@gkiely/safe-install 0.1.15 → 0.1.16

package/README.md

@@ -37,12 +37,12 @@ allow-remote=root
 ```json
 {
   "scripts": {
-    "safe-install": "npx -y @gkiely/safe-install0.1.15"
+    "safe-install": "npx -y @gkiely/safe-install0.1.16"
   }
 }
 ```
 
-4. Find dependencies that declare install-time scripts:
+3. Find dependencies that declare install-time scripts:
 
 ```sh
 npm run safe-install -- review-deps
@@ -69,6 +69,18 @@ or remote tarball URL specifiers.
 npm run safe-install
 ```
 
+7. If your project defines its own install lifecycle scripts, `safe-install`
+runs them after dependency installation:
+
+```json
+{
+  "scripts": {
+    "preinstall": "node scripts/preinstall.js",
+    "postinstall": "node scripts/setup.js"
+  }
+}
+```
+
 You can pass npm install args through:
 
 ```sh
@@ -86,6 +98,9 @@ npm run safe-install -- update
 `safe-install` runs npm install with scripts blocked, then runs install scripts only for packages listed in
 `trustedDependencies`.
 
+It also runs your project's own `preinstall`, `install`, and `postinstall`
+scripts when they are defined in the root `package.json`.
+
 If `blockExoticSubDeps` is set to `true` in `package.json`, `safe-install` also
 fails the install before rebuilding trusted dependencies when a transitive
 dependency points outside the npm registry with a `git:`, `file:`, `link:`, or
@@ -96,6 +111,9 @@ Equivalent manual flow:
 ```sh
 npm install --ignore-scripts --no-audit --no-fund
 npm rebuild --ignore-scripts=false esbuild sharp
+npm run --ignore-scripts preinstall
+npm run --ignore-scripts install
+npm run --ignore-scripts postinstall
 ```
 
 ## Notes

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 type PackageJson = {
     blockExoticSubDeps?: unknown;
+    scripts?: Record<string, unknown>;
     trustedDependencies?: unknown;
 };
 type LockPackage = {

package/dist/index.js

@@ -115,6 +115,9 @@ function run(command, args) {
         process.exit(result.status ?? 1);
     }
 }
+function getRootInstallScripts(pkg) {
+    return installScriptNames.filter((scriptName) => typeof pkg.scripts?.[scriptName] === "string");
+}
 export function getInstallArgs(args = []) {
     return ["install", "--ignore-scripts", ...args];
 }
@@ -143,11 +146,11 @@ function printHelp() {
 
 Usage:
   safe-install [npm install args]
-                        Run npm install with scripts disabled, then rebuild trusted dependencies
+                        Run npm install with dependency scripts disabled, then rebuild trusted dependencies
   safe-install -- review-deps
                         List dependencies that declare install-time scripts
   safe-install -- update [npm update args]
-                        Run npm update with scripts disabled, then rebuild trusted dependencies
+                        Run npm update with dependency scripts disabled, then rebuild trusted dependencies
 `);
 }
 export function reviewDepsCommand() {
@@ -180,6 +183,9 @@ function runPackageManagerThenRebuild(npmArgs) {
     if (trustedDependencies.length > 0) {
         run("npm", ["rebuild", "--ignore-scripts=false", ...trustedDependencies]);
     }
+    for (const scriptName of getRootInstallScripts(pkg)) {
+        run("npm", ["run", "--ignore-scripts", scriptName]);
+    }
 }
 export function main(args = process.argv.slice(2)) {
     const command = parseCommand(args);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gkiely/safe-install",
-  "version": "0.1.15",
-  "description": "Run npm installs with lifecycle scripts disabled, then rebuild explicitly trusted dependencies.",
+  "version": "0.1.16",
+  "description": "Run npm installs with dependency lifecycle scripts disabled, then rebuild explicitly trusted dependencies.",
   "author": "Grant Kiely <grant@youneedawiki.com>",
   "license": "MIT",
   "type": "module",
@@ -45,7 +45,8 @@
     "build": "tsc -p tsconfig.build.json",
     "prepack": "npm run build",
     "prepublishOnly": "npm run typecheck && npm test",
-    "release": "node scripts/bump-readme-version.ts && npm run typecheck && npm test && npm version patch && npm publish --access public && git push --follow-tags",
+    "bump": "node scripts/bump-readme-version.ts",
+    "release": "npm run typecheck && npm test && npm version patch && npm publish --access public && git push --follow-tags",
     "safe-install": "node dist/index.js",
     "test": "npm run build && node --test",
     "typecheck": "tsc --noEmit"