RFC: Expand list of ignored files #114

ruyadorno · 2020-03-18T21:55:24Z

TLDR; Expand the default list of files that should not end up in published tarball.

ruyadorno · 2020-03-18T21:58:54Z

discussion started here: npm/npm-packlist#48 and the @npm/cli-team decided it would be nice to throw a proper RFC to discuss this a bit more with the community.

ljharb

The real solution imo isn’t to exclude more files, it’s to allow publishers to create two lists: “everything” and “production” - and publish both tarballs, so that by default the smallest tarball installs, but it’s easy to opt in to installing the more complete one.

accepted/0000-expand-list-of-packlist-ignored-files.md

wesleytodd · 2020-04-01T18:36:30Z

accepted/0000-expand-list-of-packlist-ignored-files.md

+- `.idea/` (or other editors similar configs/store/etc)
+- `.travis.yml`, `.github/` (and/or more ci services)
+- `.yo-rc.json` template/boilerplate related files
+


.env files would be another good addition.

ruyadorno · 2020-04-01T18:39:10Z

Action items from the OpenRFC call:

Restrict this RFC to only items that can be potentially harmful to the ecosystem (high potential of leaking secrets, etc)
Let's create a new warning list that would prompt publishers at publish time

ruyadorno · 2020-07-15T15:40:54Z

It would be awesome if folks can contribute to this by suggesting files that they notice have high potential to be harmful if published by mistake to the registry 😊

ljharb

LGTM pending the one comment

accepted/0000-expand-list-of-packlist-ignored-files.md

ljharb · 2020-07-15T17:37:56Z

What about also ignoring *.sublime-project, bower.json, component.json?

ruyadorno · 2020-07-15T18:59:54Z

from @bnb in OpenRFC call:

We could borrow items from: https://github.com/github/gitignore/blob/master/Node.gitignore

rwjblue · 2020-07-15T21:14:06Z

accepted/0000-expand-list-of-packlist-ignored-files.md

+- `.editorconfig` common plugins
+- `.gitattributes` and/or more git things
+- `.idea/` (or other editors similar configs/store/etc)
+- `.travis.yml`, `.github/` (and/or more ci services)


FWIW, removing .travis.yml / .github/workflow/*.yml files would be a breaking change for some packages that use the CI configuration in order to provide users with useful messaging about supported platforms (where the supported platforms are defined as platforms that are under test).

An example would be this code in ember-cli, which is used to emit warnings like:

Node ${process.version} is no longer supported by Ember CLI. We recommend that you use the most-recent "Active LTS" version of Node.js. See https://git.io/v7S5n for details.

Or:

Node ${process.version} is not tested against Ember CLI on your platform. We recommend that you use the most-recent "Active LTS" version of Node.js. See https://git.io/v7S5n for details.

wow, TIL people do this.

altho in this case, https://github.com/ember-cli/ember-cli/blob/v3.18.0/.npmignore#L18 would ensure ember-cli is not broken by this change.

wow, TIL people do this.

Ya, our goal was to ensure we could use a single source of truth for this guidance. We could remove it I suppose, but it has come in helpful for things like new Node releases that are untested with their release.

altho in this case, ember-cli/ember-cli@v3.18.0/.npmignore#L18 would ensure ember-cli is not broken by this change.

Ya, good point. As long as the .npmignore "wins" (including negation) this won't be an issue. Thank you for looking at that!

vweevers · 2021-05-25T09:20:37Z

accepted/0000-expand-list-of-packlist-ignored-files.md

+
+## Implementation
+
+Add some more entries to the already existing [list of ignored files in packlist](https://github.com/npm/npm-packlist/blob/master/index.js#L38) and make sure we have tests asserting it behaves the way we intend.


Suggested change

Add some more entries to the already existing [list of ignored files in packlist](https://github.com/npm/npm-packlist/blob/master/index.js#L38) and make sure we have tests asserting it behaves the way we intend.

Add some more entries to the already existing [list of ignored files in packlist](https://github.com/npm/npm-packlist/blob/main/index.js#L38) and make sure we have tests asserting it behaves the way we intend.

vweevers · 2021-05-25T09:23:37Z

accepted/0000-expand-list-of-packlist-ignored-files.md

+
+## Detailed Explanation
+
+Expand the current list of ignored files to also ignore by default:


Do the items listed here mean e.g. /.editorconfig or **/.editorconfig? The latter could cause breakage in generators / initializers that have template files in subdirectories, for example https://github.com/pkgjs/create/tree/main/templates

webstech · 2023-01-14T06:54:50Z

Is there any incentive to move forward with this? I was shocked to find how many dependabot and workflow files I had in various repos today. Yarn already excludes .github during pack/publish so there is precedent. Internally there seems to be an established list of well known files to blacklist. I found 100+ flavours of dot filenames in local node_modules directories. It may be more code but a warning to suggest using .npmignore or package.files could help with migration. I understand any warnings may not be seen in automation runs - just trying to get some of this to happen.

ljharb · 2023-07-14T17:19:26Z

Please do not include .editorconfig in this list; I run a tool in my packages that lints against it, and i rely on that file being present.

ruyadorno added Agenda will be discussed at the Open RFC call Release 7.x labels Mar 18, 2020

RFC: Expand list of ignored files

14189d3

ruyadorno force-pushed the expand-list-of-ignored-files-on-publish branch from 5ee1fe0 to 14189d3 Compare March 18, 2020 22:00

ljharb suggested changes Mar 18, 2020

View reviewed changes

accepted/0000-expand-list-of-packlist-ignored-files.md Show resolved Hide resolved

darcyclarke mentioned this pull request Mar 31, 2020

Open RFC Meeting - Wednesday, April 1, 2020, 2:00 PM EST #122

Closed

wesleytodd reviewed Apr 1, 2020

View reviewed changes

darcyclarke mentioned this pull request Apr 14, 2020

Open RFC Meeting - Wednesday, April 15, 2020, 2:00 PM EST #130

Closed

darcyclarke mentioned this pull request Apr 29, 2020

Open RFC Meeting - Wednesday, April 29, 2020, 2:00 PM EST #134

Closed

darcyclarke removed the Agenda will be discussed at the Open RFC call label Apr 29, 2020

darcyclarke assigned ruyadorno Apr 29, 2020

ruyadorno added the Agenda will be discussed at the Open RFC call label Jul 15, 2020

darcyclarke mentioned this pull request Jul 15, 2020

Open RFC Meeting - Wednesday, July 15, 2020, 2:00 PM EST #178

Closed

ljharb suggested changes Jul 15, 2020

View reviewed changes

accepted/0000-expand-list-of-packlist-ignored-files.md Show resolved Hide resolved

rwjblue reviewed Jul 15, 2020

View reviewed changes

darcyclarke mentioned this pull request Jul 17, 2020

Open RFC Meeting - Wednesday, July 22, 2020, 2:00 PM EST #180

Closed

darcyclarke removed the Agenda will be discussed at the Open RFC call label Jul 22, 2020

ruyadorno added semver:major backwards-incompatible breaking changes and removed Release 7.x labels Oct 21, 2020

darcyclarke added the Proposal label Mar 10, 2021

vweevers reviewed May 25, 2021

View reviewed changes

settings bot removed the Proposal label Sep 21, 2021

ruyadorno removed their assignment Jun 6, 2023

lukekarrys mentioned this pull request Jul 14, 2023

Plans for npm 10 nodejs/Release#884

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RFC: Expand list of ignored files #114

RFC: Expand list of ignored files #114

ruyadorno commented Mar 18, 2020 •

edited

Loading

ruyadorno commented Mar 18, 2020

ljharb left a comment

wesleytodd Apr 1, 2020

ruyadorno commented Apr 1, 2020

ruyadorno commented Jul 15, 2020 •

edited

Loading

ljharb left a comment

ljharb commented Jul 15, 2020

ruyadorno commented Jul 15, 2020

rwjblue Jul 15, 2020 •

edited

Loading

ljharb Jul 15, 2020

rwjblue Jul 15, 2020

vweevers May 25, 2021

vweevers May 25, 2021

webstech commented Jan 14, 2023

ljharb commented Jul 14, 2023


		## Implementation

		Add some more entries to the already existing [list of ignored files in packlist](https://github.com/npm/npm-packlist/blob/master/index.js#L38) and make sure we have tests asserting it behaves the way we intend.


		## Detailed Explanation

		Expand the current list of ignored files to also ignore by default:

RFC: Expand list of ignored files #114

Are you sure you want to change the base?

RFC: Expand list of ignored files #114

Conversation

ruyadorno commented Mar 18, 2020 • edited Loading

ruyadorno commented Mar 18, 2020

ljharb left a comment

Choose a reason for hiding this comment

wesleytodd Apr 1, 2020

Choose a reason for hiding this comment

ruyadorno commented Apr 1, 2020

ruyadorno commented Jul 15, 2020 • edited Loading

ljharb left a comment

Choose a reason for hiding this comment

ljharb commented Jul 15, 2020

ruyadorno commented Jul 15, 2020

rwjblue Jul 15, 2020 • edited Loading

Choose a reason for hiding this comment

ljharb Jul 15, 2020

Choose a reason for hiding this comment

rwjblue Jul 15, 2020

Choose a reason for hiding this comment

vweevers May 25, 2021

Choose a reason for hiding this comment

vweevers May 25, 2021

Choose a reason for hiding this comment

webstech commented Jan 14, 2023

ljharb commented Jul 14, 2023

ruyadorno commented Mar 18, 2020 •

edited

Loading

ruyadorno commented Jul 15, 2020 •

edited

Loading

rwjblue Jul 15, 2020 •

edited

Loading