Yarn: Make `yarn install --ignore-scripts` more specific

Created on 13 Jun 2019  路  5Comments  路  Source: yarnpkg/yarn

Do you want to request a feature or report a bug?
I would like to request a feature.

What is the current behavior?
yarn install --ignore-scripts ignores all scripts, including the postinstall script of your project and those of your project's dependencies.

What is the desired behavior?
yarn install --ignore-scripts has options to ignore either your local postinstall script (my use case), or your dependencies' postinstall scripts (mentioned in #5450). This might work best if you can specify exactly what scripts to ignore, with something like a --ignore-scripts=local,node-sass option to ignore specific scripts.

Please mention your node.js, yarn and operating system version.
Node 10.16.0, Yarn 1.16.0, Mac OSX Mojave

Also, I am totally willing to work on this myself, so I would love it if someone from the Yarn team could let me know if this is something that would be accepted.

Most helpful comment

I can second this, would be really useful to have specific

All 5 comments

Would be useful with GitHub Actions, as recommended by https://github.com/actions/setup-node#usage

steps:
- uses: actions/checkout@v1
- uses: actions/setup-node@v1
  with:
    node-version: '10.x'
    registry-url: 'https://registry.npmjs.org'
# Skip post-install scripts here, as a malicious
# script could steal NODE_AUTH_TOKEN.
- run: npm install --ignore-scripts
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
# `npm rebuild` will run all those post-install scripts for us.
- run: npm rebuild && npm run prepare --if-present

Still no update on this after 10 months?

I can second this, would be really useful to have specific

I was doing a quick google search today looking for this very feature, just to give maintainers a feel for the need for this.

My specific usecase is to do a limited install of eslint for CI.

Well, being able to run yarn install --ignore-script postinstall would be tremendously useful with any Angular 9+ application. Since everything is transitioning to ivy it would give you the ability to skip the lengthy ngcc --properties es2015 browser module main --first-only --create-ivy-entry-points step.

Was this page helpful?
0 / 5 - 0 ratings