Skip to content

Restrict running NPM scripts with monorepo tools #5255

@kirill-konshin

Description

@kirill-konshin
  • I'd be willing to implement this feature (contributing guide)
  • This feature is important to have in this repository; a contrib plugin wouldn't do

Describe the user story

With the rise of monorepo tools like NX, Lerna and Turborepo it makes sense to guarantee that tasks only run through these tools.

For example, 2 packages A and B, B depends on A, and build script of B assumes that build script in A has finished. This is easily achieved via any of those managers. But the problem is, users may accidentally run build script in package B manually: cd packages/packageA && yarn build, and obviously, Yarn won't know that some monorepo manager has certain topology of tasks, which might lead to errors.

Describe the solution you'd like

Yarn might get a new functionality to prevent running scripts directly if they are not in root workspace, only through a manager, presence of which Yarn can detect. For example, by checking presence of Turbo ENV vars like TURBO_HASH or TURBO_INVOCATION_DIR.

Alternatively, this can be achieved by adding some kind of global hook which Yarn runs before running any script. This kind of check is necessary in leaf workspaces, not in the root workspace.

In order to have even more fine control, the hook can only be applied to a list of explicitly defined scripts, configured in .yarnrc.yml.

Describe the drawbacks of your solution

Poorly written check can disrupt the workflow, but since it's an opt-in, users should assume responsibility.

Global hook for all scripts can be an overkill, but for the exact list of scripts it should be OK.

Describe alternatives you've considered

Each leaf worspace can have a gate script like this:

{
  "scripts": {
    "gate": "if [ -z "${TURBO_HASH}" ]; then echo "No turbo" && exit 1 fi",
    "build": "yarn gate && ...",
}

But this will have to be repeated in each workspace, which is fine, but it's a lot of boilerplate code, and better be managed centrally somehow.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions