workspace @npmcli/config and disable audit on global

.github/workflows/ci-npmcli-config.yml

@@ -0,0 +1,94 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI - @npmcli/config
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - workspaces/config/**
+  push:
+    branches:
+      - main
+      - latest
+    paths:
+      - workspaces/config/**
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    name: Lint
+    if: github.repository_owner == 'npm'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18.x
+          cache: npm
+      - name: Reset Deps
+        run: node . run resetdeps
+      - name: Lint
+        run: node . run lint --ignore-scripts -w @npmcli/config
+      - name: Post Lint
+        run: node . run postlint --ignore-scripts -w @npmcli/config
+
+  test:
+    name: Test - ${{ matrix.platform.name }} - ${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+          - name: macOS
+            os: macos-latest
+            shell: bash
+          - name: Windows
+            os: windows-latest
+            shell: cmd
+        node-version:
+          - 14.17.0
+          - 14.x
+          - 16.13.0
+          - 16.x
+          - 18.0.0
+          - 18.x
+    runs-on: ${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: ${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - name: Reset Deps
+        run: node . run resetdeps
+      - name: Add Problem Matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - name: Test
+        run: node . test --ignore-scripts -w @npmcli/config
+      - name: Check Git Status
+        if: matrix && matrix.platform.os != 'windows-latest'
+        run: node scripts/git-dirty.js

.gitignore

@@ -43,6 +43,7 @@
 !/workspaces/
 /workspaces/*
 !/workspaces/arborist/
+!/workspaces/config/
 !/workspaces/libnpmaccess/
 !/workspaces/libnpmdiff/
 !/workspaces/libnpmexec/

.release-please-manifest.json

@@ -11,5 +11,6 @@
   "workspaces/libnpmpublish": "7.0.1",
   "workspaces/libnpmsearch": "6.0.0",
   "workspaces/libnpmteam": "5.0.0",
-  "workspaces/libnpmversion": "4.0.0"
+  "workspaces/libnpmversion": "4.0.0",
+  "workspaces/config": "6.0.1"
 }

DEPENDENCIES.md

@@ -188,7 +188,9 @@ graph LR;
   npmcli-arborist-->treeverse;
   npmcli-config-->ini;
   npmcli-config-->nopt;
+  npmcli-config-->npmcli-eslint-config["@npmcli/eslint-config"];
   npmcli-config-->npmcli-map-workspaces["@npmcli/map-workspaces"];
+  npmcli-config-->npmcli-template-oss["@npmcli/template-oss"];
   npmcli-config-->proc-log;
   npmcli-config-->read-package-json-fast;
   npmcli-config-->semver;
@@ -613,10 +615,13 @@ graph LR;
   npmcli-arborist-->walk-up-path;
   npmcli-config-->ini;
   npmcli-config-->nopt;
+  npmcli-config-->npmcli-eslint-config["@npmcli/eslint-config"];
   npmcli-config-->npmcli-map-workspaces["@npmcli/map-workspaces"];
+  npmcli-config-->npmcli-template-oss["@npmcli/template-oss"];
   npmcli-config-->proc-log;
   npmcli-config-->read-package-json-fast;
   npmcli-config-->semver;
+  npmcli-config-->tap;
   npmcli-config-->walk-up-path;
   npmcli-disparity-colors-->ansi-styles;
   npmcli-docs-->cmark-gfm;
@@ -763,4 +768,4 @@ packages higher up the chain.
  - @npmcli/git, make-fetch-happen, @npmcli/config, init-package-json
  - @npmcli/installed-package-contents, @npmcli/map-workspaces, cacache, npm-pick-manifest, @npmcli/run-script, read-package-json, readdir-scoped-modules, promzard
  - @npmcli/docs, npm-bundled, read-package-json-fast, @npmcli/fs, unique-filename, npm-install-checks, npm-package-arg, npm-packlist, normalize-package-data, @npmcli/package-json, bin-links, nopt, npmlog, parse-conflict-json, dezalgo, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, semver, @npmcli/move-file, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, wrappy, treeverse, minify-registry-metadata, @npmcli/disparity-colors, @npmcli/ci-detect, mute-stream, ini, npm-audit-report, npm-user-validate
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, semver, @npmcli/move-file, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, wrappy, treeverse, minify-registry-metadata, ini, @npmcli/disparity-colors, @npmcli/ci-detect, mute-stream, npm-audit-report, npm-user-validate

lib/arborist-cmd.js

@@ -1,3 +1,5 @@
+const log = require('./utils/log-shim.js')
+
 // This is the base for all commands whose execWorkspaces just gets
 // a list of workspace names and passes it on to new Arborist() to
 // be able to run a filtered Arborist.reify() at some point.
@@ -17,6 +19,18 @@ class ArboristCmd extends BaseCommand {
 
   static ignoreImplicitWorkspace = false
 
+  constructor (npm) {
+    super(npm)
+    if (this.npm.config.isDefault('audit')
+      && (this.npm.global || this.npm.config.get('location') !== 'project')
+    ) {
+      this.npm.config.set('audit', false)
+    } else if (this.npm.global && this.npm.config.get('audit')) {
+      log.warn('config',
+        'includes both --global and --audit, which is currently unsupported.')
+    }
+  }
+
   async execWorkspaces (args, filters) {
     await this.setWorkspaces(filters)
     return this.exec(args)

lib/npm.js

@@ -88,6 +88,21 @@ class Npm extends EventEmitter {
   // would be needed to change this
   async cmd (cmd) {
     await this.load()
+
+    // when location isn't set and global isn't true
+    // check for a package.json at the localPrefix
+    // and set the location to project if found
+    // TODO: this logic can move to the config module loadLocalPrefix to
+    // avoid double stat calls and consolidate logic
+    if (this.config.isDefault('location') && !this.config.get('global')) {
+      const hasPackageJson = await fs.stat(resolve(this.config.localPrefix, 'package.json'))
+        .then((st) => st.isFile())
+        .catch(() => false)
+      if (hasPackageJson) {
+        this.config.set('location', 'project')
+      }
+    }
+
     const command = this.deref(cmd)
     if (!command) {
       throw Object.assign(new Error(`Unknown command ${cmd}`), {

node_modules/@npmcli/config

@@ -0,0 +1 @@
+../../workspaces/config

package-lock.json

@@ -2052,22 +2052,8 @@
       }
     },
     "node_modules/@npmcli/config": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@npmcli/config/-/config-6.0.1.tgz",
-      "integrity": "sha512-f8PGjhM7kKbMfEMmE8n1dW+m/7XFuvatLXqItO89ZKJwYl9Zs5d7CmsIe8n8i+4YmGYL3HqR26/mVb4oK2b6Zw==",
-      "inBundle": true,
-      "dependencies": {
-        "@npmcli/map-workspaces": "^3.0.0",
-        "ini": "^3.0.0",
-        "nopt": "^6.0.0",
-        "proc-log": "^3.0.0",
-        "read-package-json-fast": "^3.0.0",
-        "semver": "^7.3.5",
-        "walk-up-path": "^1.0.0"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
+      "resolved": "workspaces/config",
+      "link": true
     },
     "node_modules/@npmcli/disparity-colors": {
       "version": "3.0.0",
@@ -13488,7 +13474,6 @@
     },
     "node_modules/walk-up-path": {
       "version": "1.0.0",
-      "inBundle": true,
       "license": "ISC"
     },
     "node_modules/wcwidth": {
@@ -13925,6 +13910,28 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
+    "workspaces/config": {
+      "name": "@npmcli/config",
+      "version": "6.0.1",
+      "license": "ISC",
+      "dependencies": {
+        "@npmcli/map-workspaces": "^3.0.0",
+        "ini": "^3.0.0",
+        "nopt": "^6.0.0",
+        "proc-log": "^3.0.0",
+        "read-package-json-fast": "^3.0.0",
+        "semver": "^7.3.5",
+        "walk-up-path": "^1.0.0"
+      },
+      "devDependencies": {
+        "@npmcli/eslint-config": "^4.0.0",
+        "@npmcli/template-oss": "4.8.0",
+        "tap": "^16.0.1"
+      },
+      "engines": {
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+      }
+    },
     "workspaces/libnpmaccess": {
       "version": "7.0.0",
       "license": "ISC",

release-please-config.json

@@ -69,7 +69,8 @@
     },
     "workspaces/libnpmversion": {
       "prerelease": false
-    }
+    },
+    "workspaces/config": {}
   },
   "exclude-packages-from-root": true,
   "group-pull-request-title-pattern": "chore: release ${version}",

tap-snapshots/test/lib/commands/config.js.test.cjs

@@ -354,6 +354,7 @@ exports[`test/lib/commands/config.js TAP config list with publishConfig > output
 ; "cli" config from command line options
 
 cache = "{NPMDIR}/test/lib/commands/tap-testdir-config-config-list-with-publishConfig-sandbox/cache" 
+location = "project" 
 prefix = "{LOCALPREFIX}" 
 userconfig = "{HOME}/.npmrc" 
 

test/index.js

@@ -11,7 +11,17 @@ t.test('loading as main module will load the cli', t => {
   const cwd = t.testdir()
   const { spawn } = require('child_process')
   const LS = require('../lib/commands/ls.js')
-  const ls = new LS({ config: { validate: () => {} } })
+  const ls = new LS({
+    config: {
+      validate: () => {},
+      get: (key) => {
+        if (key === 'location') {
+          return 'project'
+        }
+      },
+      isDefault: () => {},
+    },
+  })
   const p = spawn(process.execPath, [index, 'ls', '-h', '--cache', cwd])
   const out = []
   p.stdout.on('data', c => out.push(c))

test/lib/arborist-cmd.js

@@ -2,6 +2,16 @@ const { resolve } = require('path')
 const t = require('tap')
 const ArboristCmd = require('../../lib/arborist-cmd.js')
 
+const configMock = {
+  validate: () => {},
+  get: (key) => {
+    if (key === 'location') {
+      return 'project'
+    }
+  },
+  isDefault: () => {},
+}
+
 t.test('arborist-cmd', async t => {
   const path = t.testdir({
     'package.json': JSON.stringify({
@@ -44,7 +54,7 @@ t.test('arborist-cmd', async t => {
 
   class TestCmd extends ArboristCmd {}
 
-  const cmd = new TestCmd({ localPrefix: path, config: { validate: () => {} } })
+  const cmd = new TestCmd({ localPrefix: path, config: configMock })
 
   // check filtering for a single workspace name
   cmd.exec = async function (args) {
@@ -96,7 +106,7 @@ t.test('handle getWorkspaces raising an error', async t => {
     },
   })
   class TestCmd extends ArboristCmd {}
-  const cmd = new TestCmd({ localPrefix: t.testdir(), config: { validate: () => {} } })
+  const cmd = new TestCmd({ localPrefix: t.testdir(), config: configMock })
 
   await t.rejects(
     cmd.execWorkspaces(['foo'], ['a']),

test/lib/commands/explain.js

@@ -8,6 +8,12 @@ const npm = {
   },
   config: {
     validate: () => {},
+    get: (key) => {
+      if (key === 'location') {
+        return 'project'
+      }
+    },
+    isDefault: () => {},
   },
 }
 const { resolve } = require('path')

test/lib/commands/install-ci-test.js

@@ -25,6 +25,12 @@ const installCITest = new InstallCITest({
   },
   config: {
     validate: () => {},
+    get: (key) => {
+      if (key === 'location') {
+        return 'project'
+      }
+    },
+    isDefault: () => {},
   },
 })
 

test/lib/commands/install-test.js

@@ -25,6 +25,12 @@ const installTest = new InstallTest({
   },
   config: {
     validate: () => {},
+    get: (key) => {
+      if (key === 'location') {
+        return 'project'
+      }
+    },
+    isDefault: () => {},
   },
 })