[BUG] --ignore-scripts is ignored, npm install runs build.

[trusktr]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm i surge -D --ignore-scripts runs scripts:

lume+lume git:develop ❯ npm i surge -D --ignore-scripts                                                                                                                                                                          ✹ ✭
npm ERR! code 2
npm ERR! path /home/trusktr/src/lume+lume/packages/element-behaviors
npm ERR! command failed
npm ERR! command sh -c npm run build
npm ERR! > element-behaviors@2.2.11 build
npm ERR! > lume build
.
.
.

Expected Behavior

It should not run scripts. In the above output, you see the build script of a package failed.

Steps To Reproduce

• Provide a reproduction

Environment

• npm: 8.3.0
• Node: 17.3.0
• OS: Pop_os! Linux
• platform: System 76 Oryx Pro (I'm lovin' it!)
• npm config:

❯ npm config ls
; "builtin" config from /home/trusktr/.npm-packages/lib/node_modules/npm/npmrc

globalignorefile = "/etc/npmignore" 
; prefix = "/usr/local" ; overridden by user

; "user" config from /home/trusktr/.npmrc

//registry.npmjs.org/:_authToken = (protected) 
prefix = "/home/trusktr/.npm-packages" 

; "project" config from /home/trusktr/src/lume+lume/.npmrc

engine-strict = true 
legacy-peer-deps = true 
package-lock = false 

; node bin location = /home/trusktr/.n-node-versions/bin/node
; cwd = /home/trusktr/src/lume+lume
; HOME = /home/trusktr
; Run `npm config ls -l` to show all defaults.

Reproduction

This can be reproduced with this repo:

https://github.com/lume/lume

Just

• clone it,
• npm run fresh to bootstrap the repo (in a Unix OS)
• then try npm install any-package-you-want -D --ignore-scripts and you'll see it runs npm scripts.

If you delete the prepare script from package.json, the problem does not go away. npm is trying to run scripts from a dependency that's already installed, it seems.

[ljharb]

That doesn’t look like surge’s script, it looks like your own.

[trusktr]

@ljharb Yeah, it's my own script of a package of mine, but I didn't think it would run if I passed --ignore-scripts.

I'm running npm i surge -D --ignore-scripts inside of home/trusktr/src/lume+lume, and home/trusktr/src/lume+lume/packages/element-behaviors is a package that I manage with Lerna.

I don't have an install script in the root of the repo. I have prepare, and build, but neither of those call lerna, so I'm not sure why a script from packages/element-behaviors is being executed.

One thing is that home/trusktr/src/lume+lume/node_modules/element-behaviors at the root of the repo is a symlink to home/trusktr/src/lume+lume/packages/element-behaviors. Could that have anything to do with it (doesn't seem like it would, but that's the only way that the package is connected to the root of the repo as far as I know.

[ljharb]

The flag ignores install scripts of what you’re installing. It then has to run your project’s scripts, so it can potentially recompile with new dependencies.

I can’t speak to the specific scripts or why they’re run; I’m only speaking to the expectation.

[trusktr]

Yeah, that's the weird thing. According to https://docs.npmjs.com/cli/v8/using-npm/scripts#npm-install, it will run these scripts:

preinstall
install
postinstall
prepublish
preprepare
prepare
postprepare

I ensured I have none of those in the top level of the repo where package.json is. Then when I run npm i surge -D --ignore-scripts, for some reason build of a package in packages runs.

I just tried npm i --ignore-scripts, which does the same.

I should make a reproduction.

[trusktr]

Check out this output that confirms what I'm seeing. The first command includes "dev" to show that there is a "dev" script, but that's not something npm install runs, and all other scripts are missing:

lume+lume git:develop ❯ pwd
/home/trusktr/src/lume+lume

lume+lume git:develop ❯ cat package.json | grep -E '"dev"|"preinstall"|"install"|"postinstall"|"prepublish"|"preprepare"|"prepare"|"postprepare"'
                "dev": "lume dev",

lume+lume git:develop ❯ npm i surge -D --ignore-scripts
npm ERR! code 2
npm ERR! path /home/trusktr/src/lume+lume/packages/element-behaviors
npm ERR! command failed
npm ERR! command sh -c npm run build
npm ERR! > element-behaviors@2.2.11 build
npm ERR! > lume build
npm ERR! 
npm ERR! 
npm ERR! 
npm ERR! element-behaviors
npm ERR! * * *   **** *   
npm ERR!  * * * *      ** 
npm ERR!       *     *   *
npm ERR!            *     
npm ERR!         *       *
npm ERR!  *    *          
npm ERR!    *             
npm ERR! * * **   *  *    
npm ERR!               *  
npm ERR!                  
npm ERR!           *      
npm ERR!              * * 
npm ERR! 
npm ERR! 
npm ERR! 
npm ERR! 
npm ERR! [21:43:42] Using gulpfile ~/src/lume+lume/packages/element-behaviors/node_modules/@lume/cli/config/gulpfile.js
npm ERR! [21:43:42] Starting 'copyAssets'...
npm ERR! [21:43:42] Finished 'copyAssets' after 38 ms
npm ERR! src/index.ts:1:74 - error TS2307: Cannot find module '@lume/custom-attributes/dist/index.js' or its corresponding type declarations.
npm ERR! 
npm ERR! 1 import {customAttributes, CustomAttributeRegistry, CustomAttribute} from '@lume/custom-attributes/dist/index.js'
npm ERR!                                                                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
npm ERR! 
npm ERR! 
npm ERR! Found 1 error.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/trusktr/.npm/_logs/2021-12-31T05_43_32_455Z-debug-0.log

lume+lume git:develop ❯ ls -l /home/trusktr/.npm/_logs/2021-12-31T05_43_32_455Z-debug-0.log
ls: cannot access '/home/trusktr/.npm/_logs/2021-12-31T05_43_32_455Z-debug-0.log': No such file or directory

I would provide the debug log that it says it outputs, but that doesn't exist for some reason.

[trusktr]

Added a reproduction to the OP.

[trusktr]

It seems that this is due to some behavior in newer npm that tries to re-build symlinked dependencies for some reason.

[trusktr]

I discovered that running npm rebuild causes the build scripts of linked packages in node_modules to be executed. Is this expected?

[trusktr]

@ljharb Is npm rebuild supposed to run build of packages in node_modules?

[ljharb]

Yes.

[trusktr]

And so --ignore-scripts should in fact cause any build script to be ignored, right?