ci: disallow installation scripts before publish

Author: sapphi-red

.github/workflows/publish.yml

@@ -27,6 +27,9 @@ jobs:
           # disable cache, to avoid cache poisoning (https://docs.zizmor.sh/audits/#cache-poisoning)
           package-manager-cache: false
 
+      - name: Disallow installation scripts
+        run: yq '.onlyBuiltDependencies = []' -i pnpm-workspace.yaml
+
       - name: Install deps
         run: pnpm install
         env:

.github/workflows/release-continuous.yml

@@ -29,6 +29,9 @@ jobs:
           # disable cache, to avoid cache poisoning (https://docs.zizmor.sh/audits/#cache-poisoning)
           package-manager-cache: false
 
+      - name: Disallow installation scripts
+        run: yq '.onlyBuiltDependencies = []' -i pnpm-workspace.yaml
+
       - name: Install dependencies
         run: pnpm install