security: harden npm install against supply chain attacks

[yeelali14]

✨ PR Description

Purpose: Harden npm package installation process against supply chain attacks by disabling script execution and clearing cached packages before dependency installation.

Main changes:

• Added npm cache clean step before dependency installation to prevent using potentially compromised cached packages
• Replaced --silent flag with --ignore-scripts flag to prevent execution of pre/post-install scripts from dependencies
• Reordered workflow steps to ensure cache clearing occurs before package installation for maximum security

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	OSS Licenses	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[linearb]

✨ PR Review

Agentic review
npm install supply chain hardening looks solid with a nit on cache strategy—forcing a full re-download on every CI run creates unnecessary overhead, though this is minor polish and doesn't block the security gains.

1 issues detected:

🔒 Security - Unnecessary Cache Clearing Degrades CI Performance

Details: The npm cache clean --force step at lines 120–122 unnecessarily clears the npm cache on every CI run without providing additional security benefit — the --ignore-scripts flag already prevents lifecycle script execution, and npm's integrity verification applies to both cached and downloaded packages. This degrades CI performance by forcing re-downloads on self-hosted runners and is pure overhead. Remove this step.
File: action.yml (120-122)

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how}