Composer runs scripts declared by packages during install, which is convenient and means composer install executes third-party code the moment it lands. On a CI runner building a pull request, that is a stranger’s code.
composer install --no-scripts --no-plugins --prefer-dist
# then run only the ones you decided to run
composer run-script post-install-cmd--no-plugins matters as much as --no-scripts: a Composer plugin runs during dependency resolution, which is earlier still. Neither is appropriate for a normal development install, where the scripts are usually doing something necessary. The distinction is whether the lock file being installed has been reviewed, and on an untrusted branch it has not.