You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+4-23
Original file line number
Diff line number
Diff line change
@@ -10,37 +10,18 @@ There's no need to install the package. Just create a Git pre-commit [hook](http
10
10
npx enforcepm <pm>
11
11
```
12
12
13
-
Where `<pm>` is the name of package manager you want to use within your project.
13
+
Where `<pm>` is the name of the package manager you want to use within your project.
14
14
Currently only [**npm**](https://docs.npmjs.com/about-npm), [**yarn**](https://yarnpkg.com/) and [**pnpm**](https://pnpm.io/) are supported.
15
15
16
16
Feel free to open an issue requesting the implementation of your preferred package manager, or even better send a PR.
17
17
18
-
## Why enforcepm?
18
+
## How does it work?
19
19
20
-
As I started using yarn in my projects, I looked for a safety net against running npm commands.
21
-
It turns out there is no clean way to implement one (see yarn issue [#4895](https://github.com/yarnpkg/yarn/issues/4895)).
22
-
23
-
The best options available are:
24
-
25
-
I) [using a `preinstall` script](https://github.com/yarnpkg/yarn/issues/4895#issuecomment-343438785) in which `npm_execpath` is examinated to find out which package manager was designated to run the install command
26
-
27
-
II) [using a fictitious npm engine](https://github.com/yarnpkg/yarn/issues/4895#issuecomment-545644733) along with an `.npmrc` file with the rule `engine-strict = true`, so that any npm command would fail
28
-
29
-
The first approach doesn't really work, as `preinstall` only runs before install command with no arguments (eg, it runs before `npm install`, but not before `npm install enforcepm`).
30
-
31
-
The second approach works, though someone reports [it may cause problems later on](https://github.com/yarnpkg/yarn/issues/4895#issuecomment-1057095337), but it's quite "dirty" as it requires to create a file appositely for the job, and needs you to specify as many fake engines as the number of package manager you want to prevent from running commands.
32
-
33
-
There must be a better way to enforce a package manager.
34
-
35
-
## How does _enforcepm_ enforce a package manager?
36
-
37
-
When prevention is somewhat cumbersome, a cure may be the right path.
38
-
39
-
Rather than preventing a package manager from running, _enforcepm_ deals with the consequences of having used the wrong package manager.
20
+
Since, currently, there is no clean way to prevent a package manager from running (see [#4895](https://github.com/yarnpkg/yarn/issues/4895)), the approach chosen by _enforcepm_ is to deals with the consequences of using the wrong package manager.
40
21
41
22
The main problem with using wrong package managers is the generation of lock files, which are redundant and may cause [_"consistency issues"_](https://classic.yarnpkg.com/blog/2018/06/04/yarn-import-package-lock/)
42
23
43
-
_enforcepm_is just a script that deletes any staged lock file other than the desired one. The script is meant to be run in a pre-commit hook.
24
+
_enforcepm_ deletes any staged lock file other than the desired ones. The deletion is meant to take place in a pre-commit hook.
0 commit comments