Overview

Taking a look back at closed issues in this repo, I've seen some external issues linked back that indicated folks have been running into issues with adding --ignore-scripts to all npm calls. In hindsight, setting it by default, rather quietly, probably needed a little more consideration.

But it's where we're at now, so let's make the most of it! This PR adds an ignore-scripts input to the action (and CLI and lib) that can be set to false, for users who rely on lifecycle scripts for publish and understand the security implications.

uses: JS-DevTools/npm-publish@v2
with:
  token: ${{ secrets.NPM_TOKEN }}
  ignore-scripts: false