Add @lavamoat/allow-scripts (#58)

`@lavamoat/allow-scripts` is now used to selectively run post-install
scripts. A `.yarnrc` file has been added to ensure post-install scripts
are disabled by default, and the CI configuration has been updated to
include the post-install script step.

The `setup` npm script has been added to make installing dependencies
easier, and the standard contributor documentation has been added to
explain this command (and the linting commands).

.github/workflows/build-lint.yml

@@ -21,6 +21,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - run: yarn --frozen-lockfile
+      - run: yarn allow-scripts
       - run: yarn build
       - run: yarn lint
   all-jobs-pass:

.yarnrc

@@ -0,0 +1 @@
+ignore-scripts true

README.md

@@ -52,3 +52,17 @@ viewer.stopAnimation()
 
 First, rebuild `browserify example/example.js -o bundle.js`.
 Then, run a local server in this folder and visit it. For example, `http-server`.
+
+## Contributing
+
+### Setup
+
+- Install [Node.js](https://nodejs.org) version 12
+  - If you are using [nvm](https://github.com/creationix/nvm#installation) (recommended) running `nvm use` will automatically choose the right node version for you.
+- Install [Yarn v1](https://yarnpkg.com/en/docs/install)
+- Run `yarn setup` to install dependencies and run any requried post-install scripts
+  - **Warning:** Do not use the `yarn` / `yarn install` command directly. Use `yarn setup` instead. The normal install command will skip required post-install scripts, leaving your development environment in an invalid state.
+
+### Testing and Linting
+
+Run `yarn lint` to run the linter, or run `yarn lint:fix` to run the linter and fix any automatically fixable issues.

package.json

@@ -7,6 +7,7 @@
     "node": ">=12.0.0"
   },
   "scripts": {
+    "setup": "yarn install && yarn allow-scripts",
     "build": "yarn bundle normal && yarn bundle gradient && yarn bundle recolor && yarn bundle distort && yarn bundle beta",
     "bundle": "./example/build.sh",
     "convert": "node convert.js > fox.json",
@@ -28,6 +29,7 @@
     "gl-vec3": "1.0.3"
   },
   "devDependencies": {
+    "@lavamoat/allow-scripts": "^1.0.6",
     "@metamask/auto-changelog": "^2.3.0",
     "@metamask/eslint-config": "^3.2.0",
     "browserify": "^16.5.2",
@@ -45,5 +47,10 @@
   "bugs": {
     "url": "https://github.com/MetaMask/logo/issues"
   },
-  "homepage": "https://github.com/MetaMask/logo#readme"
+  "homepage": "https://github.com/MetaMask/logo#readme",
+  "lavamoat": {
+    "allowScripts": {
+      "@lavamoat/preinstall-always-fail": false
+    }
+  }
 }