[BUG] Neither --ignore-scripts nor --ignore-prepublish are respected by npm publish

[jeffrson]

Current Behavior:

When a package.json contains a "prepublishOnly" script, this is executed regardless of calling npm via
npm --ignore-scripts or npm --ignore-prepublish

Expected Behavior:

I'm not sure, if "--ignore-prepublish" refers to "prepublish" only (:-)) or to "prepublishOnly" as well...

Anyway, IMO --ignore-scripts should prevent "prepublishOnly" from being run.

Steps To Reproduce:

Well, have package.json with

scripts: {
...
"prepublishOnly": "echo prepublishOnly",
...
}

and run npm publish --ignore-scripts --dry-run

Environment:

• npm: 7.5.5

Maybe related to #2434?

npm6 did it right, btw.

Edit: also git tag is commit'ed - which might not be a good idea for "--ignore-scripts".

[everhardt]

I think the bug is broader than just prepublishOnly: if I run npm publish --ignore-scripts it also runs the postpublish script. I have npm 7.5.3.

[Fdawgs]

Also encountering this same issue using npm v7.10 with node.js v16.0.0

[darkobits]

#2434 reported this behavior for npm ci.

Per this issue, it's also happening with publish. Additionally, I'm also seeing it with link (version 7.12.1).

[jthomas]

I'm also seeing it with this command:

npm install --production --no-optional --ignore-scripts on npm v7.10 with node.js v16.0.0

[wraithgar]

--ignore-prepublish is not a valid flag in npm@7

--ignore-scripts bug is fixed in this PR #3495

[darkobits]

Perhaps slightly off-topic for this issue, but are there plans to make this flag work for all commands for which it was supported in NPM 6?

[wraithgar]

If folks are seeing this with OTHER commands, open another issue.

Please be sure that it is not this other bug we are already tracking where git dependencies' prepare scripts are always being ran. #3300

[wraithgar]

fixed in v7.20.0

[Fdawgs]

Thanks @wraithgar!