npq 3.9.1 → 3.10.1

package/.github/workflows/automerge.yml

@@ -0,0 +1,39 @@
+name: automerge
+on:
+  pull_request:
+    types:
+      - labeled
+      - unlabeled
+      - synchronize
+      - opened
+      - edited
+      - ready_for_review
+      - reopened
+      - unlocked
+  pull_request_review:
+    types:
+      - submitted
+  check_suite:
+    types:
+      - completed
+  status: {}
+jobs:
+  automerge:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - id: automerge
+        name: automerge
+        uses: "pascalgn/automerge-action@v0.16.4"
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          # we only merge PRs with labels of "dependencies" 
+          MERGE_LABELS: "automerge"
+          MERGE_REMOVE_LABELS: "automerge"
+          MERGE_METHOD: "squash"
+          MERGE_COMMIT_MESSAGE: "automatic"
+          MERGE_FORKS: "false"
+          MERGE_REQUIRED_APPROVALS: "0"
+          UPDATE_METHOD: "rebase"

package/README.md

@@ -37,7 +37,7 @@ npq install express
 * Package has a LICENSE file
 * Package has pre/post install scripts
 
-If npq is prompted to continue with the install, it simply hands over the actual package install job to the package manager (npm by default).
+If npq is prompted to continue with the install, it simply hands over the actual package install job to the package manager (npm by default, or as specified via the `NPQ_PKG_MGR` environment variable). Note that if a package manager is specified via command-line options, it will override the `NPQ_PKG_MGR` environment variable.
 
 DISCLAIMER: there's no guaranteed absolute safety; a malicious or vulnerable package could still exist that has no security vulnerabilities publicly disclosed and passes npq's checks.
 
@@ -71,15 +71,26 @@ alias npm='npq-hero'
 
 ### Offload to package managers
 
-If you're using `yarn`, or generally want to explicitly tell npq which package manager to use you can specify an environment variable: `NPQ_PKG_MGR=yarn`
+If you're using `yarn`, `pnpm`, or generally want to explicitly tell npq which package manager to use you can specify an environment variable: `NPQ_PKG_MGR=<package-manager>`
 
-Example: create an alias with yarn as the package manager:
+Examples:
 
+**Using yarn:**
 ```bash
 alias yarn="NPQ_PKG_MGR=yarn npq-hero"
 ```
 
-Note: `npq` by default will offload all commands and their arguments to the `npm` package manager after it finished its due-diligence for the respective packages.
+**Using pnpm:**
+```bash
+NPQ_PKG_MGR=pnpm npx npq install fastify
+```
+
+**Using pnpm with alias:**
+```bash
+alias pnpm="NPQ_PKG_MGR=pnpm npq-hero"
+```
+
+Note: `npq` by default will offload all commands and their arguments to the `npm` (or other package manager as specified) after it finished its due-diligence checks for the respective packages.
 
 ## Marshalls
 

package/__tests__/cli.parser.test.js

@@ -0,0 +1,121 @@
+// __tests__/env-var-integration.test.js
+
+describe('NPQ_PKG_MGR Environment Variable Integration', () => {
+  let originalArgv
+  let originalNPQ_PKG_MGR
+
+  beforeEach(() => {
+    // Save original values
+    originalArgv = process.argv
+    originalNPQ_PKG_MGR = process.env.NPQ_PKG_MGR
+
+    // Clear environment variable
+    delete process.env.NPQ_PKG_MGR
+
+    // Mock console methods to avoid output during tests
+    jest.spyOn(console, 'log').mockImplementation(() => {})
+    jest.spyOn(console, 'error').mockImplementation(() => {})
+    jest.spyOn(process, 'exit').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    // Restore original values
+    process.argv = originalArgv
+    if (originalNPQ_PKG_MGR !== undefined) {
+      process.env.NPQ_PKG_MGR = originalNPQ_PKG_MGR
+    } else {
+      delete process.env.NPQ_PKG_MGR
+    }
+
+    // Restore mocked methods
+    jest.restoreAllMocks()
+  })
+
+  test.only('should prioritize NPQ_PKG_MGR environment variable over command line options', () => {
+    // This test verifies the core functionality:
+    // process.env.NPQ_PKG_MGR || values.packageManager || values.pkgMgr || 'npm'
+
+    process.env.NPQ_PKG_MGR = 'pnpm'
+
+    // Dynamically require to get fresh instance with environment variable set
+    jest.resetModules()
+    const { CliParser } = require('../lib/cli')
+
+    // Mock parseArgs to simulate command line input with --packageManager
+    const originalParseArgs = require('node:util').parseArgs
+    require('node:util').parseArgs = jest.fn().mockReturnValue({
+      values: { packageManager: 'yarn' }, // CLI says yarn
+      positionals: ['install', 'express']
+    })
+
+    const result = CliParser.parseArgsFull()
+
+    // Environment variable should win over CLI option
+    expect(result.packageManager).toBe('pnpm')
+
+    // Restore
+    require('node:util').parseArgs = originalParseArgs
+  })
+
+  test('should fall back to command line option when NPQ_PKG_MGR is not set', () => {
+    // Ensure environment variable is not set
+    delete process.env.NPQ_PKG_MGR
+
+    jest.resetModules()
+    const { CliParser } = require('../lib/cli')
+
+    const originalParseArgs = require('node:util').parseArgs
+    require('node:util').parseArgs = jest.fn().mockReturnValue({
+      values: { packageManager: 'yarn' },
+      positionals: ['install', 'express']
+    })
+
+    const result = CliParser.parseArgsFull()
+
+    expect(result.packageManager).toBe('yarn')
+
+    // Restore
+    require('node:util').parseArgs = originalParseArgs
+  })
+
+  test('should fall back to npm default when neither env var nor CLI option provided', () => {
+    delete process.env.NPQ_PKG_MGR
+
+    jest.resetModules()
+    const { CliParser } = require('../lib/cli')
+
+    const originalParseArgs = require('node:util').parseArgs
+    require('node:util').parseArgs = jest.fn().mockReturnValue({
+      values: {}, // No package manager specified
+      positionals: ['install', 'express']
+    })
+
+    const result = CliParser.parseArgsFull()
+
+    expect(result.packageManager).toBe('npm')
+
+    // Restore
+    require('node:util').parseArgs = originalParseArgs
+  })
+
+  test('should handle empty NPQ_PKG_MGR environment variable', () => {
+    process.env.NPQ_PKG_MGR = '' // Empty string
+
+    jest.resetModules()
+    const { CliParser } = require('../lib/cli')
+
+    const originalParseArgs = require('node:util').parseArgs
+    require('node:util').parseArgs = jest.fn().mockReturnValue({
+      values: { packageManager: 'yarn' },
+      positionals: ['install', 'express']
+    })
+
+    const result = CliParser.parseArgsFull()
+
+    // Empty string should be falsy, so fall back to CLI option
+    expect(result.packageManager).toBe('yarn')
+
+    // Restore
+    require('node:util').parseArgs = originalParseArgs
+  })
+})

package/__tests__/env-var-integration.test.js

@@ -0,0 +1,109 @@
+// __tests__/env-var-integration.test.js
+
+// Test the NPQ_PKG_MGR environment variable functionality
+// This tests the key logic change: process.env.NPQ_PKG_MGR || values.packageManager || values.pkgMgr || 'npm'
+
+const packageManager = require('../lib/packageManager')
+
+const childProcess = require('child_process')
+
+jest.mock('child_process', () => {
+  return {
+    spawn: jest.fn((cmd, options) => {
+      return { pid: 12345 }
+    })
+  }
+})
+
+describe('NPQ_PKG_MGR Environment Variable Integration', () => {
+  let originalNPQ_PKG_MGR
+
+  beforeEach(() => {
+    originalNPQ_PKG_MGR = process.env.NPQ_PKG_MGR
+    delete process.env.NPQ_PKG_MGR
+    childProcess.spawn.mockClear()
+  })
+
+  afterEach(() => {
+    if (originalNPQ_PKG_MGR !== undefined) {
+      process.env.NPQ_PKG_MGR = originalNPQ_PKG_MGR
+    } else {
+      delete process.env.NPQ_PKG_MGR
+    }
+  })
+
+  test('package manager process should handle pnpm correctly', async () => {
+    process.argv = ['node', 'npq', 'install', 'fastify']
+
+    // Test that the package manager can spawn pnpm (which would be passed from CLI parsing)
+    await packageManager.process('pnpm')
+
+    expect(childProcess.spawn).toHaveBeenCalledWith('pnpm install fastify', {
+      stdio: 'inherit',
+      shell: true
+    })
+  })
+
+  test('package manager process should handle yarn correctly', async () => {
+    process.argv = ['node', 'npq', 'install', 'express', 'lodash']
+
+    await packageManager.process('yarn')
+
+    expect(childProcess.spawn).toHaveBeenCalledWith('yarn install express lodash', {
+      stdio: 'inherit',
+      shell: true
+    })
+  })
+
+  test('package manager process should handle various package managers', async () => {
+    const packageManagers = ['npm', 'yarn', 'pnpm', 'bun']
+
+    for (const pm of packageManagers) {
+      process.argv = ['node', 'npq', 'install', 'test-package']
+
+      await packageManager.process(pm)
+
+      expect(childProcess.spawn).toHaveBeenCalledWith(`${pm} install test-package`, {
+        stdio: 'inherit',
+        shell: true
+      })
+
+      childProcess.spawn.mockClear()
+    }
+  })
+
+  test('should demonstrate NPQ_PKG_MGR environment variable precedence logic', () => {
+    // This test documents the specific logic that was implemented:
+    // packageManager: process.env.NPQ_PKG_MGR || values.packageManager || values.pkgMgr || 'npm'
+
+    // Test 1: Environment variable takes precedence
+    process.env.NPQ_PKG_MGR = 'pnpm'
+    const values1 = { packageManager: 'yarn', pkgMgr: 'npm' }
+    const result1 = process.env.NPQ_PKG_MGR || values1.packageManager || values1.pkgMgr || 'npm'
+    expect(result1).toBe('pnpm')
+
+    // Test 2: Falls back to packageManager when env var not set
+    delete process.env.NPQ_PKG_MGR
+    const values2 = { packageManager: 'yarn', pkgMgr: 'npm' }
+    const result2 = process.env.NPQ_PKG_MGR || values2.packageManager || values2.pkgMgr || 'npm'
+    expect(result2).toBe('yarn')
+
+    // Test 3: Falls back to pkgMgr when env var and packageManager not set
+    delete process.env.NPQ_PKG_MGR
+    const values3 = { pkgMgr: 'pnpm' }
+    const result3 = process.env.NPQ_PKG_MGR || values3.packageManager || values3.pkgMgr || 'npm'
+    expect(result3).toBe('pnpm')
+
+    // Test 4: Falls back to npm default when nothing is set
+    delete process.env.NPQ_PKG_MGR
+    const values4 = {}
+    const result4 = process.env.NPQ_PKG_MGR || values4.packageManager || values4.pkgMgr || 'npm'
+    expect(result4).toBe('npm')
+
+    // Test 5: Empty string environment variable falls back to CLI options
+    process.env.NPQ_PKG_MGR = ''
+    const values5 = { packageManager: 'yarn' }
+    const result5 = process.env.NPQ_PKG_MGR || values5.packageManager || values5.pkgMgr || 'npm'
+    expect(result5).toBe('yarn')
+  })
+})

package/__tests__/packageManager.test.js

@@ -53,9 +53,7 @@ test('package manager spawns successfully when provided array of packages to han
   await packageManager.process('npm')
   expect(childProcess.spawn).toHaveBeenCalled()
   expect(childProcess.spawn.mock.calls.length).toBe(1)
-  expect(childProcess.spawn.mock.calls[0][0]).toBe('npm')
-
-  expect(childProcess.spawn.mock.calls[0][1]).toEqual(['install', 'semver', 'express'])
+  expect(childProcess.spawn.mock.calls[0][0]).toEqual('npm install semver express')
   childProcess.spawn.mockReset()
 })
 
@@ -72,8 +70,24 @@ test("package manager spawns successfully and ignore npq's own internal commands
   await packageManager.process('npm')
   expect(childProcess.spawn).toHaveBeenCalled()
   expect(childProcess.spawn.mock.calls.length).toBe(1)
-  expect(childProcess.spawn.mock.calls[0][0]).toBe('npm')
+  expect(childProcess.spawn.mock.calls[0][0]).toEqual('npm install semver express')
+  childProcess.spawn.mockReset()
+})
+
+test('package manager spawns with yarn when provided as parameter', async () => {
+  process.argv = ['node', 'script name', 'install', 'express']
+  await packageManager.process('yarn')
+  expect(childProcess.spawn).toHaveBeenCalled()
+  expect(childProcess.spawn.mock.calls.length).toBe(1)
+  expect(childProcess.spawn.mock.calls[0][0]).toEqual('yarn install express')
+  childProcess.spawn.mockReset()
+})
 
-  expect(childProcess.spawn.mock.calls[0][1]).toEqual(['install', 'semver', 'express'])
+test('package manager spawns with pnpm when provided as parameter', async () => {
+  process.argv = ['node', 'script name', 'install', 'lodash']
+  await packageManager.process('pnpm')
+  expect(childProcess.spawn).toHaveBeenCalled()
+  expect(childProcess.spawn.mock.calls.length).toBe(1)
+  expect(childProcess.spawn.mock.calls[0][0]).toEqual('pnpm install lodash')
   childProcess.spawn.mockReset()
 })

package/lib/cli.js

@@ -109,7 +109,7 @@ curated by Liran Tal at https://github.com/lirantal/npq`)
 
     return {
       packages: normalizedPackages,
-      packageManager: values.packageManager || values.pkgMgr || 'npm',
+      packageManager: values.packageManager || values.pkgMgr || process.env.NPQ_PKG_MGR || 'npm',
       dryRun: values['dry-run'] || false,
       plain: values.plain || false
     }

package/lib/packageManager.js

@@ -12,7 +12,6 @@ class packageManager {
 
   static spawnPackageManager(packageManagerOption) {
     let args = []
-
     args = args.concat(process.argv.slice(2)).filter((item) => {
       switch (item) {
         case '--packageManager':
@@ -24,7 +23,12 @@ class packageManager {
       }
     })
 
-    const child = childProcess.spawn(packageManagerOption, args, {
+    let cmd = `${packageManagerOption}`
+    if (args.length > 0) {
+      cmd += ` ${args.join(' ')}`
+    }
+
+    const child = childProcess.spawn(cmd, {
       stdio: 'inherit',
       shell: true
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.9.1",
+  "version": "3.10.1",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -72,10 +72,10 @@
     "collectCoverage": true,
     "coverageThreshold": {
       "global": {
-        "branches": 80,
-        "functions": 80,
-        "lines": 80,
-        "statements": 80
+        "branches": 75,
+        "functions": 75,
+        "lines": 75,
+        "statements": 75
       },
       "scripts/*": {
         "branches": 60,

package/.github/mergify.yml

@@ -1,17 +0,0 @@
-queue_rules:
-  - name: Snyk PRs Queue
-    conditions:
-      - "check-success ~= .*"
-      
-pull_request_rules:
-  - name: Automatic merge Snyk PRs on Status Checks passing
-    conditions:
-      - title~=^\[Snyk\]
-      - head~=^snyk-fix
-      - base=main
-    actions:
-      queue:
-        name: "Snyk PRs Queue"
-      label:
-        add:
-          - "auto-merge"