@gkiely/safe-install 0.1.4 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -2
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -30,7 +30,7 @@ ignore-scripts=true
|
|
|
30
30
|
```json
|
|
31
31
|
{
|
|
32
32
|
"scripts": {
|
|
33
|
-
"safe-install": "npx -y @gkiely/safe-install
|
|
33
|
+
"safe-install": "npx -y @gkiely/safe-install"
|
|
34
34
|
}
|
|
35
35
|
}
|
|
36
36
|
```
|
|
@@ -38,7 +38,7 @@ ignore-scripts=true
|
|
|
38
38
|
4. Find dependencies that declare install-time scripts:
|
|
39
39
|
|
|
40
40
|
```sh
|
|
41
|
-
npm run safe-install
|
|
41
|
+
npm run safe-install review-deps
|
|
42
42
|
```
|
|
43
43
|
|
|
44
44
|
5. Review the output, then add trusted packages to `package.json`. You can also
|
|
@@ -81,6 +81,16 @@ npm rebuild --ignore-scripts=false esbuild sharp
|
|
|
81
81
|
|
|
82
82
|
## Notes
|
|
83
83
|
|
|
84
|
+
Supports npm install flags:
|
|
85
|
+
|
|
86
|
+
```json
|
|
87
|
+
{
|
|
88
|
+
"scripts": {
|
|
89
|
+
"safe-install": "npx -y @gkiely/safe-install --no-audit --no-fund"
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
```
|
|
93
|
+
|
|
84
94
|
Only add a package to `trustedDependencies` after reviewing why it needs an
|
|
85
95
|
install script. This does not make dependency scripts safe; it makes the trust
|
|
86
96
|
decision explicit and version-controlled.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@gkiely/safe-install",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.5",
|
|
4
4
|
"description": "Run npm installs with lifecycle scripts disabled, then rebuild explicitly trusted dependencies.",
|
|
5
5
|
"author": "Grant Kiely <grant@youneedawiki.com>",
|
|
6
6
|
"license": "MIT",
|
|
@@ -45,6 +45,7 @@
|
|
|
45
45
|
"build": "tsc -p tsconfig.build.json",
|
|
46
46
|
"prepack": "npm run build",
|
|
47
47
|
"prepublishOnly": "npm run typecheck && npm test",
|
|
48
|
+
"release": "npm run typecheck && npm test && npm version patch && npm publish --access public && git push --follow-tags",
|
|
48
49
|
"safe-install": "node dist/index.js",
|
|
49
50
|
"test": "node --test",
|
|
50
51
|
"typecheck": "tsc --noEmit"
|