fix(pnpm): stop ignore pnpmfile with high trust level (#4845)

renovatebot · Nov 22, 2019 · edc2dc3 · edc2dc3
1 parent b86c1b0
commit edc2dc3
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/lib/manager/npm/post-update/pnpm.ts b/lib/manager/npm/post-update/pnpm.ts
@@ -91,8 +91,10 @@ export async function generateLockFile(
     logger.debug(`Using pnpm: ${cmd}`);
     cmd += ' install';
     cmd += ' --lockfile-only';
-    cmd += ' --ignore-scripts';
-    cmd += ' --ignore-pnpmfile';
+    if (global.trustLevel !== 'high') {
+      cmd += ' --ignore-scripts';
+      cmd += ' --ignore-pnpmfile';
+    }
     // TODO: Switch to native util.promisify once using only node 8
     ({ stdout, stderr } = await exec(cmd, {
       cwd,