-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Description
monorepo root .bin executable not working when run from workspace package directory if ignore-scripts=true is set in .npmrc. One of my requirement for pnpm migration is to not run scripts due to supply chain attacks.
Works as expected if I remove ignore-scripts=true
pnpm version:
7.1.7
Code to reproduce the issue:
Sample monorepo:
Example:
--package.json
--node_modules/
--shared/
|--client/
|--package.json
|--node_modules/
|--server/
|--package.json
|--node_modules/
lets say there is a executable in root node_modules/.bin called app
node_modules/.bin/app
pnpm app works from root directory. If I go to shared/client and run pnpm app it doesn't work - I get error
ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL not found: app
Expected behavior:
monorepo root executables should work from anywhere when ignore-scripts=true is set.
Actual behavior:
monorepo root executables do NOT work except from root directory when ignore-scripts=true is set
Additional information:
node -v
v16.15.1
macOS