From 73ffad43aa40c983358b6c8ef244230db17c3ff2 Mon Sep 17 00:00:00 2001
From: zaniebot <zaniebot@accounts.zanie.blue>
Date: Wed, 19 Aug 2026 09:39:35 -0500
Subject: [PATCH] Disable `npm` install scripts by default (#27837)

The playground workflows disable dependency lifecycle scripts, but
ordinary local installs in the playground, its API, and the ty benchmark
project still enable them. Set `ignore-scripts` in each project's
`.npmrc` so the same default applies outside CI, while preserving the
existing seven-day release-age policy. Because `ignore-scripts` also
suppresses first-party pre/post hooks, the playground's `build`,
`dev:build`, and `start` commands invoke their required WASM preparation
explicitly. The datastore instructions now install from the API lockfile
and invoke its local Wrangler instead of allowing `npx` to resolve a
separate dependency tree.

Related: astral-sh/ruff-vscode#1151 and astral-sh/ty-vscode#525 apply
the same install-script default to the editor extensions.
astral-sh/ruff#27844 enforces the cooldown-supporting `npm` floor,
astral-sh/ruff#27842 hardens the native `prek` formatter environment,
and astral-sh/ruff#27838 locks the playground deployment toolchain.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
---
 .github/workflows/ci.yaml    | 2 +-
 playground/.npmrc            | 1 +
 playground/README.md         | 7 +++----
 playground/api/.npmrc        | 1 +
 playground/ruff/package.json | 9 +++------
 playground/ty/package.json   | 9 +++------
 scripts/ty_benchmark/.npmrc  | 1 +
 7 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 871c90fea5..90afa09fe5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1075,7 +1075,7 @@ jobs:
         run: npm ci --ignore-scripts
         working-directory: playground
       - name: "Build playgrounds"
-        run: npm run dev:wasm
+        run: npm run dev:build
         working-directory: playground
       - name: "Run TypeScript checks"
         run: npm run check
diff --git a/playground/.npmrc b/playground/.npmrc
index 63f6c7a891..a22c5b4c3b 100644
--- a/playground/.npmrc
+++ b/playground/.npmrc
@@ -1,2 +1,3 @@
 engine-strict = true
+ignore-scripts = true
 min-release-age = 7
diff --git a/playground/README.md b/playground/README.md
index 776d91f8d1..eaffd2b189 100644
--- a/playground/README.md
+++ b/playground/README.md
@@ -13,10 +13,9 @@ module.
 
 To run the datastore, which is based
 on [Workers KV](https://developers.cloudflare.com/workers/runtime-apis/kv/),
-install the [Wrangler CLI](https://developers.cloudflare.com/workers/wrangler/install-and-update/),
-then run `npx wrangler@4.118.0 dev --local` from the `./playground/api` directory. Note that the datastore
-is
-only required to generate shareable URLs for code snippets. The development datastore does not
+run `npm ci --ignore-scripts` and `npm start -- --local` from the `./playground/api` directory
+to use the locked [Wrangler CLI](https://developers.cloudflare.com/workers/wrangler/install-and-update/).
+The datastore is only required to generate shareable URLs for code snippets. The development datastore does not
 require Cloudflare authentication or login, but in turn only persists data locally.
 
 ## Architecture
diff --git a/playground/api/.npmrc b/playground/api/.npmrc
index 63f6c7a891..a22c5b4c3b 100644
--- a/playground/api/.npmrc
+++ b/playground/api/.npmrc
@@ -1,2 +1,3 @@
 engine-strict = true
+ignore-scripts = true
 min-release-age = 7
diff --git a/playground/ruff/package.json b/playground/ruff/package.json
index a89da89c4e..15c1b67783 100644
--- a/playground/ruff/package.json
+++ b/playground/ruff/package.json
@@ -4,14 +4,11 @@
   "version": "0.0.0",
   "type": "module",
   "scripts": {
-    "prebuild": "npm run build:wasm",
-    "build": "vite build",
+    "build": "npm run build:wasm && vite build",
     "build:wasm": "wasm-pack build ../../crates/ruff_wasm --target web --out-dir ../../playground/ruff/ruff_wasm",
     "dev:wasm": "wasm-pack build ../../crates/ruff_wasm --dev --target web --out-dir ../../playground/ruff/ruff_wasm",
-    "predev:build": "npm run dev:wasm",
-    "dev:build": "vite build",
-    "prestart": "npm run dev:wasm",
-    "start": "vite",
+    "dev:build": "npm run dev:wasm && vite build",
+    "start": "npm run dev:wasm && vite",
     "preview": "vite preview"
   },
   "dependencies": {
diff --git a/playground/ty/package.json b/playground/ty/package.json
index e96e136b79..c7d4ff2b27 100644
--- a/playground/ty/package.json
+++ b/playground/ty/package.json
@@ -4,14 +4,11 @@
   "version": "0.0.0",
   "type": "module",
   "scripts": {
-    "prebuild": "npm run build:wasm",
-    "build": "vite build",
+    "build": "npm run build:wasm && vite build",
     "build:wasm": "wasm-pack build ../../crates/ty_wasm --target web --out-dir ../../playground/ty/ty_wasm",
     "dev:wasm": "wasm-pack build ../../crates/ty_wasm --dev --target web --out-dir ../../playground/ty/ty_wasm",
-    "predev:build": "npm run dev:wasm",
-    "dev:build": "vite build",
-    "prestart": "npm run dev:wasm",
-    "start": "vite",
+    "dev:build": "npm run dev:wasm && vite build",
+    "start": "npm run dev:wasm && vite",
     "preview": "vite preview"
   },
   "dependencies": {
diff --git a/scripts/ty_benchmark/.npmrc b/scripts/ty_benchmark/.npmrc
index 63f6c7a891..a22c5b4c3b 100644
--- a/scripts/ty_benchmark/.npmrc
+++ b/scripts/ty_benchmark/.npmrc
@@ -1,2 +1,3 @@
 engine-strict = true
+ignore-scripts = true
 min-release-age = 7