Security: Disable yarn postinstall scripts

[ChristopherChudzicki]

This PR was generated automatically via a script.

This PR disables yarn's postinstall scripts by setting enableScripts: false in .yarnrc.yml. It is part of:

• https://github.com/mitodl/hq/issues/8676

Why this change?

Disabling postinstall scripts improves security by:

• Preventing malicious code execution: Stops potentially harmful scripts from running during package installation
• Supply chain security: Reduces risk from compromised packages that could execute malicious postinstall scripts
• Controlled execution: Allows manual review and execution of necessary scripts only when needed

What changed?

• Added enableScripts: false to .yarnrc.yml

Impact

• Some packages may require manual script execution if they depend on postinstall hooks
• Improved security posture against supply chain attacks
• No functional changes to core application code

This is a security best practice recommended for production applications to prevent potential malicious code execution during package installation.

[gemini-code-assist]

Summary of Changes

Hello @ChristopherChudzicki, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the project's security posture by disabling Yarn's postinstall scripts. This change is a recommended security best practice, preventing the automatic execution of potentially malicious code during package installation and mitigating risks associated with supply chain attacks. While some packages might require manual script execution, the primary goal is to bolster security without impacting core application functionality.

Highlights

• Security Enhancement: Disabled Yarn's postinstall scripts by setting "enableScripts: false" in ".yarnrc.yml" to prevent malicious code execution during package installation.
• Supply Chain Security: Improved supply chain security by reducing the risk of compromised packages executing harmful postinstall scripts.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request improves security by disabling yarn's postinstall scripts, which is a commendable security best practice. The change correctly implements this by adding enableScripts: false to .yarnrc.yml. My review highlights a resulting maintainability issue: the project's own postinstall script in package.json is now disabled but still present, which could cause confusion. I've recommended addressing this in a follow-up to improve project clarity.

[gemini-code-assist]

While this is a good security enhancement, it also disables the project's own postinstall script defined in package.json:

"postinstall": "./webpack_if_prod.sh"

This script will no longer run automatically after yarn install, which can be confusing for developers who see the script in package.json and expect it to run.

To improve clarity and maintainability, I recommend removing the postinstall script from package.json in a follow-up PR. The build step (./webpack_if_prod.sh) should then be explicitly integrated into your CI/CD pipeline for production builds. This makes the build process more transparent and avoids reliance on postinstall hooks.