proposal: provide a standardised .npmignore file for use across plugin and util repos

[Fdawgs]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the issue has not already been raised

Issue

Summary

Reduce size of published packages by using .npmignore, or files in package.json.

Motivation

With the Greener NHS programme, National Health Service organisations and bodies across the UK are looking at ways to become carbon neutral, reduce energy consumption, combat climate change, and at the same time save money that can then be spent instead on improving patient care.
The recent heatwaves and wildfires across Europe have exemplified the need to prioritize this.

I've been looking at this from the tech perspective within my hospital, and have already called out a supplier for their unnecessarily heavy web app (loading various versions of jquery and lodash and then not using them). It would be hypocritical for me to not look at the tools and frameworks we use internally, such as Fastify.

Whilst previous discussions have looked at this issue through the lenses of improving developer experience, environmental impacts have not been considered.

Rationale and Alternatives

Ignoring unused files could speed up installations, lower bandwidth usage, improve reliability on spotty connections, and leave more room on the hard drive. Registries and mirrors would also benefit; reduced resources likely means lower energy consumption and lower costs.

Users could use yarn's autoclean CLI to remove the unused files, but the files have already been downloaded and bandwidth wasted at this point.

Implementation

Prior discussions have stated the want to include test files in published packages.
With this in mind, we could still ignore files and directories related to:

• CI/CD
• Examples
• Benchmarks

Example

@fastify/static

• packed size: 210.5kB
• packed size with .github and example/** removed: 162.9kB (~23% reduction)
• packed size with .github, example/**, and test/** removed: 11.8kB (~94% reduction)

@fastify/static is downloaded around 400,000 times a month at present (will grow as more migrate from fastify-static) meaning it uses ~84.2GB/month.
Removing just the CI/CD and examples would drop that to ~65.16GB/month; removing the test files as well would drop that to ~4.72GB/month.

Previous discussions

• Can fastify exclude .eslintrc in the publish package? fastify#4031
• Add docs, test and examples to .npmignore fastify#3467
• https://github.com/orgs/fastify/teams/plugins/discussions/5

[jsumners]

Thank you for the numbers. It is a little surprising the amount of data that is transferred and saved in your example. However, you are talking about a month long timeframe distributed across the whole globe. These numbers seem very reasonable.

The issue I have with (package.json).files and .npmignore is the increased maintenance burden. From the docs:

If there's no .npmignore file, but there is a .gitignore file, then npm will ignore the stuff matched by the .gitignore file. If you want to include something that is excluded by your .gitignore file, you can create an empty .npmignore file to override it.

This means that as soon as you add a .npmignore file you must start duplicating configuration between that file and the existing .gitignore file.

Even more frustrating is (package.json).files; from the docs:

File patterns follow a similar syntax to .gitignore, but reversed: including a file, directory, or glob pattern (, **/, and such) will make it so that file is included in the tarball when it's packed. Omitting the field will make it default to ["*"], which means it will include all files.

The result is that once the files field is added then a new entry must be added for every file added to the project. This is extremely easy to overlook and has resulted in more than a few botched releases.

[Fdawgs]

No worries @jsumners, thanks for the response! Completely understandable.

[jorrit]

The result is that once the files field is added then a new entry must be added for every file added to the project. This is extremely easy to overlook and has resulted in more than a few botched releases.

The files are can contain directories as well, and each file in the directory is added to the package. It seems fastify uses the lib directory for code in the NPM package, so adding lib is sufficient.