@gkiely/safe-install 0.1.3 → 0.1.5

package/README.md

@@ -38,7 +38,7 @@ ignore-scripts=true
 4. Find dependencies that declare install-time scripts:
 
 ```sh
-npm run safe-install -- review-deps
+npm run safe-install review-deps
 ```
 
 5. Review the output, then add trusted packages to `package.json`. You can also
@@ -59,7 +59,7 @@ specifiers.
 6. Use `safe-install` for future installs:
 
 ```sh
-npm run safe-install -- --no-audit --no-fund
+npm run safe-install
 ```
 
 ## What `safe-install` does
@@ -81,6 +81,16 @@ npm rebuild --ignore-scripts=false esbuild sharp
 
 ## Notes
 
+Supports npm install flags:
+
+```json
+{
+  "scripts": {
+    "safe-install": "npx -y @gkiely/safe-install --no-audit --no-fund"
+  }
+}
+```
+
 Only add a package to `trustedDependencies` after reviewing why it needs an
 install script. This does not make dependency scripts safe; it makes the trust
 decision explicit and version-controlled.

package/dist/index.js

@@ -154,23 +154,19 @@ export function installCommand(args = []) {
     }
 }
 export function main(args = process.argv.slice(2)) {
-    const [command] = args;
+    if (args.includes("--help") || args.includes("-h")) {
+        printHelp();
+        return;
+    }
+    const command = args.find((arg) => arg !== "--" && !arg.startsWith("-"));
     if (command === undefined) {
-        installCommand();
+        installCommand(args.filter((arg) => arg !== "--"));
         return;
     }
     if (command === "review-deps") {
         reviewDepsCommand();
         return;
     }
-    if (command === "--help" || command === "-h") {
-        printHelp();
-        return;
-    }
-    if (command.startsWith("-")) {
-        installCommand(args);
-        return;
-    }
     throw new Error(`Unknown command: ${command}`);
 }
 if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1])) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gkiely/safe-install",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Run npm installs with lifecycle scripts disabled, then rebuild explicitly trusted dependencies.",
   "author": "Grant Kiely <grant@youneedawiki.com>",
   "license": "MIT",
@@ -45,6 +45,7 @@
     "build": "tsc -p tsconfig.build.json",
     "prepack": "npm run build",
     "prepublishOnly": "npm run typecheck && npm test",
+    "release": "npm run typecheck && npm test && npm version patch && npm publish --access public && git push --follow-tags",
     "safe-install": "node dist/index.js",
     "test": "node --test",
     "typecheck": "tsc --noEmit"