Missing ignore script updated (AST-160327) (#722)

* Ignore script related changes

* Commented first line of npmrc

* Check one lock file should be there

* added --ignore-scripts

Author: cx-aniket-shinde

.github/workflows/ci.yml

@@ -14,6 +14,18 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
+      - name: Verify single lockfile
+        run: |
+          if [ -f package-lock.json ] && [ -f yarn.lock ]; then
+            echo "ERROR: Both lockfiles exist"
+            exit 1
+          fi
+
+          if [ ! -f yarn.lock ] && [ ! -f package-lock.json ]; then
+            echo "ERROR: No lockfile found,Policy requires exactly ONE package manager lockfile"
+            exit 1
+          fi
+
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 20
@@ -26,9 +38,9 @@ jobs:
 
       - name: npm install
         run: |
-          npm install
+          npm ci --ignore-scripts
           cd cxAstScan/
-          npm install
+          npm ci --ignore-scripts
 
       - name: Code Linting
         run: npm run lint

.github/workflows/release.yml

@@ -41,6 +41,18 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
+      - name: Verify single lockfile
+        run: |
+          if [ -f package-lock.json ] && [ -f yarn.lock ]; then
+            echo "ERROR: Both lockfiles exist"
+            exit 1
+          fi
+
+          if [ ! -f yarn.lock ] && [ ! -f package-lock.json ]; then
+            echo "ERROR: No lockfile found,Policy requires exactly ONE package manager lockfile"
+            exit 1
+          fi
+
       - name: Set Extension and Publisher ID
         run: |
           if [ "${{ inputs.dev }}" == "true" ]; then
@@ -114,9 +126,9 @@ jobs:
 
       - name: Build step
         run: |
-          npm install
+          npm ci --ignore-scripts
           cd cxAstScan/
-          npm install
+          npm ci --ignore-scripts
 
       - run: npm run build
 

.github/workflows/update-js-runtime-wrapper.yml

@@ -22,6 +22,18 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
+      - name: Verify single lockfile
+        run: |
+          if [ -f package-lock.json ] && [ -f yarn.lock ]; then
+            echo "ERROR: Both lockfiles exist"
+            exit 1
+          fi
+
+          if [ ! -f yarn.lock ] && [ ! -f package-lock.json ]; then
+            echo "ERROR: No lockfile found,Policy requires exactly ONE package manager lockfile"
+            exit 1
+          fi
+
       - name: Determine Version
         id: get_version
         run: |
@@ -59,9 +71,9 @@ jobs:
 
       - name: Build step
         run: |
-          npm install
+          npm ci --ignore-scripts
           cd cxAstScan/
-          npm install
+          npm ci --ignore-scripts
 
       - name: Commit Changes
         run: |

.npmrc

@@ -1,8 +1,11 @@
-Default registry for most packages
+# Default registry for most packages
 registry=https://npm.echohq.com/
- 
+
 # GitHub Packages scope
 @Checkmarx:registry=https://npm.pkg.github.com/
- 
+
 # GitHub Packages auth
-//npm.pkg.github.com/:_authToken=
+//npm.pkg.github.com/:_authToken=
+
+# Supply Chain Security Policy: Block lifecycle scripts
+ignore-scripts=true