From 1496e690f44a2656b62c8571b4256c3a90c91206 Mon Sep 17 00:00:00 2001
From: William Woodruff <william@astral.sh>
Date: Mon, 1 Dec 2025 17:47:17 -0500
Subject: [PATCH] chore: use `npm ci --ignore-scripts` everywhere

Signed-off-by: William Woodruff <william@astral.sh>
---
 .github/copilot-instructions.md             | 4 ++--
 .github/dependabot.yml                      | 4 ++++
 .github/workflows/test.yml                  | 2 +-
 .github/workflows/update-known-versions.yml | 2 +-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 64664d2..da40ee0 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -59,7 +59,7 @@ src/
 #### 1. Install Dependencies
 
 ```bash
-npm install
+npm ci --ignore-scripts
 ```
 
 **Timing**: ~20-30 seconds
@@ -236,7 +236,7 @@ This file is the authoritative source for understanding available action paramet
 
 ### Build Failures
 
-- **"Module not found"**: Run `npm install` to ensure dependencies are installed
+- **"Module not found"**: Run `npm ci --ignore-scripts` to ensure dependencies are installed
 - **TypeScript errors**: Check `tsconfig.json` and ensure all imports are valid
 - **Test failures**: Check if test fixtures have been modified or if logic changes broke assumptions
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bb85b6f..3fd581b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,8 +4,12 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 88ee5ec..38edb2b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -33,7 +33,7 @@ jobs:
           node-version-file: .nvmrc
           cache: npm
       - run: |
-          npm install
+          npm ci --ignore-scripts
       - run: |
           npm run all
       - name: Check all jobs are in all-tests-passed.needs
diff --git a/.github/workflows/update-known-versions.yml b/.github/workflows/update-known-versions.yml
index eb2c29c..3fdc81d 100644
--- a/.github/workflows/update-known-versions.yml
+++ b/.github/workflows/update-known-versions.yml
@@ -39,7 +39,7 @@ jobs:
           fi
       - name: Compile changes
         if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
-        run: npm ci && npm run all
+        run: npm ci --ignore-scripts && npm run all
       - name: Commit and push changes
         if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
         id: commit-and-push