Is there a CLI command for PNPM I --allow-all-builds ?

[cghiurea]

Is there a CLI command for PNPM I --allow-all-builds or generate a list of apps that need builds?
For example this is the only I saw what packages need scripts ran: Ignored build scripts: @nestjs/core, @prisma/client, @prisma/engines, @scarf/scarf, @swc/core, bcrypt, prisma. Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts

How can I do this programmatically for docker builds?

[smokingmonkeyAI]

Would be great if we could apply a --filter to the approve-builds to specify the package we want to run the script for in a Dockerfile.

[jeremyd]

+1 I just got hit by this approve-builds thing, how is anyone automating this?

[zkochan]

No, it doesn't make sense to add a flag that would allow all the packages as the whole point is to allow specific verified packages.

There is a flag that allow listing which package can run scripts: https://pnpm.io/cli/add#--allow-build

[rschristian]

No, it doesn't make sense to add a flag that would allow all the packages as the whole point is to allow specific verified packages.

That may be a selling point for some folks but not everyone is interested in this. If it isn't going to be opt-in, please at least allow users to opt-out when they know better.

Going project-by-project allow listing everything inside is not a good use of anyone's time and all it does is add to the security theater without actually improving anything.

[estiller]

please at least allow users to opt-out when they know better.

IMHO, this is the key. There are definitely specific scenarios where the users know better and would like to opt out. In one of my main projects, I'm currently blocked from upgrading to PNPM v10 due to this specific feature.

[thenitai]

This is preventing anyone who has automated (dockerfile, etc.) from upgrading to v10 :(

[estiller]

@thenitai, there is already a flag - https://pnpm.io/next/settings#dangerouslyallowallbuilds
You could also run pnpm install --dangerously-allow-all-builds

[cghiurea]

So it @zkochan it didn’t make sense, but you guys still put it in? What happened ? I ended up agreeing with you that it’s safer to build locally then update your package.json

[douglasg14b]

Still completely skuffed in docker files. Have to downgrade to pnpm 9.

[PetrShchukin]

Are there any fixes for this? Putting the config into pnpm-workspace.yaml seems like a strange decision. Now it messes things up with Snyk, as it thinks there are workspaces in place. Please fix this feature - the only current solution is to downgrade pnpm!

[estiller]

https://github.com/orgs/pnpm/discussions/9109#discussioncomment-13634454

[zkochan]

All the pnpm related settings are in pnpm-workspace.yaml. If snyk doesn't work with that, it should be fixed.

[tarcisiomiranda]

Found a simple and clean way to handle PNPM build approvals in pipelines or package.json scripts:

for p in svelte-preprocess esbuild; do pnpm add $p --allow-build=$p; done && pnpm install