Skip to content

fix(config): conflicts between global and local in whether to run scripts#9714

Merged
zkochan merged 7 commits intomainfrom
dangerously-allow-all-builds-conflicts-with-local-projects-9628
Jul 7, 2025
Merged

fix(config): conflicts between global and local in whether to run scripts#9714
zkochan merged 7 commits intomainfrom
dangerously-allow-all-builds-conflicts-with-local-projects-9628

Conversation

@KSXGitHub
Copy link
Contributor

Fixes #9628

@KSXGitHub KSXGitHub marked this pull request as ready for review July 3, 2025 14:39
@KSXGitHub KSXGitHub requested a review from zkochan as a code owner July 3, 2025 14:39
@KSXGitHub KSXGitHub changed the title fix(config): conflicts between global and local fix(config): conflicts between global and local in whether to run scripts Jul 3, 2025
@zkochan
Copy link
Member

zkochan commented Jul 4, 2025

I don't think that this is the right solution. You are making it impossible to set this setting globally. Users should be able to allow all scripts in all projects on the computer by globally setting dangerouslyAllowAllBuilds to true. But if a project has an allow list or a disallow list of built dependencies, then prefer those local settings.

@KSXGitHub
Copy link
Contributor Author

@zkochan c9c51ee

@zkochan zkochan requested a review from Copilot July 7, 2025 10:05
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Fix conflicts between global and local settings for running lifecycle scripts by extracting build-related config keys and applying them with correct precedence.

  • Introduces depsBuildConfig.ts helpers to remove and reapply build settings
  • Refactors getConfig to strip build flags from the base config and conditionally merge global or local values
  • Adds end-to-end tests in global.ts covering both dangerously-allow-all-builds and onlyBuiltDependencies behaviors

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
pnpm/test/install/global.ts Adds tests to verify global versus local build flag precedence
config/config/src/index.ts Refactors getConfig to separate and conditionally merge build keys
config/config/src/depsBuildConfig.ts New utilities for extracting/removing build-related settings
.changeset/cuddly-plants-sleep.md Documents version bump and PR purpose
Comments suppressed due to low confidence (3)

config/config/src/index.ts:230

  • [nitpick] The variable name globalConfigWithoutDepsBuildSettings is quite long and may reduce readability. Consider renaming it to something shorter like baseGlobalConfig or globalBaseConfig.
  const globalConfigWithoutDepsBuildSettings: ConfigWithDeprecatedSettings = Object.fromEntries(

config/config/src/index.ts:382

  • [nitpick] Add a brief comment explaining why build settings are removed and reapplied in the global branch to clarify the intended precedence logic for future maintainers.
  if (opts.cliOptions['global']) {

pnpm/test/install/global.ts:95

  • [nitpick] You might group or annotate platform-specific tests together (e.g., using test.skip with a message) so it's clear why they are no-ops on non-Linux environments.
  if (process.platform !== 'linux') return

import which from 'which'
import { inheritAuthConfig } from './auth'
import { checkGlobalBinDir } from './checkGlobalBinDir'
import { hasDepsBuild, removeDepsBuild } from './depsBuildConfig'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The names of these functions are not descriptive enough.

Suggested change
import { hasDepsBuild, removeDepsBuild } from './depsBuildConfig'
import { hasDependencyBuildOptions
, extractAndRemoveDependencyBuildOptions } from './depsBuildConfig'

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment on lines +230 to +235
const globalConfigWithoutDepsBuildSettings: ConfigWithDeprecatedSettings = Object.fromEntries(
rcOptions.map((configKey) => [camelcase(configKey, { locale: 'en-US' }), npmConfig.get(configKey)])
) as ConfigWithDeprecatedSettings
const globalDepsBuildConfig = removeDepsBuild(globalConfigWithoutDepsBuildSettings)

const pnpmConfig: ConfigWithDeprecatedSettings = Object.assign(globalConfigWithoutDepsBuildSettings, configFromCliOpts) as unknown as ConfigWithDeprecatedSettings
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't it easier just to skip the removal in case of global install?

This comment was marked as outdated.

Copy link
Contributor Author

@KSXGitHub KSXGitHub Jul 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not easier. This method would require every code path below to refrain from inheriting the settings from local config or CLI args or etc, increasing complexity. It is simplier to just inherit them all then remove them later.

rcOptions.map((configKey) => [camelcase(configKey, { locale: 'en-US' }), npmConfig.get(configKey)]) as any, // eslint-disable-line
), configFromCliOpts) as unknown as ConfigWithDeprecatedSettings

const globalConfigWithoutDepsBuildSettings: ConfigWithDeprecatedSettings = Object.fromEntries(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the name of this variable is confusing because at this point it has the build settings.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's just pnpmConfig now: 5082f95

@KSXGitHub KSXGitHub requested a review from zkochan July 7, 2025 13:16
@zkochan zkochan merged commit 623da6f into main Jul 7, 2025
19 of 21 checks passed
@zkochan zkochan deleted the dangerously-allow-all-builds-conflicts-with-local-projects-9628 branch July 7, 2025 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Avoid conflict with existing projects and scripts when using dangerously-allow-all-builds globally

3 participants