Security maintenance (#595)

* chore(dependabot): cool-down to 5 days

* chore: ignore NPM scripts & add save-exact to pin deps by default

Author: fraxken

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 5
     groups:
       github-actions:
         patterns:
@@ -14,6 +16,8 @@ updates:
     versioning-strategy: widen
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 5
     groups:
       dependencies:
         dependency-type: "production"

.github/workflows/cache.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
-        run: npm install
+        run: npm install --ignore-scripts
       - name: Build
         run: npm run build:all
       - name: Run tests

.github/workflows/nodejs.yml

@@ -28,7 +28,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
-        run: npm install
+        run: npm install --ignore-scripts
       - name: Build
         run: npm run build --ws --if-present
       - name: Run tests

.github/workflows/npm-provenance.yml

@@ -20,7 +20,7 @@ jobs:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
       - run: npm install -g npm
-      - run: npm install
+      - run: npm install --ignore-scripts
       - run: npm publish --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/server.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
-        run: npm install
+        run: npm install --ignore-scripts
       - name: Build
         run: npm run build:all
       - name: Run tests

.github/workflows/size-satisfies.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
-        run: npm install
+        run: npm install --ignore-scripts
       - name: Build
         run: npm run build:all
       - name: Run tests

.github/workflows/vis-network.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
-        run: npm i
+        run: npm install --ignore-scripts
       - name: Build
         run: npm run build:all
       - name: Run tests

.npmrc

@@ -1,2 +1,4 @@
 package-lock=false
 provenance=true
+save-exact=true
+ignore-scripts=true