fix(ci): skip lifecycle scripts on CI installs

No CI job needs a compiled native module. isolated-vm landed in December 2025
and .npmrc blocked all lifecycle scripts until #5935, so CI ran green for
~7 months with it never built: next.config.ts and trigger.config.ts both
external it, every test mocks it, and the only real require lives in
isolated-vm-worker.cjs, which no CI job spawns. All three Dockerfiles already
install with --ignore-scripts and rebuild it by hand.

Building it in CI therefore buys nothing and couples every job to prebuild
availability for the pinned Node. Upstream ships prebuilds for two ABIs only
(Node 22/24), so the next setup-node bump would resurface the same opaque
node-gyp failure that broke Create GitHub Release on main.

- pass --ignore-scripts to all 8 CI bun install invocations
- retarget the Setup Node comments at engines.node >= 22.19.0, which is the
  standalone reason for the pin now that scripts no longer run

Author: waleedlatif1

.github/workflows/ci.yml

@@ -186,9 +186,8 @@ jobs:
         with:
           bun-version: 1.3.13
 
-      # Required: bun install runs isolated-vm's install script, and upstream
-      # only publishes prebuilds for Node 22/24. On the runner default (Node 20)
-      # it falls back to a node-gyp build that crashes on Node 20.
+      # Repo scripts target engines.node >= 22.19.0; without this the job runs on
+      # the runner default (Node 20).
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
@@ -206,7 +205,7 @@ jobs:
             ${{ runner.os }}-bun-
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Deploy to Trigger.dev
         working-directory: ./apps/sim
@@ -591,16 +590,15 @@ jobs:
         with:
           bun-version: 1.3.13
 
-      # Required: bun install runs isolated-vm's install script, and upstream
-      # only publishes prebuilds for Node 22/24. On the runner default (Node 20)
-      # it falls back to a node-gyp build that crashes on Node 20.
+      # Repo scripts target engines.node >= 22.19.0; without this the job runs on
+      # the runner default (Node 20).
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Create release
         env:

.github/workflows/docs-embeddings.yml

@@ -41,7 +41,7 @@ jobs:
             ${{ runner.os }}-bun-
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Process docs embeddings
         working-directory: ./apps/sim

.github/workflows/migrations.yml

@@ -36,9 +36,8 @@ jobs:
         with:
           bun-version: 1.3.13
 
-      # Required: bun install runs isolated-vm's install script, and upstream
-      # only publishes prebuilds for Node 22/24. On the runner default (Node 20)
-      # it falls back to a node-gyp build that crashes on Node 20.
+      # Repo scripts target engines.node >= 22.19.0; without this the job runs on
+      # the runner default (Node 20).
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
@@ -56,7 +55,7 @@ jobs:
             ${{ runner.os }}-bun-
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       # The expression maps the explicit environment input to exactly one repo
       # secret, so the job never holds another environment's database URL. An

.github/workflows/publish-cli.yml

@@ -41,7 +41,7 @@ jobs:
 
       - name: Install dependencies
         working-directory: packages/cli
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Build package
         working-directory: packages/cli

.github/workflows/publish-ts-sdk.yml

@@ -40,7 +40,7 @@ jobs:
             ${{ runner.os }}-bun-
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Run tests
         working-directory: packages/ts-sdk

.github/workflows/test-build.yml

@@ -60,7 +60,7 @@ jobs:
           path: ./.turbo
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       # Surfaces known CVEs in the dependency tree. Non-blocking until the
       # existing advisory backlog is triaged, then flip to a required gate by
@@ -278,7 +278,7 @@ jobs:
           fi
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Build application
         env: