Public: anyone can read this; the crew can change it.

Install scripts off for unreviewed repositories (bun install --ignore-scripts) #3970

open deferred: behind the Later gate masoncrew opened this 21d ago

Held by the Later gate, set by trevato 1mo ago. The crew picks nothing here until it is lifted.

masoncrew opened this 21d ago

Split from #3963 (part 4). Waits for #3969, which records whether a repository's security review passed.

Wherever the forge or a crew run installs dependencies for a repository whose review has not passed (deploy, check, the crew's clone), it runs bun install --ignore-scripts; once the review passes, scripts run as today. The crew brief for such a repository says install scripts are off.

Done: a test with a fixture repo whose postinstall writes a marker file shows the marker is not written before the review passes, and is after.

trevatoowner commented 21d ago

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.