Correct workflow for "strictDepBuilds" and "ignoredBuiltDependencies"

[AnderssonPeter]

First off I hope my understanding is correct that ignoredBuiltDependencies stops a package from running it's post install script and stops pnpm from complaning about it when running a pnpm install?

When I run pnpm install, it correctly warns me that some packages tried to run a post install script, great!
So I add them to it to pnpm-workspace.yaml -> ignoredBuiltDependencies and run pnpm install again, but it still warns me about the package when I run the next pnpm install?
So what am I supposed to run after pnpm has informed me about a post install script? (I want the list of "ignored" packages to be stored in git so that each person doesn't have to have it's own list of ignored packages...)
The only thing I have found is to remove my node_modules and run a clean pnpm install but that seems a bit absurd to each time I add a new package that has a post install script i want to ignore.
pnpm config get ignored-built-dependencies --json reflects my pnpm-workspace.yaml -> ignoredBuiltDependencies changes so pnpm seems to know about them?

[zkochan]

Use the new allowBuilds setting instead. Usage example:

allowBuilds:
  esbuild: true
  core-js: false
  nx@21.6.4 || 21.6.5: true

[AnderssonPeter]

@zkochan allowBuilds works if I set it to true, but if I set it to false it behaves the exact same way as ignoredBuiltDependencies.
This seems a bit unintuitive and might result in someone setting it to true just to get rid of the message and thereby risking getting exploited by a supply chain attack?

[shirakaba]

allowBuilds.esbuild: false in pnpm-workspace.yaml seems to be working for me on pnpm v11.0.8. No ERR_PNPM_IGNORED_BUILDS.

[AnderssonPeter]

allowBuilds.esbuild: false in pnpm-workspace.yaml seems to be working for me on pnpm v11.0.8. No ERR_PNPM_IGNORED_BUILDS.

If you first run a pnpm install without allowBuilds, the you should get an error? Then you add allowBuilds and run pnpm install again? Does the error go away on the second pnpm install?