[BUG] --ignore-scripts is not respected by npm publish

[juanrgm]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

npm ERR! code 1
npm ERR! path /pkg
npm ERR! command failed
npm ERR! command sh -c echo Failed && exit 1
npm ERR! Failed

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-09-01T18_00_57_472Z-debug.log

Expected Behavior

npm notice 
npm notice package: test@0.0.1
npm notice === Tarball Contents ===
npm notice 115B package.json
npm notice === Tarball Details ===
npm notice name:          test
npm notice version:       0.0.1
npm notice filename:      test-0.0.1.tgz
npm notice package size:  180 B
npm notice unpacked size: 115 B
npm notice shasum:        709f297e88cc2041bf93d30742bc4fbdcb63690f
npm notice integrity:     sha512-/eb5abNq1YYmO[...]hDW8R2gOKj1TA==
npm notice total files:   1
npm notice
npm ERR! code ENEEDAUTH
npm ERR! need auth This command requires you to be logged in.
npm ERR! need auth You need to authorize this machine using `npm adduser`

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-09-01T18_02_05_247Z-debug.log

Steps To Reproduce

{
    "name": "test",
    "version": "0.0.1",
    "scripts": {
        "prepare": "echo Failed && exit 1"
    }
}

npm publish --ignore-scripts

Environment

• OS: Windows 10 / Alpine 3.13
• Node: 16.8.0
• npm: 7.21.0

[kombuchamp]

Checked on npm version 8.3.1 (node v16.14.0) - npm publish --ignore-scripts still gets "prepare" script triggered. Is this intended behaviour?
I see another issue where this problem was fixed
#2755
in this pr:
https://github.com/npm/cli/pull/3495/files

And this code is still in publish.js, which means that it it is probably a bug
https://github.com/npm/cli/blob/latest/lib/commands/publish.js#L120
Tests on publish.js related to this behaviour are still passing, which might mean that there could be an issue with setting config parameter "ignore-scripts" through cli

[dominykas]

It seems the issue is still there - regardless of how ignore-scripts is set (env, config, etc), the prepare script gets executed during npm publish and npm pack.

I'll see if I can get a minimal test case going...

[dominykas]

Oh, seems it was only meant to be fixed in v9: #5651

[dominykas]

OK, yeah, it seems to be still happening via pacote: https://github.com/npm/pacote/blob/272edc1bac06991fc5f95d06342334bbacfbaa4b/lib/dir.js#L33

[lukekarrys]

Closing this since it will be tracked as a breaking change in our v11 roadmap instead of as a bugfix. npm/statusboard#488