fix: do not allow importing dev deps from lib/bin

[tjenkinson]

References

Refs npm/template-oss#316
Needed by npm/node-semver#559

[wraithgar]

Now we're talking. Tested this in a local branch

$ npm run lint

> ssri@10.0.2 lint
> eslint "**/*.js"


/Users/wraithgar/Development/npm/ssri/branches/main/lib/index.js
  3:13  error  'tap' should be listed in the project's dependencies, not devDependencies  import/no-extraneous-dependencies

✖ 1 problem (1 error, 0 warnings)

[wraithgar]

Gonna give @lukekarrys a few days to weigh in since he's done more work on these rules than I have.

[lukekarrys]

This is great, thank you @tjenkinson!

[wraithgar]

Need to do some housekeeping on this repo before we can publish.

The irony is we'll have to work around this rule in node-semver since it has an exception to having its code in ./lib.

This was still the right choice because we really want to centrally manage this opinion across our 80+ repos, not just piecemeal it.

[tjenkinson]

The irony is we'll have to work around this rule in node-semver since it has an exception to having its code in ./lib.

Is there a reason it’s an exception? If not wondering if it could be updated to move things into a lib dir, instead of having a custom config?

[tjenkinson]

Ah nevermind I see the readme advertises importing directly from the other dirs

[wraithgar]

we opted not to change node-semver cause it was deemed a disruptive semver major change.