[BUG] npm prune --production rebuilds packages installed from github

[nazar-pc]

How

Current Behavior

npm prune --production re-runs install and postinstall scripts (at least) for packages installed from GitHub with github: prefix.

Steps to Reproduce

1. Have a package in production dependencies installed from GitHub with install or postinstall script, for instance this:

...
"mediasoup": "github:versatica/mediasoup#v3"
...

2. With package-lock.json in place do:

npm ci
npm prune --production

Expected Behavior

npm prune --production only removed packages and doesn't cause re-building of native packages.

Other details

This doesn't happen when installing the same package from NPM registry.

References

Initially reported at versatica/mediasoup#417

~> npm --version
6.14.5

[dalyr95]

Same issue, here's my heroku build log.

tl:dr
npm prune is run
our storybook git module's postinstall is run and fails because CROSS-ENV isn't installed anymore

-----> Pruning devDependencies
       
       > husky@4.2.5 preuninstall node_modules/husky
       > node husky uninstall
       
       husky > Uninstalling git hooks
       fatal: not a git repository (or any parent up to mount point /)
       Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
       husky > Failed to uninstall
       
       > motorway-storybook@github:motorway/motorway-storybook#daa0ab7ad8fe06b7fa10bbfe1f737044725725d4 postinstall node_modules/motorway-storybook
       > cross-env NODE_ENV=production npm run build
       
       sh: 1: cross-env: not found
       npm ERR! code ELIFECYCLE
       npm ERR! syscall spawn
       npm ERR! file sh
       npm ERR! errno ENOENT
       npm ERR! motorway-storybook@github:motorway/motorway-storybook#daa0ab7ad8fe06b7fa10bbfe1f737044725725d4 postinstall: `cross-env NODE_ENV=production npm run build`

[nazar-pc]

In my case it fails to build native module and as the result after pruning (which doesn't fails for some reason) I have dependency which is broken completely.

[jordanholt]

Looking at the output of npm prune --production --dry-run --json; git dependencies are being flagged as requiring an update:

"updated": [
    {
      "action": "update",
      "name": "my-git-package",
      "version": "github:jordanholt/my-git-package#commit-ish",
      "path": "node_modules/my-git-package",
      "previousVersion": "1.0.0"
    }
]

Likely because version doesn't match the previousVersion from package.json. Is this or this the place in Arborist that's responsible for that?

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.

[nazar-pc]

@darcyclarke can you just reopen this?
I just checked and it is still an issue with NPM v7 and don't see why people that already subscribed to this issue should lose notifications because there is a new issues for this now, it doesn't make any sense.