security: avoid global npm package installation

Author: vitormattos

.github/workflows/npm-build.yml

@@ -63,15 +63,14 @@ jobs:
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 
-      - name: Set up npm
-        env:
-          NPM_VERSION: ${{ steps.versions.outputs.npmVersion }}
-        run: npm install --global "npm@$NPM_VERSION"
+      - name: Enforce package engine requirements
+        run: |
+          npm --version
+          npm config set engine-strict true
 
       - name: Validate package-lock.json
         run: |
-          npm install --global npm-package-lock-add-resolved@1.1.4
-          npm-package-lock-add-resolved
+          npm exec --yes --package=npm-package-lock-add-resolved@1.1.4 -- npm-package-lock-add-resolved
           git --no-pager diff --exit-code
 
       - name: Install dependencies and build