fix: exclude non-root README.md/LICENSE files

[AaronHamilton965]

Summary

Currently, package publishers are not able to exclude non-root readme and license/licence files when publishing or packing their packages, as they are always strictly included.

This solution allows users to exclude non-root readme and license/licence files by excluding them in the files array inside package.json.

Added a new function called excludeNonRoot, which removes readme, license, or licence from the strictDefaults array, and adds the inverse of the file to the defaults array. This allows the root files to remain, while non roots are ignored.

Additionally, if users would like to, they can also exclude readme, license, or licence files from specific folders, for example: "!lib/**/README.md"

However, if users do not want to use this behavior, they can simply not include !readme, !license, or !licence and the original behavior will be preserved, meaning that ALL of those files, root or non-root, will be included.

Tap Test

npm test
All results pass

Dummy Project

Installed the npm cli repository, and added our changes to the npm-packlist’s index.js under node_modules.

Installed stylelint repository to have a dummy project for testing.
Make changes to package.json

alias localnpm="node /workspaces/cli/"
localnpm pack --dry

See which files are included/excluded

References

cli issue - 6341

[rahulio96]

This is for excluding non-root/nested readme and license files NOT top-level readme files, as those will always be included.

Sorry if the title was a little misleading, that's my fault. I was just trying to match it up with the original issue's title.

[ljharb]

Does this also work for .npmignore, not just files?

[rahulio96]

We only tested it with the package.json files array, as it's what we thought the issue was calling for.

It likely does not work with .npmignore, as the function is being called inside another function that seems to deal with only package.json (processPackage)

[wraithgar]

It looks like what we're doing is marking certain entries in strictDefaults as "all levels" or "root only".

Would it be possible for the new lines to be powered by a distinct set of values like strictDefaults and defaults, instead of three individual lines? Also, is there a reason that copying is not part of this new logic? If we say all of the entries in strictDefaults except .git is part of this new logic, can we refactor things to make it more clear? We'd have one for "all levels" and one for "root only"

Hope this makes sense. I think you're on the right track.

[ljharb]

It likely does not work with .npmignore, as the function is being called inside another function that seems to deal with only package.json (processPackage)

that implies that the bug also doesn't exist with npmignore, which would be a good thing :-)

[rahulio96]

Hi again, sorry for the late reply, got caught up with something else.

Ok, I think I understand what you want us to do, and we'll be looking into it soon, just not sure about what you said here:

Also, is there a reason that copying is not part of this new logic?

[wraithgar]

copying refers to

npm-packlist/lib/index.js

Line 43 in 21ed893

'!/copying{,.*[^~$]}',

[rahulio96]

@wraithgar Just saw the comment you left via email but can't find it on GitHub for some reason. Do you want us to bring back the strings to rootOnly or keep it as is?

[wraithgar]

@rahulio96 I deleted my suggestion as you'd already implemented it and it wasn't a very strong opinion.

[wraithgar]

So far so good. I think it is potentially confusing having this work one way for files but not for .npmignore.

While not a deal breaker, I think that this at least deserves clarification in the README so folks know that you can't "unignore" readme (etc) files, but you can explicitly include them in the files array.

[rahulio96]

Yeah I can get to work on updating the README description soon.

[wraithgar]

Thanks! It'd be great to get this into npm 10 before it goes GA. We can make this a breaking change out of an abundance of caution and keep things tidy.

[rahulio96]

Thank you both for your time, patience, and feedback, it was much appreciated!

[XhmikosR]

Could we maybe get this patch backported to the npm-packlist version that npm 9.x is using too?

[wraithgar]

No this was considered a breaking change which is why it was held off till npm 10.