Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add prepublish script #71

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add prepublish script #71

wants to merge 2 commits into from

Conversation

ljharb
Copy link

@ljharb ljharb commented Oct 23, 2018

This ensures that the build process isn't forgotten.

Additionally, it ensures that backports won't be mistakenly published as "latest", it cleans up the build output before recreating it, and it removes lockfiles, since this is a published package.

 - clean up `lib` before rebuilding it
 - ensure the build process runs prepublish
 - ensure that backports aren't unintentionally published as "latest"
# Only apps should have lockfiles
npm-shrinkwrap.json
package-lock.json
yarn.lock
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It can be useful for a library to have a lockfile checked in (and not published) so that build and test dependencies are locked to known-good versions.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don’t agree; that allows the package to pass tests while consumers fail them. Dev-only lockfiles are only appropriate for apps, not for packages.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mainly mention because I feel like I've had build and test specific dev-dependencies (such as babel-plugin-add-module-exports today :P ) break much more often than regular dependencies. It's a very painful experience to clone an old repository to make a quick tweak and find it can't even build. I find it important to guarantee that a project is in a buildable (and hopefully even fully-reproducible) state as it was in the last commit. Finding out about breakages in non-dev-dependencies is important, but omitting a lockfile so the next repo-cloner runs into it isn't the specific way I like to go about it for my own projects. (Personally, I like using greenkeeper for that sort of thing.)

I'm happy with whichever way this project goes, just wanted to dump some of my experiences and reasoning here! The main meat of this PR seems really needed and I definitely wouldn't want to delay that.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed you should use something like greenkeeper to keep up with that, rather than letting a project bitrot until you try to maintain it later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants