|
|
|
|
|
|
by andrewl-hn
2310 days ago
|
|
|
That's why npm has a command `npm install --ignore-scripts`. It download the dependencies, but doesn't run the postinstall scripts (that either download pre-build binaries or run a compiler locally). In early days of node (circa 2011-2013) we used to do the following:
1. run `npm install --ignore-scripts` first.
2. Check the node_modules folder to source control,
3. run `npm install` again - this time without the flag
4. put all extra files generated by install scripts to .gitignore This way the third-party code (at least, the JS-part of that code) was in the repository, and every developer / server got the version of binaries for their architecture. It wasn't a bullet-proof, though, since:
1. The scripts could do different things anyway
2. More importantly: one could upload a new version of library to npm with the same version number. These days, lockfiles and stricter npm publishing rules largely eliminated both issues, and updating dependencies doesn't produce 10k-line diffs in git history anymore. |
|
|