fix(ci-cd): add ignore-scripts to avoid lifecycle execution

[piyushsinghgaur1]

Description

Addresses the SonarQube finding on the release workflow flagging npm lifecycle-script execution during the publish step. npx semantic-release@25.0.5 was resolving and running a package straight from the registry with lifecycle scripts enabled, which lets arbitrary preinstall/postinstall code from the dependency tree run inside the release job — a job that holds contents: write, id-token: write and the release GH PAT.

Passing --ignore-scripts stops those lifecycle hooks from executing while still installing and running semantic-release itself, closing the hotspot without changing release behaviour.

Also normalised the inline-comment spacing in the same file so it matches the repo's YAML formatting.

Fixes # (sonar hotspot on .github/workflows/release.yaml)

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• Change is scoped to .github/workflows/release.yaml; no application/source code touched, so runtime behaviour and the published package are unaffected.
• YAML parses and the workflow structure is unchanged apart from the npx flag and comment spacing.
• End-to-end verification requires a workflow_dispatch run of the Release workflow, which publishes to npm — to be confirmed on the next real release.

Checklist:

• Performed a self-review of my own code
• npm test passes on your machine (unchanged — no source files modified)
• New tests added or existing tests modified to cover all changes (n/a — CI workflow change)
• Code conforms with the style guide
• API Documentation in code was updated (n/a)
• Any dependent changes have been merged and published in downstream modules

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud