How to know the list of packages that are ignored by lifecycle scripts?

[azu]

pnpm 10 now ignores lifecycle scripts by default.

• https://github.com/pnpm/pnpm/releases/tag/v10.0.0

I am looking for a command to retrieve packages that have this ignored lifecyle script.

Motivation

I want to detect packages whose lifecycle scripts are being ignored.
I want CI to detect that some packages are being ignored, or want to fail pnpm install itself if ignored scripts exists.

Current behavior

If already have node_modules/, pnpm install will not show warnings for ignoredScripts.
Warnings are not always displayed and may be missed.

# first time - show warning
$ pnpm install
Lockfile is up to date, resolution step is skipped
Packages: +40
++++++++++++++++++++++++++++++++++++++++
Progress: resolved 40, reused 40, downloaded 0, added 40, done

dependencies: +40, reused 40, downloaded 0, added 40, done
+ canvas 3.0.1

The following dependencies have build scripts that were ignored: canvas
To allow the execution of build scripts for these packages, add their names to “pnpm.onlyBuiltDependencies” in your “package.json”, then run “pnpm rebuild”.

Done in 1.6s

# second time - no warning
$ pnpm install
Already up to date
Done in 456ms
Done in 456ms

The following features may solve this problem.

• A command like pnpm get-packages-with-ignored-scripts that returned ignored packaged
  • or, pnpm list --filter-ignored-scripts
• A flag like pnpm install --fail-on-ignored-scripts to fail on pnpm install if there are packages with ignored lifecycle scripts
• A onIgnoredScripts-like hook for .pnpmfile.cjs to do something if there are packages for which lifecycle scripts are ignored

workaround:

The only way I have found to determine this is to remove node_modules, then run pnpm install and see if The following dependencies have build scripts that were ignored appears in the standard output.
However, this method relies on a warning message, which may break at any time.

rm -rf node_modules && pnpm install | (grep -q “The following dependencies have build scripts that were ignored” && exit 1 || exit 0)

If you have a more stable way to do this, I would appreciate it.

[zkochan]

We don't have such command yet. We currently store the list of ignored dependencies inside the "ignoredBuilds" field in "node_modules/.modules.yaml".

We can add a flag to make pnpm exit with a non-0 exit code if there are ignored builds not explicitly listed in some ignore list.

[azu]

Thanks

We don't have such command yet. We currently store the list of ignored dependencies inside the "ignoredBuilds" field in "node_modules/.modules.yaml".

I've confirmed at example repo.

$ git clone https://github.com/azu/pnpm-10-with-postinstall-lifecyle.git
$ cd pnpm-10-with-postinstall-lifecyle
$ pnpm i
$ cat node_modules/.modules.yaml | yq .ignoredBuilds
- canvas

We can add a flag to make pnpm exit with a non-0 exit code if there are ignored builds not explicitly listed in some ignore list.

Looks good.

I thought it would be useful to have a CLI flag or setting (.npmrc?) that would make pnpm install fail if a package is not defined in either pnpm.onlyBuiltDependencies and pnpm.neverBuiltDependencies.

[azu]

📝 I've used following GitHub Actions workflow to check ignored build.

name: pnpm-ignored-build-check

on:
  push:
  pull_request:

jobs:
  pnpm-ignored-build-check:
    permissions:
      contents: "read"
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: package.json
          cache: pnpm
      - name: Install
        run: pnpm install
      - name: Check ignoredBuilds
        run: |
          ignoredBuilds=$(yq .ignoredBuilds < node_modules/.modules.yaml)
          if [ "$ignoredBuilds" = "null" ] || [ "$ignoredBuilds" = "[]" ]; then
            echo "ok"
            exit 0
          else
            echo "Following packages were unexpected ignored in build on pnpm install"
            echo "$ignoredBuilds"
            exit 1
          fi

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

[jgarplind]

Sorry if this is only tangentially related, but I just wanted to share some observations which are difficult to package in a way that warrant their own discussion topic.

At some point, I collected this from my terminal output. Probably during a (re-)installation of dependencies. Notably I've been unable to reproduce the output despite removing my node_modules folder(s) (and even my `pnpm-lock.yaml file), which is confusing me.

The following dependencies have build scripts that were ignored: @swc/core, matrix-js-sdk, msw
To allow the execution of build scripts for these packages, add their names to "pnpm.onlyBuiltDependencies" in your "package.json", then run "pnpm rebuild"

Maybe it's better asked directly to the package maintainer, but given this package.json, I don't see any "lifecycle scripts"? I'm fuzzy on the exact definition of a "lifecycle script" though, so perhaps I'm just missing something?

Then, in the .modules.yaml file mentioned by you above, I can actually find some more packages which I cannot recall having ever seen in the terminal output:

• '@sentry/cli'
• esbuild
• '@parcel/watcher'

All in all, it seems that the .modules.yaml is correct, so I can only agree with @azu that it would be very useful to have this information more readily and consistently communicated when running the pnpm CLI.