chore: move snyk and renovate to devDependencies

Installation of snyk and renovate can be skipped through '--only=prod' flag

.gitlab-ci.yml

@@ -10,7 +10,8 @@ before_script:
 test:
   script:
     - apk add patch # Install GNU version of patch for snyk
-    - npm run build
+    - npm run snyk # Refer to "scripts" in package.json
+    - npm run hexo
 
   only:
     - master # only trigger when 'master' branch is pushed
@@ -20,7 +21,8 @@ renovate: # Check dependency update
     - npm run renovate
 
   only:
-    - schedules # only triggered by schedules
+    - schedules # trigger build by schedules
+    - web # trigger through "Run pipeline" button in GitLab.com
 
 
 # # Uncomment below (and comment/remove above) lines for gitlab pages

package.json

@@ -6,7 +6,8 @@
     "version": "3.8.0"
   },
   "scripts": {
-    "build": "snyk auth $SNYK_TOKEN && snyk protect && snyk test && snyk monitor && hexo generate",
+    "hexo": "hexo generate",
+    "snyk": "snyk auth $SNYK_TOKEN && snyk protect && snyk test && snyk monitor",
     "renovate": "renovate --token $BOT_TOKEN --platform 'gitlab' --onboarding false --update-lock-files false --labels 'renovate' --recreate-closed true curben/blog"
   },
   "dependencies": {
@@ -21,7 +22,9 @@
     "hexo-renderer-marked": "^0.3.2",
     "hexo-renderer-stylus": "^0.3.3",
     "hexo-server": "^0.3.3",
-    "hexo-yam": "^1.0.3",
+    "hexo-yam": "^1.0.4"
+  },
+  "devDependencies": {
     "renovate": "^13.110.1",
     "snyk": "^1.105.0"
   }