build: npm package for v1.1.14-v1.1.16 contains .git folder

[Noglen]

Bug, enhancement request, or proposal:

Bug

Detailed Reproduction Steps:

1. npm install angular-material@1.1.14
2. check the node_modules\angular-material directory

What is the expected behavior?

there is no .git folder

What is the current behavior?

there is a .git folder

What is the use-case or motivation for changing an existing behavior?

npm doesn't like having sub modules or repos in the node_modules folder, and complains with the following error

npm ERR! git {myproject}\node_modules\angular-material: Appears to be a git repo or submodule.
npm ERR! git {myproject}\node_modules\angular-material
npm ERR! git Refusing to remove it. Update manually,
npm ERR! git or move it out of the way first.

Which versions of AngularJS, Material, OS, and browsers are affected?

• AngularJS Material: 1.1.14

Is there anything else we should know? Stack Traces, Screenshots, etc.

[Splaktar]

I can confirm that I am seeing this as well and that this wasn't the case in 1.1.13. I also saw the same error message about refusing to remove it when trying to install 1.1.13 to test.

[Splaktar]

Related: https://stackoverflow.com/a/53533508/633107

[Splaktar]

We don't use .npmignore in https://github.com/angular/bower-material (where npm publish is run from), but this seems like a bug in some version of NPM that we have never published with before.

@mmalerba can you please let us know what version of NPM was used for npm publish yesterday?

[Splaktar]

node 8.15.0 and npm 6.9.0 were used for the 1.1.14 release. It's not sure what was used previously, but I'll check with someone else who recently published to see what they are using.

[Splaktar]

The last 4 releases were created by @mmalerba and @jelbourn. The 1.1.12 release by @mmalerba in January did not have a .git directory in the publish, but he said that he has re-imaged his machine since then. @jelbourn is currently out on vacation.

There is an abandoned npm bug where npm publish on Linux can include the .git directory since npm 5.6.0.

However, this npm blog post on npm publish clearly states that

npm will always ignore these file name patterns:

• .git, hg , .svn, CVS version control directories

The NPM blog post also suggests that we not use .npmignore together with .gitignore since using .npmignore means that your .gitignore is no longer consulted when doing npm publish.

This clearly looks like a bug in NPM. @mmalerba since you are the only one who can investigate this further or report it, can you please report this to NPM?

We'll also need to get another release out soon that doesn't include this .git directory as it breaks people's projects, especially when upgrading to the next version of AngularJS Material.

[Splaktar]

Before we do the release to fix this, we should use the --dry-run for npm publish to verify that the .git folder and contents are not in the list of published files.