npm - @jsdevtools/npm-publish - Versions diffs - 2.1.0 → 2.2.0 - Mend

@jsdevtools/npm-publish 2.1.0 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (29) hide show

package/README.md +79 -32
package/lib/action/core.d.ts +2 -2
package/lib/action/core.js +7 -2
package/lib/action/core.js.map +1 -1
package/lib/action/main.js +1 -0
package/lib/action/main.js.map +1 -1
package/lib/cli/index.d.ts +1 -1
package/lib/cli/index.js +3 -0
package/lib/cli/index.js.map +1 -1
package/lib/cli/parse-cli-arguments.js +7 -1
package/lib/cli/parse-cli-arguments.js.map +1 -1
package/lib/compare-and-publish/compare-and-publish.js +5 -1
package/lib/compare-and-publish/compare-and-publish.js.map +1 -1
package/lib/normalize-options.d.ts +1 -0
package/lib/normalize-options.js +1 -0
package/lib/normalize-options.js.map +1 -1
package/lib/npm/call-npm-cli.d.ts +1 -0
package/lib/npm/call-npm-cli.js +2 -1
package/lib/npm/call-npm-cli.js.map +1 -1
package/lib/options.d.ts +14 -6
package/package.json +12 -12
package/src/action/core.ts +7 -3
package/src/action/main.ts +1 -0
package/src/cli/index.ts +3 -0
package/src/cli/parse-cli-arguments.ts +10 -1
package/src/compare-and-publish/compare-and-publish.ts +5 -1
package/src/normalize-options.ts +2 -0
package/src/npm/call-npm-cli.ts +5 -1
package/src/options.ts +15 -6

package/README.md CHANGED Viewed

@@ -31,7 +31,7 @@ This package can be used three different ways:
 - 🤖 A [**GitHub Action**](#github-action) as part of your CI/CD process
-- 🧩 A [**function**](#javascript-function) that you call in your JavaScript code
+- 🧩 A [**function**](#javascript-api) that you call in your JavaScript code
 - 🖥 A [**CLI**](#command-line-interface) that you run in your terminal
@@ -39,12 +39,37 @@ This package can be used three different ways:
 The v1 to v2 upgrade brought a few notable **breaking changes**. To migrate, make the following updates:
-- The `type` output is now an empty string instead of `none` when no release occurs
+- The `type` output is now an empty string instead of `'none'` when no release occurs
   ```diff
     - run: echo "Version changed!"
   -   if: ${{ steps.publish.outputs.type != 'none' }}
   +   if: ${{ steps.publish.outputs.type }}
   ```
+- The `--ignore-scripts` option is now passed to `npm publish` as a security precaution. If you define any publish lifecycle scripts - `prepublishOnly`, `prepack`, `prepare`, `postpack`, `publish`, `postpublish` - run them explicitly or set the `ignore-scripts` input to `false`.
+  ```diff
+    with:
+      token: ${{ secrets.NPM_TOKEN }}
+  +   ignore-scripts: false
+  ```
+- The workflow's `.npmrc` file is no longer modified. If you have any workarounds to adjust for this misbehavior - for example, if you're using `actions/setup-node` to configure `.npmrc` - you should remove them.
+  ```diff
+    - uses: actions/setup-node@v3
+      with:
+        node-version: '18'
+        registry-url: https://registry.npmjs.org/
+    - uses: JS-DevTools/npm-publish@v1
+      with:
+        token: ${{ secrets.NPM_TOKEN }}
+    - name: Do some more stuff with npm
+      run: npm whoami
+      env:
+  -     INPUT_TOKEN: ${{ secrets.NPM_TOKEN }}
+  +     NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  ```
 - The `check-version` and `greater-version-only` options have been removed and replaced with `strategy`.
   - Use `strategy: all` (default) to publish all versions that do not yet exist in the registry.
     ```diff
@@ -62,10 +87,24 @@ The v1 to v2 upgrade brought a few notable **breaking changes**. To migrate, mak
     -   greater-version-only: true
     +   strategy: upgrade
     ```
-  - `check-version: false` has been removed. You don't need this action if you're not checking already published versions; use `npm` directly, instead.
+  - `check-version: false` has been removed. You may not need this action if you're not checking already published versions; [you can `npm` directly][publishing-nodejs-packages], instead.
+    ```diff
+    - - uses: JS-DevTools/npm-publish@v1
+    -   with:
+    -     token: ${{ secrets.NPM_TOKEN }}
+    -     check-version: false
+    + - uses: actions/setup-node@v3
+    +   with:
+    +     node-version: '18'
+    +     registry-url: https://registry.npmjs.org/
+    + - run: npm publish
+    +   env:
+    +     NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    ```
 See the [change log][] for more details and other changes in the v2 release.
+[publishing-nodejs-packages]: https://docs.github.com/actions/publishing-packages/publishing-nodejs-packages
 [change log]: https://github.com/JS-DevTools/npm-publish/releases
 ## GitHub Action
@@ -99,21 +138,24 @@ jobs:
 You can set any or all of the following input parameters using `with`:
-| Name         | Type                   | Default                          | Description                                                                   |
-| ------------ | ---------------------- | -------------------------------- | ----------------------------------------------------------------------------- |
-| `token`      | string                 | **required**                     | Authentication token to use with the configured registry.                     |
-| `registry`   | string                 | `https://registry.npmjs.org/` \* | Registry URL to use.                                                          |
-| `package`    | string                 | Current working directory        | Path to a package directory, a `package.json`, or a packed `.tgz` to publish  |
-| `tag`        | string                 | `latest` \*                      | [Distribution tag][npm-tag] to publish to.                                    |
-| `access`     | `public`, `restricted` | [npm defaults][npm-access] \*    | Whether the package should be publicly visible or restricted.                 |
-| `provenance` | boolean                | `false` \*                       | Run `npm publish` with the `--provenance` flag to add provenance statements.  |
-| `strategy`   | `all`, `upgrade`       | `all`                            | Use `all` to publish all unique versions, `upgrade` for only semver upgrades. |
-| `dry-run`    | boolean                | `false`                          | Run `npm publish` with the `--dry-run` flag to prevent publication.           |
-\* Default values for these options may be specified using `publishConfig` in `package.json`.
+| Name             | Type                   | Default                       | Description                                                                      |
+| ---------------- | ---------------------- | ----------------------------- | -------------------------------------------------------------------------------- |
+| `token`          | string                 | **required**                  | Authentication token to use with the configured registry.                        |
+| `registry`¹      | string                 | `https://registry.npmjs.org/` | Registry URL to use.                                                             |
+| `package`        | string                 | Current working directory     | Path to a package directory, a `package.json`, or a packed `.tgz` to publish.    |
+| `tag`¹           | string                 | `latest`                      | [Distribution tag][npm-tag] to publish to.                                       |
+| `access`¹        | `public`, `restricted` | [npm defaults][npm-access]    | Whether the package should be publicly visible or restricted.                    |
+| `provenance`¹ ²  | boolean                | `false`                       | Run `npm publish` with the `--provenance` flag to add [provenance][] statements. |
+| `strategy`       | `all`, `upgrade`       | `all`                         | Use `all` to publish all unique versions, `upgrade` for only semver upgrades.    |
+| `ignore-scripts` | boolean                | `true`                        | Run `npm publish` with the `--ignore-scripts` flag as a security precaution.     |
+| `dry-run`        | boolean                | `false`                       | Run `npm publish` with the `--dry-run` flag to prevent publication.              |
+1. May be specified using `publishConfig` in `package.json`.
+2. Provenance requires npm `>=9.5.0`.
 [npm-tag]: https://docs.npmjs.com/cli/v9/commands/npm-publish#tag
 [npm-access]: https://docs.npmjs.com/cli/v9/commands/npm-publish#access
+[provenance]: https://docs.npmjs.com/generating-provenance-statements
 ### Output
@@ -145,7 +187,7 @@ steps:
 [semver release type]: https://github.com/npm/node-semver#release_types
-## JavaScript Function
+## JavaScript API
 To use npm-package in your JavaScript code, you'll need to install it using [npm][] or other package manager of choice:
@@ -172,20 +214,22 @@ As shown in the example above, you should pass an options object to the `npmPubl
 import type { Options } from "@jsdevtools/npm-publish";
 ```
-| Name                 | Type                   | Default                          | Description                                                                   |
-| -------------------- | ---------------------- | -------------------------------- | ----------------------------------------------------------------------------- |
-| `token`              | string                 | **required**                     | Authentication token to use with the configured registry.                     |
-| `registry`           | string, `URL`          | `https://registry.npmjs.org/` \* | Registry URL to use.                                                          |
-| `package`            | string                 | Current working directory        | Path to a package directory, a `package.json`, or a packed `.tgz` to publish  |
-| `tag`                | string                 | `latest` \*                      | [Distribution tag][npm-tag] to publish to.                                    |
-| `access`             | `public`, `restricted` | [npm defaults][npm-access] \*    | Whether the package should be publicly visible or restricted.                 |
-| `provenance`         | boolean                | `false` \*                       | Run `npm publish` with the `--provenance` flag to add provenance statements.  |
-| `strategy`           | `all`, `upgrade`       | `all`                            | Use `all` to publish all unique versions, `upgrade` for only semver upgrades. |
-| `dryRun`             | boolean                | `false`                          | Run `npm publish` with the `--dry-run` flag to prevent publication.           |
-| `logger`             | object                 | `undefined`                      | Logging interface with `debug`, `info`, and `error` log methods.              |
-| `temporaryDirectory` | string                 | `os.tmpdir()`                    | Temporary directory to hold a generated `.npmrc` file                         |
-\* Default values for these options may be specified using `publishConfig` in `package.json`.
+| Name                 | Type                   | Default                       | Description                                                                      |
+| -------------------- | ---------------------- | ----------------------------- | -------------------------------------------------------------------------------- |
+| `token`              | string                 | **required**                  | Authentication token to use with the configured registry.                        |
+| `registry`¹          | string, `URL`          | `https://registry.npmjs.org/` | Registry URL to use.                                                             |
+| `package`            | string                 | Current working directory     | Path to a package directory, a `package.json`, or a packed `.tgz` to publish.    |
+| `tag`¹               | string                 | `latest`                      | [Distribution tag][npm-tag] to publish to.                                       |
+| `access`¹            | `public`, `restricted` | [npm defaults][npm-access]    | Whether the package should be publicly visible or restricted.                    |
+| `provenance`¹ ²      | boolean                | `false`                       | Run `npm publish` with the `--provenance` flag to add [provenance][] statements. |
+| `strategy`           | `all`, `upgrade`       | `all`                         | Use `all` to publish all unique versions, `upgrade` for only semver upgrades.    |
+| `ignoreScripts`      | boolean                | `true`                        | Run `npm publish` with the `--ignore-scripts` flag as a security precaution.     |
+| `dryRun`             | boolean                | `false`                       | Run `npm publish` with the `--dry-run` flag to prevent publication.              |
+| `logger`             | object                 | `undefined`                   | Logging interface with `debug`, `info`, and `error` log methods.                 |
+| `temporaryDirectory` | string                 | `os.tmpdir()`                 | Temporary directory to hold a generated `.npmrc` file                            |
+1. May be specified using `publishConfig` in `package.json`.
+2. Provenance requires npm `>=9.5.0`.
 ### Output
@@ -224,7 +268,7 @@ npx npm-publish --token YOUR_NPM_AUTH_TOKEN_HERE
 You can customize your call with options to change the registry, package, etc.
 ```bash
-npm-publish --token YOUR_NPM_AUTH_TOKEN_HERE --registry http://example.com ./path/to/package
+npx npm-publish --token YOUR_NPM_AUTH_TOKEN_HERE --registry http://example.com ./path/to/package
 ```
 ### Options
@@ -261,12 +305,15 @@ Options:
   --strategy <strategy>   Publish strategy, may be "all" or "upgrade".
                           Defaults to "all", see documentation for details.
+  --no-ignore-scripts     Allow lifecycle scripts, which are disabled by default
+                          as a security precaution. Defaults to false.
   --dry-run               Do not actually publish anything.
   --quiet                 Only print errors.
   --debug                 Print debug logs.
   -v, --version           Print the version number.
-  -h --help               Show usage text.
+  -h, --help              Show usage text.
 Examples:

package/lib/action/core.d.ts CHANGED Viewed

@@ -19,9 +19,9 @@ export declare function getRequiredSecretInput(name: string): string;
  * Get a boolean input by name.
  *
  * @param name Input name
- * @returns True if value is "true", false if not
+ * @returns True if value is "true", false if "false", undefined if unset
  */
-export declare function getBooleanInput(name: string): boolean;
+export declare function getBooleanInput(name: string): boolean | undefined;
 /**
  * Set the action as failed due to an error.
  *

package/lib/action/core.js CHANGED Viewed

@@ -36,10 +36,15 @@ exports.getRequiredSecretInput = getRequiredSecretInput;
  * Get a boolean input by name.
  *
  * @param name Input name
- * @returns True if value is "true", false if not
+ * @returns True if value is "true", false if "false", undefined if unset
  */
 function getBooleanInput(name) {
-    return (0, core_1.getInput)(name) === "true";
+    const inputString = (0, core_1.getInput)(name).toLowerCase();
+    if (inputString === "true")
+        return true;
+    if (inputString === "false")
+        return false;
+    return undefined;
 }
 exports.getBooleanInput = getBooleanInput;
 /**

package/lib/action/core.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/action/core.ts"],"names":[],"mappings":";;;AAAA,uCAAuC;AACvC,wCAQuB;AAIvB,mDAAmD;AACtC,QAAA,MAAM,GAAW;IAC5B,KAAK,EAAE,YAAU;IACjB,IAAI,EAAE,WAAS;IACf,KAAK,EAAE,YAAU;CAClB,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,QAAQ,CAAmB,IAAY;IACrD,MAAM,WAAW,GAAG,IAAA,eAAU,EAAC,IAAI,CAAC,CAAC;IACrC,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,WAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAHD,4BAGC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAY;IACjD,MAAM,WAAW,GAAG,IAAA,eAAU,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAA,gBAAW,EAAC,WAAW,CAAC,CAAC;IACzB,OAAO,WAAW,CAAC;AACrB,CAAC;AAJD,wDAIC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,~~OAAO~~,IAAA,eAAU,EAAC,IAAI,CAAC,KAAK,MAAM,CAAC;~~AACrC~~,CAAC;~~AAFD~~,~~0CAEC~~;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,KAAc;IACtC,IAAA,gBAAW,EAAC,KAAc,CAAC,CAAC;AAC9B,CAAC;AAFD,8BAEC;AAuBD,+CAA+C;AAC/C,SAAgB,SAAS,CACvB,IAAY,EACZ,KAAmC,EACnC,YAA2C;IAE3C,IAAA,gBAAW,EAAC,IAAI,EAAE,KAAK,IAAI,YAAY,CAAC,CAAC;AAC3C,CAAC;AAND,8BAMC"}
1	+ {"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/action/core.ts"],"names":[],"mappings":";;;AAAA,uCAAuC;AACvC,wCAQuB;AAIvB,mDAAmD;AACtC,QAAA,MAAM,GAAW;IAC5B,KAAK,EAAE,YAAU;IACjB,IAAI,EAAE,WAAS;IACf,KAAK,EAAE,YAAU;CAClB,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,QAAQ,CAAmB,IAAY;IACrD,MAAM,WAAW,GAAG,IAAA,eAAU,EAAC,IAAI,CAAC,CAAC;IACrC,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,WAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAHD,4BAGC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAY;IACjD,MAAM,WAAW,GAAG,IAAA,eAAU,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAA,gBAAW,EAAC,WAAW,CAAC,CAAC;IACzB,OAAO,WAAW,CAAC;AACrB,CAAC;AAJD,wDAIC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,WAAW,GAAG,IAAA,eAAU,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,IAAI,WAAW,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,WAAW,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,SAAS,CAAC;AACnB,CAAC;AAND,0CAMC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,KAAc;IACtC,IAAA,gBAAW,EAAC,KAAc,CAAC,CAAC;AAC9B,CAAC;AAFD,8BAEC;AAuBD,+CAA+C;AAC/C,SAAgB,SAAS,CACvB,IAAY,EACZ,KAAmC,EACnC,YAA2C;IAE3C,IAAA,gBAAW,EAAC,IAAI,EAAE,KAAK,IAAI,YAAY,CAAC,CAAC;AAC3C,CAAC;AAND,8BAMC"}

package/lib/action/main.js CHANGED Viewed

@@ -36,6 +36,7 @@ async function run() {
         access: core.getInput("access"),
         provenance: core.getBooleanInput("provenance"),
         strategy: core.getInput("strategy"),
+        ignoreScripts: core.getBooleanInput("ignore-scripts"),
         dryRun: core.getBooleanInput("dry-run"),
         logger: core.logger,
         temporaryDirectory: process.env["RUNNER_TEMP"],

package/lib/action/main.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/action/main.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yBAAyB;AACzB,0CAAyC;AACzC,gDAAkC;AAElC,sBAAsB;AACtB,KAAK,UAAU,GAAG;IAChB,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAU,EAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC;QAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;KAC/C,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/action/main.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yBAAyB;AACzB,0CAAyC;AACzC,gDAAkC;AAElC,sBAAsB;AACtB,KAAK,UAAU,GAAG;IAChB,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAU,EAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC;QAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;QACrD,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;KAC/C,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC"}

package/lib/cli/index.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-export declare const USAGE = "\nUsage:\n\n  npm-publish <options> [package]\n\nArguments:\n\n  package                 The path to the package to publish.\n                          May be a directory, package.json, or .tgz file.\n                          Defaults to the package in the current directory.\n\nOptions:\n\n  --token <token>         (Required) npm authentication token.\n\n  --registry <url>        Registry to read from and write to.\n                          Defaults to \"https://registry.npmjs.org/\".\n\n  --tag <tag>             The distribution tag to check against and publish to.\n                          Defaults to \"latest\".\n\n  --access <access>       Package access, may be \"public\" or \"restricted\".\n                          See npm documentation for details.\n\n  --provenance            Publish with provenance statements.\n                          See npm documentation for details.\n\n  --strategy <strategy>   Publish strategy, may be \"all\" or \"upgrade\".\n                          Defaults to \"all\", see documentation for details.\n\n  --dry-run               Do not actually publish anything.\n  --quiet                 Only print errors.\n  --debug                 Print debug logs.\n\n  -v, --version           Print the version number.\n  -h, --help              Show usage text.\n\nExamples:\n\n  $ npm-publish --token abc123 ./my-package\n";
+export declare const USAGE = "\nUsage:\n\n  npm-publish <options> [package]\n\nArguments:\n\n  package                 The path to the package to publish.\n                          May be a directory, package.json, or .tgz file.\n                          Defaults to the package in the current directory.\n\nOptions:\n\n  --token <token>         (Required) npm authentication token.\n\n  --registry <url>        Registry to read from and write to.\n                          Defaults to \"https://registry.npmjs.org/\".\n\n  --tag <tag>             The distribution tag to check against and publish to.\n                          Defaults to \"latest\".\n\n  --access <access>       Package access, may be \"public\" or \"restricted\".\n                          See npm documentation for details.\n\n  --provenance            Publish with provenance statements.\n                          See npm documentation for details.\n\n  --strategy <strategy>   Publish strategy, may be \"all\" or \"upgrade\".\n                          Defaults to \"all\", see documentation for details.\n\n  --ignore-scripts        Ignore lifecycle scripts as a security precaution.\n                          Defaults to true.\n\n  --dry-run               Do not actually publish anything.\n  --quiet                 Only print errors.\n  --debug                 Print debug logs.\n\n  -v, --version           Print the version number.\n  -h, --help              Show usage text.\n\nExamples:\n\n  $ npm-publish --token abc123 ./my-package\n";
 /**
  * The main entry point of the CLI
  *

package/lib/cli/index.js CHANGED Viewed

@@ -33,6 +33,9 @@ Options:
   --strategy <strategy>   Publish strategy, may be "all" or "upgrade".
                           Defaults to "all", see documentation for details.
+  --ignore-scripts        Ignore lifecycle scripts as a security precaution.
+                          Defaults to true.
   --dry-run               Do not actually publish anything.
   --quiet                 Only print errors.
   --debug                 Print debug logs.

package/lib/cli/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;AAAA,0CAAsD;AACtD,qEAA6D;AAEhD,QAAA,KAAK,GAAG~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCpB~~,CAAC;AAEF;;;;;GAKG;AACI,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,OAAe;IACxD,MAAM,YAAY,GAAG,IAAA,0CAAiB,EAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,YAAY,CAAC,IAAI,EAAE;QACrB,OAAO,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC;QACpB,OAAO;KACR;IAED,IAAI,YAAY,CAAC,OAAO,EAAE;QACxB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO;KACR;IAED,MAAM,MAAM,GAAW;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,YAAY,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7D,KAAK,EAAE,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC;IAEF,MAAM,IAAA,qBAAU,EAAC,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AApBD,oBAoBC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;AAAA,0CAAsD;AACtD,qEAA6D;AAEhD,QAAA,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CpB,CAAC;AAEF;;;;;GAKG;AACI,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,OAAe;IACxD,MAAM,YAAY,GAAG,IAAA,0CAAiB,EAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,YAAY,CAAC,IAAI,EAAE;QACrB,OAAO,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC;QACpB,OAAO;KACR;IAED,IAAI,YAAY,CAAC,OAAO,EAAE;QACxB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO;KACR;IAED,MAAM,MAAM,GAAW;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,YAAY,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7D,KAAK,EAAE,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC;IAEF,MAAM,IAAA,qBAAU,EAAC,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AApBD,oBAoBC"}

package/lib/cli/parse-cli-arguments.js CHANGED Viewed

@@ -14,6 +14,7 @@ const ARGUMENTS_OPTIONS = [
     { name: "access", type: String },
     { name: "provenance", type: Boolean },
     { name: "strategy", type: String },
+    { name: "no-ignore-scripts", type: Boolean },
     { name: "dry-run", type: Boolean },
     { name: "quiet", type: Boolean },
     { name: "debug", type: Boolean },
@@ -27,7 +28,12 @@ const ARGUMENTS_OPTIONS = [
  * @returns A parsed object of options.
  */
 function parseCliArguments(argv) {
-    const { help, version, quiet, debug, ...options } = (0, command_line_args_1.default)(ARGUMENTS_OPTIONS, { argv, camelCase: true });
+    const { help, version, quiet, debug, ...optionFlags } = (0, command_line_args_1.default)(ARGUMENTS_OPTIONS, { argv, camelCase: true });
+    const options = Object.fromEntries(Object.entries(optionFlags).map(([key, value]) => {
+        return key === "noIgnoreScripts"
+            ? ["ignoreScripts", !value]
+            : [key, value];
+    }));
     return {
         help: Boolean(help),
         version: Boolean(version),

package/lib/cli/parse-cli-arguments.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"parse-cli-arguments.js","sourceRoot":"","sources":["../../src/cli/parse-cli-arguments.ts"],"names":[],"mappings":";AAAA,2CAA2C;;;;;;AAE3C,0EAAgD;AAGhD,MAAM,iBAAiB,GAAG;IACxB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE;IACtD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;IAC/B,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;IAClC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;IAC7B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;IAChC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE;IACrC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;IAClC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;IAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;IAC9C,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;CAC5C,CAAC;AAWF;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,~~OAAO~~,EAAE,GAAG,IAAA,2BAAe,~~EACjE~~,iBAAiB,EACjB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAC1B,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,EAAE,OAAkB;KAC5B,CAAC;AACJ,CAAC;~~AAbD~~,~~8CAaC~~"}
1	+ {"version":3,"file":"parse-cli-arguments.js","sourceRoot":"","sources":["../../src/cli/parse-cli-arguments.ts"],"names":[],"mappings":";AAAA,2CAA2C;;;;;;AAE3C,0EAAgD;AAGhD,MAAM,iBAAiB,GAAG;IACxB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE;IACtD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;IAC/B,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;IAClC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;IAC7B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;IAChC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE;IACrC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;IAClC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE;IAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;IAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;IAC9C,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;CAC5C,CAAC;AAWF;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,GAAG,IAAA,2BAAe,EACrE,iBAAiB,EACjB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAC1B,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC/C,OAAO,GAAG,KAAK,iBAAiB;YAC9B,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC;YAC3B,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnB,CAAC,CAAC,CACH,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,EAAE,OAAkB;KAC5B,CAAC;AACJ,CAAC;AArBD,8CAqBC"}

package/lib/compare-and-publish/compare-and-publish.js CHANGED Viewed

@@ -14,7 +14,11 @@ const get_arguments_js_1 = require("./get-arguments.js");
  */
 async function compareAndPublish(manifest, options, environment) {
     const { name, version, packageSpec } = manifest;
-    const cliOptions = { environment, logger: options.logger };
+    const cliOptions = {
+        environment,
+        ignoreScripts: options.ignoreScripts.value,
+        logger: options.logger,
+    };
     const viewArguments = (0, get_arguments_js_1.getViewArguments)(name, options);
     const publishArguments = (0, get_arguments_js_1.getPublishArguments)(packageSpec, options);
     let viewCall = await (0, index_js_1.callNpmCli)(index_js_1.VIEW, viewArguments, cliOptions);

package/lib/compare-and-publish/compare-and-publish.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"compare-and-publish.js","sourceRoot":"","sources":["../../src/compare-and-publish/compare-and-publish.ts"],"names":[],"mappings":";;;AAEA,8CAOyB;AACzB,+DAAgF;AAChF,yDAA2E;AAY3E;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAA0B,EAC1B,WAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAChD,MAAM,UAAU,GAAG,~~EAAE,~~WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,~~EAAE,~~CAAC;~~IAE3D~~,MAAM,aAAa,GAAG,IAAA,mCAAgB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,IAAA,sCAAmB,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,QAAQ,GAAG,MAAM,IAAA,qBAAU,EAAC,eAAI,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC5C,gEAAgE;QAChE,oCAAoC;QACpC,MAAM,oBAAoB,GAAG,IAAA,mCAAgB,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnE,QAAQ,GAAG,MAAM,IAAA,qBAAU,EAAC,eAAI,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;KACrE;IAED,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAI,EAAE;QACjD,MAAM,QAAQ,CAAC,KAAK,CAAC;KACtB;IAED,MAAM,UAAU,GAAG,IAAA,qCAAe,EAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI;QACjC,CAAC,CAAC,MAAM,IAAA,qBAAU,EAAC,kBAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC;QACzD,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEvE,IAAI,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,SAAS,KAAK,2BAAgB,EAAE;QACnE,MAAM,WAAW,CAAC,KAAK,CAAC;KACzB;IAED,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;IAEjD,OAAO;QACL,EAAE,EAAE,WAAW,EAAE,EAAE;QACnB,KAAK,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC/C,UAAU,EAAE,UAAU,CAAC,UAAU;KAClC,CAAC;AACJ,CAAC;~~AA3CD~~,~~8CA2CC~~"}
1	+ {"version":3,"file":"compare-and-publish.js","sourceRoot":"","sources":["../../src/compare-and-publish/compare-and-publish.ts"],"names":[],"mappings":";;;AAEA,8CAOyB;AACzB,+DAAgF;AAChF,yDAA2E;AAY3E;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAA0B,EAC1B,WAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAChD,MAAM,UAAU,GAAG;QACjB,WAAW;QACX,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IAEF,MAAM,aAAa,GAAG,IAAA,mCAAgB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,IAAA,sCAAmB,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,QAAQ,GAAG,MAAM,IAAA,qBAAU,EAAC,eAAI,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC5C,gEAAgE;QAChE,oCAAoC;QACpC,MAAM,oBAAoB,GAAG,IAAA,mCAAgB,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnE,QAAQ,GAAG,MAAM,IAAA,qBAAU,EAAC,eAAI,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;KACrE;IAED,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAI,EAAE;QACjD,MAAM,QAAQ,CAAC,KAAK,CAAC;KACtB;IAED,MAAM,UAAU,GAAG,IAAA,qCAAe,EAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI;QACjC,CAAC,CAAC,MAAM,IAAA,qBAAU,EAAC,kBAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC;QACzD,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEvE,IAAI,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,SAAS,KAAK,2BAAgB,EAAE;QACnE,MAAM,WAAW,CAAC,KAAK,CAAC;KACzB;IAED,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;IAEjD,OAAO;QACL,EAAE,EAAE,WAAW,EAAE,EAAE;QACnB,KAAK,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC/C,UAAU,EAAE,UAAU,CAAC,UAAU;KAClC,CAAC;AACJ,CAAC;AA/CD,8CA+CC"}

package/lib/normalize-options.d.ts CHANGED Viewed

@@ -8,6 +8,7 @@ export interface NormalizedOptions {
     tag: ConfigValue<string>;
     access: ConfigValue<Access | undefined>;
     provenance: ConfigValue<boolean>;
+    ignoreScripts: ConfigValue<boolean>;
     dryRun: ConfigValue<boolean>;
     strategy: ConfigValue<Strategy>;
     logger: Logger | undefined;

package/lib/normalize-options.js CHANGED Viewed

@@ -51,6 +51,7 @@ function normalizeOptions(manifest, options) {
         tag: setValue(options.tag, defaultTag, validateTag),
         access: setValue(options.access, defaultAccess, validateAccess),
         provenance: setValue(options.provenance, defaultProvenance, Boolean),
+        ignoreScripts: setValue(options.ignoreScripts, true, Boolean),
         dryRun: setValue(options.dryRun, false, Boolean),
         strategy: setValue(options.strategy, options_js_1.STRATEGY_ALL, validateStrategy),
         logger: options.logger,

package/lib/normalize-options.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"normalize-options.js","sourceRoot":"","sources":["../src/normalize-options.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,sDAAyB;AAEzB,oDAAsC;AAEtC,6CASsB;AAEtB,MAAM,YAAY,GAAG,6BAA6B,CAAC;AACtC,QAAA,UAAU,GAAG,QAAQ,CAAC;~~AAqBnC~~;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,IAAI,kBAAU,CAAC;IAE7D,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,EAAE,QAAQ,IAAI,YAAY,CAAC;IAEzE,MAAM,aAAa,GACjB,QAAQ,CAAC,aAAa,EAAE,MAAM;QAC9B,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,0BAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE7D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,aAAa,EAAE,UAAU,IAAI,KAAK,CAAC;IAEtE,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;QAC/D,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC;QACnD,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC;QAC/D,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC;QACpE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QAChD,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,yBAAY,EAAE,gBAAgB,CAAC;QACpE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,iBAAE,CAAC,MAAM,EAAE;KAC9D,CAAC;AACJ,CAAC;~~AAzBD~~,~~4CAyBC~~;AAED,MAAM,QAAQ,GAAG,CACf,KAAc,EACd,YAAqB,EACrB,QAAoC,EACf,EAAE,CAAC,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,YAAY,CAAC;IACtC,SAAS,EAAE,KAAK,KAAK,SAAS;CAC/B,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACjD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAO,EAAE;IAC/C,IAAI;QACF,OAAO,IAAI,GAAG,CAAC,KAAqB,CAAC,CAAC;KACvC;IAAC,MAAM;QACN,MAAM,IAAI,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;KACjD;AACH,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACjD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE;IAC5D,IACE,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,0BAAa;QACvB,KAAK,KAAK,8BAAiB,EAC3B;QACA,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAY,EAAE;IACpD,IAAI,KAAK,KAAK,yBAAY,IAAI,KAAK,KAAK,6BAAgB,EAAE;QACxD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC"}
1	+ {"version":3,"file":"normalize-options.js","sourceRoot":"","sources":["../src/normalize-options.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,sDAAyB;AAEzB,oDAAsC;AAEtC,6CASsB;AAEtB,MAAM,YAAY,GAAG,6BAA6B,CAAC;AACtC,QAAA,UAAU,GAAG,QAAQ,CAAC;AAsBnC;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,IAAI,kBAAU,CAAC;IAE7D,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,EAAE,QAAQ,IAAI,YAAY,CAAC;IAEzE,MAAM,aAAa,GACjB,QAAQ,CAAC,aAAa,EAAE,MAAM;QAC9B,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,0BAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE7D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,aAAa,EAAE,UAAU,IAAI,KAAK,CAAC;IAEtE,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;QAC/D,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC;QACnD,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC;QAC/D,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC;QACpE,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC;QAC7D,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QAChD,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,yBAAY,EAAE,gBAAgB,CAAC;QACpE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,iBAAE,CAAC,MAAM,EAAE;KAC9D,CAAC;AACJ,CAAC;AA1BD,4CA0BC;AAED,MAAM,QAAQ,GAAG,CACf,KAAc,EACd,YAAqB,EACrB,QAAoC,EACf,EAAE,CAAC,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,YAAY,CAAC;IACtC,SAAS,EAAE,KAAK,KAAK,SAAS;CAC/B,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACjD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAO,EAAE;IAC/C,IAAI;QACF,OAAO,IAAI,GAAG,CAAC,KAAqB,CAAC,CAAC;KACvC;IAAC,MAAM;QACN,MAAM,IAAI,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;KACjD;AACH,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACjD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE;IAC5D,IACE,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,0BAAa;QACvB,KAAK,KAAK,8BAAiB,EAC3B;QACA,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAY,EAAE;IACpD,IAAI,KAAK,KAAK,yBAAY,IAAI,KAAK,KAAK,6BAAgB,EAAE;QACxD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC"}

package/lib/npm/call-npm-cli.d.ts CHANGED Viewed

@@ -2,6 +2,7 @@ import type { Logger } from "../options.js";
 import type { NpmCliEnvironment } from "./use-npm-environment.js";
 export interface NpmCliOptions {
     environment: NpmCliEnvironment;
+    ignoreScripts: boolean;
     logger?: Logger | undefined;
 }
 export interface NpmCallResult<CommandT extends Command> {

package/lib/npm/call-npm-cli.js CHANGED Viewed

@@ -36,6 +36,7 @@ exports.E404 = "E404";
 exports.EPUBLISHCONFLICT = "EPUBLISHCONFLICT";
 const NPM = node_os_1.default.platform() === "win32" ? "npm.cmd" : "npm";
 const JSON_MATCH_RE = /(\{[\s\S]*\})/mu;
+const baseArguments = (options) => options.ignoreScripts ? ["--ignore-scripts", "--json"] : ["--json"];
 /**
  * Call the NPM CLI in JSON mode.
  *
@@ -45,7 +46,7 @@ const JSON_MATCH_RE = /(\{[\s\S]*\})/mu;
  * @returns The parsed JSON, or stdout if unparsable.
  */
 async function callNpmCli(command, cliArguments, options) {
-    const { stdout, stderr, exitCode } = await execNpm([command, "--ignore-scripts", "--json", ...cliArguments], options.environment, options.logger);
+    const { stdout, stderr, exitCode } = await execNpm([command, ...baseArguments(options), ...cliArguments], options.environment, options.logger);
     let successData;
     let errorCode;
     let error;

package/lib/npm/call-npm-cli.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"call-npm-cli.js","sourceRoot":"","sources":["../../src/npm/call-npm-cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4EAA8C;AAC9C,sDAAyB;AAEzB,qDAAuC;~~AA+B1B~~,QAAA,IAAI,GAAG,MAAM,CAAC;AACd,QAAA,OAAO,GAAG,SAAS,CAAC;AAEpB,QAAA,IAAI,GAAG,MAAM,CAAC;AACd,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD,MAAM,GAAG,GAAG,iBAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAC9B,OAAiB,EACjB,YAAsB,EACtB,OAAsB;IAEtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAChD,CAAC,OAAO,EAAE,~~kBAAkB~~,~~EAAE~~,~~QAAQ~~,EAAE,GAAG,YAAY,CAAC,~~EACxD~~,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,WAAW,CAAC;IAChB,IAAI,SAAS,CAAC;IACd,IAAI,KAAK,CAAC;IAEV,IAAI,QAAQ,KAAK,CAAC,EAAE;QAClB,WAAW,GAAG,SAAS,CAAwB,MAAM,CAAC,CAAC;KACxD;SAAM;QACL,MAAM,YAAY,GAAG,SAAS,CAC5B,MAAM,EACN,MAAM,CACP,CAAC;QAEF,SAAS,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACrD,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAC5D;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AA5BD,gCA4BC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CACpB,gBAA0B,EAC1B,WAAmC,EACnC,MAAe;IAEf,MAAM,EAAE,KAAK,EAAE,CAAC,oBAAoB,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,MAAM,GAAG,GAAG,4BAAY,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE;YACpD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE;SACxC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,QAAQ,EAAE,IAAI,IAAI,CAAC;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAU,GAAG,MAAgB;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;QAC1B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,SAAS,EAAE;YACb,IAAI;gBACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAY,CAAC;aACzC;YAAC,MAAM;gBACN,OAAO,SAAS,CAAC;aAClB;SACF;KACF;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
1	+ {"version":3,"file":"call-npm-cli.js","sourceRoot":"","sources":["../../src/npm/call-npm-cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4EAA8C;AAC9C,sDAAyB;AAEzB,qDAAuC;AAgC1B,QAAA,IAAI,GAAG,MAAM,CAAC;AACd,QAAA,OAAO,GAAG,SAAS,CAAC;AAEpB,QAAA,IAAI,GAAG,MAAM,CAAC;AACd,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD,MAAM,GAAG,GAAG,iBAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,MAAM,aAAa,GAAG,CAAC,OAAsB,EAAE,EAAE,CAC/C,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAC9B,OAAiB,EACjB,YAAsB,EACtB,OAAsB;IAEtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAChD,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,EACrD,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,WAAW,CAAC;IAChB,IAAI,SAAS,CAAC;IACd,IAAI,KAAK,CAAC;IAEV,IAAI,QAAQ,KAAK,CAAC,EAAE;QAClB,WAAW,GAAG,SAAS,CAAwB,MAAM,CAAC,CAAC;KACxD;SAAM;QACL,MAAM,YAAY,GAAG,SAAS,CAC5B,MAAM,EACN,MAAM,CACP,CAAC;QAEF,SAAS,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACrD,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAC5D;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AA5BD,gCA4BC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CACpB,gBAA0B,EAC1B,WAAmC,EACnC,MAAe;IAEf,MAAM,EAAE,KAAK,EAAE,CAAC,oBAAoB,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,MAAM,GAAG,GAAG,4BAAY,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE;YACpD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE;SACxC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,QAAQ,EAAE,IAAI,IAAI,CAAC;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAU,GAAG,MAAgB;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;QAC1B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,SAAS,EAAE;YACb,IAAI;gBACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAY,CAAC;aACzC;YAAC,MAAM;gBACN,OAAO,SAAS,CAAC;aAClB;SACF;KACF;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/lib/options.d.ts CHANGED Viewed

@@ -53,7 +53,7 @@ export interface Options {
      * packages.
      *
      * Defaults to "restricted" for scoped packages, unless that package has been
-     * previously published as `public`
+     * previously published as `public`.
      *
      * Can be set by the package.json's `publishConfig` field.
      */
@@ -72,13 +72,21 @@ export interface Options {
     /**
      * Version check strategy.
      *
-     * If "upgrade" (default), the package will only be published if its version
-     * is higher than the existing version on the configured tag. If "always", the
-     * package will be published if its version is simply not yet published.
-     *
-     * Defaults to `upgrade`.
+     * - `always` (default): the package will be published if its version is simply
+     *   not yet published.
+     * - `upgrade`: the package will only be published if its version is higher than
+     *   the existing version on the configured tag.
      */
     strategy?: Strategy | undefined;
+    /**
+     * Ignore lifecycle scripts.
+     *
+     * If `true` (default), `--ignore-scripts` will be passed to `npm`. If you
+     * rely on publish lifecycle scripts - i.e. `prepublishOnly`, `prepack`,
+     * `prepare`, `postpack`, `publish`, `postpublish` - you should set this to
+     * `false` or rework your build and publish workflow.
+     */
+    ignoreScripts?: boolean | undefined;
     /**
      * Pretend to publish, but don't actually upload to the registry.
      *

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@jsdevtools/npm-publish",
   "description": "Fast, easy publishing to NPM",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "keywords": [
     "github-action",
     "npm",
@@ -53,29 +53,29 @@
   "devDependencies": {
     "@actions/core": "^1.10.0",
     "@types/command-line-args": "^5.0.0",
-    "@types/node": "^18.15.11",
+    "@types/node": "^18.16.3",
     "@types/tar": "^6.1.4",
-    "@typescript-eslint/eslint-plugin": "^5.59.0",
-    "@typescript-eslint/parser": "^5.59.0",
-    "@vitest/coverage-istanbul": "^0.30.1",
+    "@typescript-eslint/eslint-plugin": "^5.59.2",
+    "@typescript-eslint/parser": "^5.59.2",
+    "@vitest/coverage-istanbul": "^0.31.4",
     "concurrently": "^8.0.1",
-    "esbuild": "0.17.17",
-    "eslint": "^8.38.0",
+    "esbuild": "^0.17.18",
+    "eslint": "^8.39.0",
     "eslint-config-prettier": "^8.8.0",
     "eslint-import-resolver-typescript": "^3.5.5",
     "eslint-plugin-import": "npm:eslint-plugin-i@^2.27.5-1",
-    "eslint-plugin-jsdoc": "^43.0.6",
-    "eslint-plugin-n": "^15.7.0",
+    "eslint-plugin-jsdoc": "^43.1.1",
+    "eslint-plugin-n": "^16.0.0",
     "eslint-plugin-promise": "^6.1.1",
     "eslint-plugin-sonarjs": "^0.19.0",
-    "eslint-plugin-unicorn": "^46.0.0",
-    "prettier": "^2.8.7",
+    "eslint-plugin-unicorn": "^46.0.1",
+    "prettier": "^2.8.8",
     "prettier-plugin-jsdoc": "^0.4.2",
     "rimraf": "^5.0.0",
     "testdouble": "^3.17.2",
     "testdouble-vitest": "^0.1.2",
     "typescript": "^5.0.4",
-    "vitest": "^0.30.1"
+    "vitest": "^0.31.4"
   },
   "dependencies": {
     "@types/semver": "^7.3.13",

package/src/action/core.ts CHANGED Viewed

@@ -45,10 +45,14 @@ export function getRequiredSecretInput(name: string): string {
  * Get a boolean input by name.
  *
  * @param name Input name
- * @returns True if value is "true", false if not
+ * @returns True if value is "true", false if "false", undefined if unset
  */
-export function getBooleanInput(name: string): boolean {
-  return ghGetInput(name) === "true";
+export function getBooleanInput(name: string): boolean | undefined {
+  const inputString = ghGetInput(name).toLowerCase();
+  if (inputString === "true") return true;
+  if (inputString === "false") return false;
+  return undefined;
 }
 /**

package/src/action/main.ts CHANGED Viewed

@@ -12,6 +12,7 @@ async function run(): Promise<void> {
     access: core.getInput("access"),
     provenance: core.getBooleanInput("provenance"),
     strategy: core.getInput("strategy"),
+    ignoreScripts: core.getBooleanInput("ignore-scripts"),
     dryRun: core.getBooleanInput("dry-run"),
     logger: core.logger,
     temporaryDirectory: process.env["RUNNER_TEMP"],

package/src/cli/index.ts CHANGED Viewed

@@ -31,6 +31,9 @@ Options:
   --strategy <strategy>   Publish strategy, may be "all" or "upgrade".
                           Defaults to "all", see documentation for details.
+  --ignore-scripts        Ignore lifecycle scripts as a security precaution.
+                          Defaults to true.
   --dry-run               Do not actually publish anything.
   --quiet                 Only print errors.
   --debug                 Print debug logs.

package/src/cli/parse-cli-arguments.ts CHANGED Viewed

@@ -11,6 +11,7 @@ const ARGUMENTS_OPTIONS = [
   { name: "access", type: String },
   { name: "provenance", type: Boolean },
   { name: "strategy", type: String },
+  { name: "no-ignore-scripts", type: Boolean },
   { name: "dry-run", type: Boolean },
   { name: "quiet", type: Boolean },
   { name: "debug", type: Boolean },
@@ -34,11 +35,19 @@ export interface ParsedArguments {
  * @returns A parsed object of options.
  */
 export function parseCliArguments(argv: string[]): ParsedArguments {
-  const { help, version, quiet, debug, ...options } = commandLineArgs(
+  const { help, version, quiet, debug, ...optionFlags } = commandLineArgs(
     ARGUMENTS_OPTIONS,
     { argv, camelCase: true }
   );
+  const options = Object.fromEntries(
+    Object.entries(optionFlags).map(([key, value]) => {
+      return key === "noIgnoreScripts"
+        ? ["ignoreScripts", !value]
+        : [key, value];
+    })
+  );
   return {
     help: Boolean(help),
     version: Boolean(version),

package/src/compare-and-publish/compare-and-publish.ts CHANGED Viewed

@@ -35,7 +35,11 @@ export async function compareAndPublish(
   environment: NpmCliEnvironment
 ): Promise<PublishResult> {
   const { name, version, packageSpec } = manifest;
-  const cliOptions = { environment, logger: options.logger };
+  const cliOptions = {
+    environment,
+    ignoreScripts: options.ignoreScripts.value,
+    logger: options.logger,
+  };
   const viewArguments = getViewArguments(name, options);
   const publishArguments = getPublishArguments(packageSpec, options);

package/src/normalize-options.ts CHANGED Viewed

@@ -23,6 +23,7 @@ export interface NormalizedOptions {
   tag: ConfigValue<string>;
   access: ConfigValue<Access | undefined>;
   provenance: ConfigValue<boolean>;
+  ignoreScripts: ConfigValue<boolean>;
   dryRun: ConfigValue<boolean>;
   strategy: ConfigValue<Strategy>;
   logger: Logger | undefined;
@@ -62,6 +63,7 @@ export function normalizeOptions(
     tag: setValue(options.tag, defaultTag, validateTag),
     access: setValue(options.access, defaultAccess, validateAccess),
     provenance: setValue(options.provenance, defaultProvenance, Boolean),
+    ignoreScripts: setValue(options.ignoreScripts, true, Boolean),
     dryRun: setValue(options.dryRun, false, Boolean),
     strategy: setValue(options.strategy, STRATEGY_ALL, validateStrategy),
     logger: options.logger,

package/src/npm/call-npm-cli.ts CHANGED Viewed

@@ -7,6 +7,7 @@ import type { NpmCliEnvironment } from "./use-npm-environment.js";
 export interface NpmCliOptions {
   environment: NpmCliEnvironment;
+  ignoreScripts: boolean;
   logger?: Logger | undefined;
 }
@@ -41,6 +42,9 @@ export const EPUBLISHCONFLICT = "EPUBLISHCONFLICT";
 const NPM = os.platform() === "win32" ? "npm.cmd" : "npm";
 const JSON_MATCH_RE = /(\{[\s\S]*\})/mu;
+const baseArguments = (options: NpmCliOptions) =>
+  options.ignoreScripts ? ["--ignore-scripts", "--json"] : ["--json"];
 /**
  * Call the NPM CLI in JSON mode.
  *
@@ -55,7 +59,7 @@ export async function callNpmCli<CommandT extends Command>(
   options: NpmCliOptions
 ): Promise<NpmCallResult<CommandT>> {
   const { stdout, stderr, exitCode } = await execNpm(
-    [command, "--ignore-scripts", "--json", ...cliArguments],
+    [command, ...baseArguments(options), ...cliArguments],
     options.environment,
     options.logger
   );

package/src/options.ts CHANGED Viewed

@@ -60,7 +60,7 @@ export interface Options {
    * packages.
    *
    * Defaults to "restricted" for scoped packages, unless that package has been
-   * previously published as `public`
+   * previously published as `public`.
    *
    * Can be set by the package.json's `publishConfig` field.
    */
@@ -81,14 +81,23 @@ export interface Options {
   /**
    * Version check strategy.
    *
-   * If "upgrade" (default), the package will only be published if its version
-   * is higher than the existing version on the configured tag. If "always", the
-   * package will be published if its version is simply not yet published.
-   *
-   * Defaults to `upgrade`.
+   * - `always` (default): the package will be published if its version is simply
+   *   not yet published.
+   * - `upgrade`: the package will only be published if its version is higher than
+   *   the existing version on the configured tag.
    */
   strategy?: Strategy | undefined;
+  /**
+   * Ignore lifecycle scripts.
+   *
+   * If `true` (default), `--ignore-scripts` will be passed to `npm`. If you
+   * rely on publish lifecycle scripts - i.e. `prepublishOnly`, `prepack`,
+   * `prepare`, `postpack`, `publish`, `postpublish` - you should set this to
+   * `false` or rework your build and publish workflow.
+   */
+  ignoreScripts?: boolean | undefined;
   /**
    * Pretend to publish, but don't actually upload to the registry.
    *