Yarn interprets "files" in package.json differently to npm, publishes more files than desired

[benjie]

Do you want to request a feature or report a bug?

Bug

What is the current behavior?

Yarn does not treat the "files" array in package.json as anchored to the root, npm does.

Yarn also adds a superfluous package entry, npm does not.

If the current behavior is a bug, please provide the steps to reproduce.

Run yarn pack for https://github.com/graphile/graphile-build/tree/master/packages/postgraphile-core (repo is managed using yarn workspaces) which has the following files array in package.json:

  "files": [
    "node8plus",
    "index.js"
  ],

Result:

$ yarn pack
yarn pack v1.6.0
success Wrote tarball to "/Dev/graphile-build/packages/postgraphile-core/postgraphile-core-v4.0.0-beta.4.tgz".
✨  Done in 0.13s.
$ tar tf postgraphile-core-v4.0.0-beta.4.tgz
package
package/LICENSE.md
package/README.md
package/node8plus
package/package.json
package/src
package/node8plus/index.js
package/node8plus/index.js.flow
package/node8plus/index.js.map
package/src/index.js

What is the expected behavior?

$ npm pack

> postgraphile-core@4.0.0-beta.4 prepack /Dev/graphile-build/packages/postgraphile-core
> mkdir -p node8plus && babel -s true --out-dir node8plus src && flow-copy-source src node8plus

src/index.js -> node8plus/index.js
postgraphile-core-4.0.0-beta.4.tgz
$ tar tf postgraphile-core-4.0.0-beta.4.tgz
package/package.json
package/LICENSE.md
package/README.md
package/node8plus/index.js
package/node8plus/index.js.flow
package/node8plus/index.js.map

Note that no files from the src folder are present above.

Also note the package and package/node8plus bare entries are not present above. I believe this is why there is a package entry shown on unpkg.com under yarn vs unpkg.com under npm.

Please mention your node.js, yarn and operating system version.

$ yarn --version
1.6.0
$ node --version
v9.10.1
$ npm --version
5.6.0
$ sw_vers
ProductName:    Mac OS X
ProductVersion: 10.13.4
BuildVersion:   17E199

[misoguy]

Can I try this if no one is on it yet?