Workspace packages are not trusted by default

[vktrl]

What version of Bun is running?

1.1.20+ae1948925

What platform is your computer?

Darwin 23.5.0 arm64 arm

What steps can reproduce the bug?

Basic monorepo:

app
├── /libs
│   └── /foo
│       └── package.json
└── package.json

./package.json

{
  "name": "app",
  "workspaces": ["./libs/*"],
  "scripts": {
    "postinstall": "echo Workspace postinstall runs fine"
  }
}

./libs/foo/package.json

{
  "name": "foo",
  "scripts": {
    "postinstall": "echo I would expect this to run because I trust myself explicitly"
  }
}

What is the expected behavior?

Monorepo packages should be tusted and their scripts should run.

What do you see instead?

> bun install
bun install v1.1.20 (ae194892)

$ echo Workspace postinstall runs fine
Workspace postinstall runs fine

Checked 7 installs across 8 packages (no changes) [46.00ms]

> bun pm untrusted
bun pm untrusted v1.1.20 (ae194892)

./node_modules/foo @workspace:libs/foo
 » [postinstall]: echo I would expect this to run because I trust myself explicitly.

These dependencies had their lifecycle scripts blocked during install.

If you trust them and wish to run their scripts, use `bun pm trust`.

Additional information

It would be nice for the trustedDependencies setting to support glob patterns like @foo/* to trust libraries that are using namespaced submodules extensively.

[sequencerr]

There is must be a way to bun pm trust [name] because @workspace:libs/foo as name doesn't work and I have no Idea what should it be, there is no mention of it in the docs

UPD: Ok, I figured it out [name] is just foo

[chakrihacker]

Any update on this??

[robobun]

Fixed on main.

Verified on main at df84f8d: workspace packages are trusted by default — their postinstall runs during bun install, and bun pm untrusted no longer lists them.

$ bun install --verbose   # (root + libs/foo workspace, both with postinstall)
[Scripts] Starting scripts for "foo"
I would expect this to run because I trust myself explicitly
[Scripts] Finished scripts for "foo"
$ bun pm untrusted
Found 0 untrusted dependencies with scripts.