From 19b4d1e990bec64818914c40230bde93a0de300b Mon Sep 17 00:00:00 2001
From: zaniebot <zaniebot@accounts.zanie.blue>
Date: Thu, 20 Aug 2026 10:38:03 -0500
Subject: [PATCH] Harden npm install defaults (#1026)

CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Set `ignore-scripts = true` in `.npmrc`
so developer and maintenance installs use the same default. Keep the
existing seven-day `min-release-age` policy for new resolutions. Require
`npm>=11.10.0` through `engines.npm` and `engine-strict`, while
retaining `devEngines` for newer clients; older installers can otherwise
ignore `devEngines` and the age setting. Pin the build and checksum
workflows to Node.js `24.19.0` so their bundled `npm` supports the
policy. Explicit project commands such as `npm run package` remain
available.

Related: astral-sh/ruff-action#401 applies the matching `npm` defaults,
and astral-sh/ruff-action#411 adds the same legacy-aware version floor.
astral-sh/ruff#27837 applies the install-script default to Ruff's
JavaScript projects. astral-sh/setup-uv#1027 separately adds
registry-signature and provenance verification.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
---
 .npmrc            |  2 ++
 .nvmrc            |  2 +-
 package-lock.json |  3 +++
 package.json      | 10 ++++++++++
 4 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/.npmrc b/.npmrc
index b435032..a22c5b4 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,3 @@
+engine-strict = true
+ignore-scripts = true
 min-release-age = 7
diff --git a/.nvmrc b/.nvmrc
index a45fd52..60ade1a 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-24
+24.19.0
diff --git a/package-lock.json b/package-lock.json
index 5a2265f..0f5da7d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -30,6 +30,9 @@
         "js-yaml": "^5.2.3",
         "ts-jest": "^29.4.11",
         "typescript": "^6.0.3"
+      },
+      "engines": {
+        "npm": ">=11.10.0"
       }
     },
     "node_modules/@actions/cache": {
diff --git a/package.json b/package.json
index 2816ee0..756a1b9 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,16 @@
   "type": "module",
   "description": "Set up your GitHub Actions workflow with a specific version of uv",
   "main": "dist/setup/index.cjs",
+  "engines": {
+    "npm": ">=11.10.0"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "version": ">=11.10.0",
+      "onFail": "error"
+    }
+  },
   "scripts": {
     "build": "tsc --noEmit",
     "check": "biome check --write",