Harden reusable Yarn installs

[9larsons]

What changed

• pass --ignore-scripts to frozen Yarn installs in both reusable downstream workflows
• remove the conditional yarn global add lerna@^4 step from the reusable test workflow
• retain the existing Yarn Classic cache, frozen-lockfile behavior, Node matrix, tests, lint, coverage, and notifications

Why

These shared workflows previously allowed any direct or transitive dependency lifecycle script to execute in CI. The test workflow also installed a moving global Lerna 4 range outside the consumer lockfile.

The current public caller inventory contains two repositories:

• TryGhost/SDK calls test.yml and already pins local lerna@9.0.7
• TryGhost/eslint-plugin-ghost calls lint-only.yml

Both consumers pass after a clean scripts-disabled install. SDK's normal yarn test command resolves its local Lerna binary, so no global executable or lifecycle-script exception is required.

Tracks PLA-317.

Validation

• actionlint on test.yml, lint-only.yml, and repo-ci.yml
• TryGhost/SDK: yarn --prefer-offline --frozen-lockfile --ignore-scripts
• TryGhost/SDK: yarn test; all 17 Lerna projects passed lint and tests using local lerna@9.0.7
• TryGhost/eslint-plugin-ghost: yarn --prefer-offline --frozen-lockfile --ignore-scripts
• TryGhost/eslint-plugin-ghost: yarn lint
• git diff --check

No install-script exception was required.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e486e68e-b3cb-4d7a-8978-e4bf8688ace7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}