Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Git dependency prepare script running with --package-lock-only #3300

Closed
1 task done
feelepxyz opened this issue May 24, 2021 · 3 comments
Closed
1 task done

Git dependency prepare script running with --package-lock-only #3300

feelepxyz opened this issue May 24, 2021 · 3 comments
Labels
Bug thing that needs fixing Needs Triage needs review for next steps Release 7.x work is associated with a specific npm 7 release

Comments

@feelepxyz
Copy link
Contributor

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

👋 I've just run into this in dependabot when trying to update discord.js. The following command fails: npm install discord.js@github:discordjs/discord.js#b376f31af9881b9cd3f82ac4a42a468947cce482 --ignore-scripts --package-lock-only with:

npm ERR! code 127
npm ERR! path /Users/feelepxyz/.npm/_cacache/tmp/git-clone-e8ed8817
npm ERR! command failed
npm ERR! command sh -c husky install
npm ERR! sh: husky: command not found

It looks like this prepare script is running with the above install. It passes without --package-lock-only.

There is a similar issue about the projects lifecycle hooks but this seems subtly different as it's about git dependencies: #2787

Expected Behavior

The command npm install discord.js@github:discordjs/discord.js#b376f31af9881b9cd3f82ac4a42a468947cce482 --ignore-scripts --package-lock-only should successfully install.

Steps To Reproduce

  1. npm install -g npm@7.14.0
  2. npm install discord.js@github:discordjs/discord.js#b376f31af9881b9cd3f82ac4a42a468947cce482 --ignore-scripts --package-lock-only

Environment

  • OS: Mac OS Catalina 10.15.7
  • Node: v15.6.0
  • npm: 7.14
@feelepxyz feelepxyz added Bug thing that needs fixing Needs Triage needs review for next steps Release 7.x work is associated with a specific npm 7 release labels May 24, 2021
@feelepxyz
Copy link
Contributor Author

The same bug is reported here: #2920 but would be helpful if it's possible to disable running prepare scripts if --package-lock-only or --ignore-scripts are set. Either would work for dependabot's use case where we care about disabling all life-cycle hooks.

@isaacs
Copy link
Contributor

isaacs commented Jun 18, 2021

#2920 is a slightly different bug.

I could see disabling prepares when --ignore-scripts is set, but we do need to run them for the package-lock-only, or else we can't be guaranteed to get the correct results in the package-lock.json file.

Will be fixed when npm/pacote#81 lands.

@wraithgar
Copy link
Member

#1422 may also be related

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug thing that needs fixing Needs Triage needs review for next steps Release 7.x work is associated with a specific npm 7 release
Projects
None yet
Development

No branches or pull requests

3 participants