Comments (3)
I also observed this (in action prepare for me, but whatever), in a Docker in a CI pipeline. Like @amadsen I’m not sure what ckeck the conditions around wd
, opts.dir
, and pkg.name
: I observe they are always true, but possibly it is for a specific use case we don’t use.
Note that it is very common in Docker and specifically in CI to execute as root. I think it is a bad practice, but it is very common, even in the official Docker image for node (see this issue).
About npm-lifecycle, I wonder if there is not a logic bug around unsafe-perm+user+group:
- if unsafe-perm is false (as a root user with default unsafe-perm = false), there is no chance we execute the program because of the condition mentionned above lines 86-90,
- if unsafe-perm is true (as a non-root user or a root user with explicit unsafe-perm=true), we continue through the functions
lifecycle_
thenrunPackageLifecycle
/runHookLifecycle
thenrunCmd
and here we use the config valuesuser
andgroup
only if unsafe-perm is false, but it is true in this branch, hence we always run the program as root anduser
/group
are never used (at least in this branch path, perhaps it is used elsewhere).
from npm-lifecycle.
PS: if like me the action is in a child npm
process (like in a dependency defined by a Git repo), the --unsafe-perm
in the main npm
was not enough (=not transmitted to the child npm
), so it can be used an environment variable npm_config_unsafe_perm="true"
.
from npm-lifecycle.
@amadsen Thank you so much for digging into this! I’m adding this weird workaround to my package.json:
+ "__comment": "'name' must match the WORKDIR in Dockerfile used when executing `RUN npm ci`.",
+ "name": "app",
Also, if I understand _incorrectWorkingDirectory
correctly it just does a convoluted “ends with” check. I guess the intention is to check that for example my-package
matches /some/path/my-package
but /some/path/foobar-my-package
will match as well?
from npm-lifecycle.
Related Issues (20)
- Warning: Possible EventEmitter memory leak detected. 11 SIGINT listeners added. HOT 2
- Run-script commands don't load environment vars with WSL
- node_modules/.bin directory not being added to PATH on Windows
- MaxListenersExceededWarning when use postinstall HOT 1
- Documentation on API usage HOT 1
- fatal: 'submodule' appears to be a git command, but we were not able to execute it. Maybe git-submodule is broken? HOT 2
- npm hooks scripts breaks on windows HOT 1
- Error: Version doesn´t exist in botfile.js HOT 1
- Error:npm-lifecycle\index.js:301:16
- Tar package vulnerability on install HOT 4
- Enhancement: Use win32 platform specific casing for env.path if present HOT 2
- Security issue from node-gyp
- Node App crashes HOT 3
- node-gyp Visual Studio 2019 compatibility
- env.npm_execpath and $execPath
- [BUG] npm falsely reports hard-coded ENOENT as postinstall error when root
- [QUESTION] Why SIGTERM is passed only one time?
- [BUG] stack Exit status 3221226505 running scripts in Node windows-x86
- Error at EventEmitter ... index.js:280 HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from npm-lifecycle.