From ac950a670f9db21a7d46e31a8e0c421861dd5a5d Mon Sep 17 00:00:00 2001
From: fumikito <guy@hametuha.com>
Date: Tue, 31 Mar 2026 17:54:30 +0900
Subject: [PATCH] Use npm ci --ignore-scripts in deploy workflow for supply
 chain security

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d282dea..aa588b2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Install dependencies and build Assets
         run: |
           composer install --no-dev --prefer-dist
-          npm install
+          npm ci --ignore-scripts
           npm run package
 
       - name: Generate readme.txt