Don't output full logs, just the commit that the build is for. And use the author, not the committer, since GitHub is almost always the committer on develop.
This is the less hacky way to keep scratch-* packages up to date (and any others in the future). This is only necessary because we cache the node_modules directory.
With node_modules cached, npm install sees the scratch-* dependencies satisfied (since if any version 0.1.0-prepublish.x satisfies ^0.1.0-prepublish). So remove these before the install step to ensure the latest version is installed.
Authenticate with NPM via .npmrc and publish the package version + "-[git sha]".
Remove vm and vm.min.js, they'll be built before the package is published to NPM and available on installation. When installing from git, the build step will run on npm install.