chore: prevent dependency lifecycle scripts

[puckowski]

• Prevent dependency lifecycle scripts during CI work.

What:

Prevent dependency lifecycle scripts from running during CI work.

Why:

Dependency lifecycle scripts should be unnecessary for Less.js CI needs.

Checklist:

• Documentation
• Added/updated unit tests
• Code complete

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflows to run pnpm install with lockfile consistency enforced and install-time lifecycle scripts disabled across build, release PR creation, and publishing pipelines.
  • This improves determinism and safety of dependency installs; no changes to public APIs or runtime behavior.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 85d45d8a-755e-4a81-8520-7d59f94bb7d8

📥 Commits

Reviewing files that changed from the base of the PR and between 6f0cf97 and 1228dfa.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/create-release-pr.yml

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/create-release-pr.yml
• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

Three GitHub Actions workflows were updated so their pnpm install commands include --ignore-scripts; the CI workflow also uses --frozen-lockfile during install.

Changes

Install script suppression across CI workflows

Layer / File(s)	Summary
CI install step .github/workflows/ci.yml	Replaced pnpm install with pnpm install --frozen-lockfile --ignore-scripts, enforcing lockfile consistency and disabling package lifecycle scripts during CI runs.
Create-release-pr install step .github/workflows/create-release-pr.yml	Added --ignore-scripts to the existing pnpm install --frozen-lockfile command used when preparing release PRs.
Publish workflow install step .github/workflows/publish.yml	Added --ignore-scripts to the existing pnpm install --frozen-lockfile command used in the publish workflow.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hop through YAML, gentle and spry,
Quiet installs under a lockfile sky.
Scripts stay sleeping, builds hum on cue,
Cozy workflows—nice and true.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: prevent dependency lifecycle scripts' accurately and concisely summarizes the main change across all three workflow files, which consistently add the --ignore-scripts flag to pnpm install commands.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}