#4699: analyzer/npm :: Add usage of --ignore-scripts parameter to "npm ci" in order to prevent unnecessary and risky script execution

[rockebee]

PR attempts to use --ignore-scripts parameter also in npm ci cases, not only for npm install.
(cmp. #4699 for respective issue description)

[mnonnenmacher]

@rockebee Thank you for the contribution. Please sign your commit message (see the failing DCO check) and reformat it to match our standards, for example like so:

Npm: Add `--ignore-scripts` to `npm ci`

Add usage of `--ignore-scripts` to the `npm ci` call in order to prevent
unnecessary and risky script execution.

Fixes #4699.

[sschuberth]

Quoting @rockebee from #4699:

Caveat: ignore-scripts was introduced with NPM 5.7.0 (together with npm ci itself), but was not supported in NPM versions 7.0.0 < 7.4.0 (link)

So, should we change the code to only pass --ignore-scripts to npm ci for version 5.7.0 to 7.0.0, or versions above 7.4.0?

[mnonnenmacher]

Quoting @rockebee from #4699:

Caveat: ignore-scripts was introduced with NPM 5.7.0 (together with npm ci itself), but was not supported in NPM versions 7.0.0 < 7.4.0 (link)

So, should we change the code to only pass --ignore-scripts to npm ci for version 5.7.0 to 7.0.0, or versions above 7.4.0?

I understood the PR so that the option was still present but simply not working from 7.0.0-7.4.0.

[sschuberth]

I understood the PR so that the option was still present but simply not working from 7.0.0-7.4.0.

Ah, ok. Then of course the code should be fine as-is.

[rockebee]

@mnonnenmacher @sschuberth, thx for feedback. Commit message is now signed properly and commit message modified as suggested.
I agree that IMHO there is no need to exclude NPM versions 7.0.0 to < 7.4.0, as npm ci itself is properly working, just the --ignore-scripts flag was not working and ignored.

[sschuberth]

Nit: There needs to be a blank line between

Fixes #4699.
Signed-off-by: Stefan Schwenkenbecher <38685542+rockebee@users.noreply.github.com>

to separate the body from the footer.

Comments addressed.