@pnpm/building.policy 1100.0.10 → 1100.0.12

package/lib/index.js

@@ -11,17 +11,21 @@ export function createAllowBuildFunction(opts) {
         const disallowedPackageBuilds = new Set();
         const allowedDepPathBuilds = new Set();
         const disallowedDepPathBuilds = new Set();
+        const allowedGitRepoBuilds = new Set();
+        const disallowedGitRepoBuilds = new Set();
         for (const [pkg, value] of Object.entries(opts.allowBuilds)) {
             switch (value) {
                 case true:
                     addAllowBuildRule(pkg, {
                         depPaths: allowedDepPathBuilds,
+                        gitRepos: allowedGitRepoBuilds,
                         packageSpecs: allowedPackageBuilds,
                     });
                     break;
                 case false:
                     addAllowBuildRule(pkg, {
                         depPaths: disallowedDepPathBuilds,
+                        gitRepos: disallowedGitRepoBuilds,
                         packageSpecs: disallowedPackageBuilds,
                     });
                     break;
@@ -34,6 +38,10 @@ export function createAllowBuildFunction(opts) {
             if (disallowedDepPathBuilds.has(pkgIdWithPatchHash)) {
                 return false;
             }
+            const gitRepoKey = getGitRepoAllowBuildKeyFromDepPath(pkgIdWithPatchHash);
+            if (gitRepoKey != null && disallowedGitRepoBuilds.has(gitRepoKey)) {
+                return false;
+            }
             const { name, version, nonSemverVersion } = dp.parse(depPath);
             const nameAtVersion = name != null && version != null ? `${name}@${version}` : undefined;
             if ((name != null && expandedDisallowed.has(name)) ||
@@ -43,6 +51,9 @@ export function createAllowBuildFunction(opts) {
             if (allowedDepPathBuilds.has(pkgIdWithPatchHash)) {
                 return true;
             }
+            if (gitRepoKey != null && allowedGitRepoBuilds.has(gitRepoKey)) {
+                return true;
+            }
             // Package-name rules require a trusted package identity. A
             // registry-style depPath (name@semver) is the trust signal: the
             // lockfile verification gate rejects lockfiles where such a key is
@@ -77,6 +88,10 @@ export function allowBuildKeyFromIgnoredBuild(depPath) {
     return parsed.name;
 }
 function addAllowBuildRule(pkg, target) {
+    if (isGitRepoAllowBuildKey(pkg)) {
+        target.gitRepos.add(pkg);
+        return;
+    }
     if (isDepPathAllowBuildKey(pkg)) {
         target.depPaths.add(dp.removePeersSuffix(pkg));
     }
@@ -84,6 +99,18 @@ function addAllowBuildRule(pkg, target) {
         target.packageSpecs.add(pkg);
     }
 }
+function isGitRepoAllowBuildKey(pkg) {
+    return !pkg.includes('#') && isGitRepoDepPath(pkg);
+}
+function getGitRepoAllowBuildKeyFromDepPath(depPath) {
+    if (!isGitRepoDepPath(depPath))
+        return undefined;
+    const refStart = depPath.indexOf('#');
+    return refStart === -1 ? depPath : depPath.slice(0, refStart);
+}
+function isGitRepoDepPath(depPath) {
+    return depPath.startsWith('git+') || depPath.includes('@git+');
+}
 function isDepPathAllowBuildKey(pkg) {
     if (dp.removePeersSuffix(pkg) !== pkg)
         return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/building.policy",
-  "version": "1100.0.10",
+  "version": "1100.0.12",
   "description": "Create a function for filtering out dependencies that are not allowed to be built",
   "keywords": [
     "pnpm",
@@ -10,9 +10,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/building/policy"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/building/policy"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/building/policy#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/building/policy#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -27,13 +27,13 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.version-policy": "1100.1.5",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/deps.path": "1100.0.8"
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/types": "1101.3.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/building.policy": "1100.0.10"
+    "@pnpm/building.policy": "1100.0.12"
   },
   "engines": {
     "node": ">=22.13"