allow local PRs without lockfiles to build

Author: chrisdrackett

.github/actions/setup-node/action.yml

@@ -14,5 +14,7 @@ runs:
         node-version-file: .node-version
 
     - name: Install dependencies
-      run: yarn install
+      run: yarn install --no-immutable
       shell: bash
+      env:
+        YARN_ENABLE_HARDENED_MODE: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && '1' || '0' }}