({
tree,
policy,
ignoreScripts = false,
dangerouslyAllowAllScripts = false,
includeWhenIgnored = false,
} = {})
| 13 | // Returns an array of `{ node, scripts }` entries. `scripts` is an object |
| 14 | // describing the relevant lifecycle scripts that would run. |
| 15 | const collectUnreviewedScripts = async ({ |
| 16 | tree, |
| 17 | policy, |
| 18 | ignoreScripts = false, |
| 19 | dangerouslyAllowAllScripts = false, |
| 20 | includeWhenIgnored = false, |
| 21 | } = {}) => { |
| 22 | // With ignore-scripts set, no scripts run, so execution callers bail out |
| 23 | // here. approve/deny pass includeWhenIgnored so they keep listing |
| 24 | // unreviewed packages, which is what you need to move from a blanket |
| 25 | // ignore-scripts to an allowlist. Listing never runs anything. |
| 26 | if ((ignoreScripts && !includeWhenIgnored) || dangerouslyAllowAllScripts) { |
| 27 | return [] |
| 28 | } |
| 29 | |
| 30 | if (!tree?.inventory) { |
| 31 | return [] |
| 32 | } |
| 33 | |
| 34 | const resolvedPolicy = policy || null |
| 35 | |
| 36 | const unreviewed = [] |
| 37 | for (const node of tree.inventory.values()) { |
| 38 | if (node.isProjectRoot || node.isWorkspace) { |
| 39 | continue |
| 40 | } |
| 41 | if (node.isLink) { |
| 42 | // Linked workspace dependencies are managed by the workspace owner. |
| 43 | continue |
| 44 | } |
| 45 | if (node.inBundle) { |
| 46 | // Bundled dependencies never run their install scripts and cannot be |
| 47 | // allowlisted, so they are never "pending". Skipping them keeps them |
| 48 | // out of the advisory warning and out of strict-allow-scripts. A |
| 49 | // package that needs a bundled dep's script must forward it as one of |
| 50 | // its own lifecycle scripts. |
| 51 | continue |
| 52 | } |
| 53 | if (node.inert) { |
| 54 | // Inert = an optional dep that can't be installed here (failed the |
| 55 | // os/cpu/libc or engine check, or failed to load). reify drops it |
| 56 | // before any script runs, so its install scripts never execute and it |
| 57 | // must not be flagged (npm/cli#9562). |
| 58 | continue |
| 59 | } |
| 60 | |
| 61 | const verdict = isScriptAllowed(node, resolvedPolicy) |
| 62 | if (verdict === true || verdict === false) { |
| 63 | continue |
| 64 | } |
| 65 | |
| 66 | const scripts = await getInstallScripts(node) |
| 67 | if (Object.keys(scripts).length === 0) { |
| 68 | continue |
| 69 | } |
| 70 | |
| 71 | unreviewed.push({ node, scripts }) |
| 72 | } |
no test coverage detected