Use --ignore-scripts in release and preview-release installs

[matthewp]

Summary

• Adds --ignore-scripts to all pnpm install calls in release.yml and preview-release.yml
• Prevents transitive packages from running lifecycle scripts (postinstall, prepare, etc.) in these privileged contexts that have id-token: write

Even with a frozen lockfile, a compromised dependency could execute arbitrary code during install via lifecycle scripts. --ignore-scripts closes that vector.

Part of supply chain hardening in response to the TanStack/Mini Shai-Hulud compromise.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c2d3850

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[delucis]

If the intention is to block dependency scripts, we should probably configure allowBuilds to explicitly disable packages with known scripts instead. (By default, pnpm will already block script execution in dependencies on install). We could also enable strictDepBuilds to get an error for any build scripts we haven’t set a policy for if we want.

It’s a bit pointless adding this flag unless we also want to block scripts in our own packages inside the monorepo, so I’d suggest not adding it unless that’s the intent (AI is very happy to write these comments, but doesn’t mean they’re correct 😄)

[ematipico]

Prevents transitive packages from running lifecycle scripts

Are you sure it's correct? The pnpm docs say something different

Do not execute any scripts defined in the project package.json and its dependencies.

[matthewp]

Putting it into draft since @delucis is doing a pnpm 11 upgrade.

[matthewp]

Closing in favor of #16716