Resolve issue with Prisma by providing a way to pass --allow-scripts

[adamzerner]

I'm trying to get Prisma set up in my new Fresh project. I imitated this repo and it works locally, but I run into issues when deploying to Deno Deploy. More specifically, when deno task build runs, this warning shows up in my GitHub Action logs:

Warning The following packages contained npm lifecycle scripts (preinstall/install/postinstall) that were not executed:
┠─ npm:[email protected]
┠─ npm:@prisma/[email protected]
┠─ npm:@prisma/[email protected]
┃
┠─ This may cause the packages to not work correctly.
┖─ To run lifecycle scripts, use the `--allow-scripts` flag with `deno install`:
   deno install --allow-scripts=npm:[email protected],npm:@prisma/[email protected],npm:@prisma/[email protected]

followed by this error:

error: Uncaught (in promise) TypeError: Module not found "file:///home/runner/work/urban-admin/urban-admin/prisma/generated/client/index.d.ts".
    at file:///home/runner/work/urban-admin/urban-admin/prisma/client.ts:8:15
  const manifest = (await import(toFileUrl(join(dir, "fresh.gen.ts")).href))
                    ^
    at async dev (https://deno.land/x/[email protected]/src/dev/dev_command.ts:38:21)
    at async file:///home/runner/work/urban-admin/urban-admin/dev.ts:8:1
Error: Process completed with exit code 1.

This makes sense. The @prisma/client NPM package has a postinstall hook that generates the Prisma client. Such hooks won't run with deno install unless you have the --allow-scripts flag. I can't tell where deno install is actually being triggered, but given the log output, it appears that the --allow-scripts flag isn't being used.

To see where deno install might be being triggered, my reasoning is as follows. The issue comes during the "Build step" step of the "Deploy" job, which runs deno task build. From deno.json we can see that deno task build executes deno run -A dev.ts build. I didn't touch dev.ts. Here's what it looks like:

#!/usr/bin/env -S deno run -A --watch=static/,routes/

import dev from "$fresh/dev.ts";
import config from "./fresh.config.ts";

import "$std/dotenv/load.ts";

await dev(import.meta.url, "./main.ts", config);

From here I'm not sure what's going on, nor how I can find deno install and add --allow-scripts. I can see that dev is being called but I can't find any docs for dev. I tried digging into main.ts and config, but couldn't really figure out what's going on there or whether there's any tweaks I can make in either of those places to resolve this issue.

To support Prisma and other NPM packages with postinstall hooks, I think Fresh should provide and/or document a way to allow such scripts to run.

[marvinhagemeister]

Deno by default will try to install any missing dependencies when running deno run. As you discovered it won't run npm postinstall scripts automatically though because they could contain malicious code in theory. To execute these postinstall scripts you need to run deno install --allow-scripts explicitly. You can do this by putting it before the deno task build command in your GH actions workflow.

  name: Deploy
  on:
    push:
      branches: [main]
    pull_request:
      branches: main
  
  jobs:
    deploy:
      name: Deploy
      runs-on: ubuntu-latest
  
      permissions:
        id-token: write # Needed for auth with Deno Deploy
        contents: read # Needed to clone the repository
  
      steps:
        - name: Clone repository
          uses: actions/checkout@v4
  
        - name: Install Deno
          uses: denoland/setup-deno@v1
          with:
            deno-version: rc

+      - name: Install dependencies
+        run: deno install --allow-scripts=npm:[email protected],npm:@prisma/[email protected],npm:@prisma/[email protected]

        - name: Build step
          run: "deno task build" # 📝 Update the build command(s) if necessary

        - name: Upload to Deno Deploy
          uses: denoland/deployctl@v1
          with:
            project: "fresh" # 📝 Update the deploy project name if necessary
            entrypoint: "./main.ts" # 📝 Update the entrypoint if necessary
            root: "."

[adamzerner]

Since Prisma is on 6.0.1 now I added:

- name: Install dependencies
  run: deno install --allow-scripts=npm:[email protected],npm:@prisma/[email protected],npm:@prisma/[email protected]

before the "Build step" step. That successfully resolved the postinstall issue but lead to the following error:

error: Uncaught (in promise) Error: Cannot find module './generated/client/index.cjs'
Require stack:
- /home/runner/work/urban-admin/urban-admin/prisma/client.ts
    at Function.Module._resolveFilename (node:module:619:15)
    at Function.Module._load (node:module:497:27)
    at Module.require (node:module:681:19)
    at require (node:module:812:16)
    at file:///home/runner/work/urban-admin/urban-admin/prisma/client.ts:5:16
Error: Process completed with exit code 1.

That error is happening because in following this setup, the standard prisma generate command won't work. We need to run this custom prisma:generate command instead. So I tried updating the "Install dependencies task" and adding a "Generate Prisma client" step before the "Build step" step like so:

- name: Install dependencies
  run: "deno install"

- name: Generate Prisma client
  run: "deno task prisma:generate"

- name: Build step
  run: "deno task build"

That leads to the following error in the "Upload to Deno Deploy" step:

Error: The deployment failed: BOOT_FAILURE

Uncaught SyntaxError: Export 'Extensions' is not defined in module
    at file:///src/prisma/generated/client/runtime/library.d.ts:1338:10

I'm not sure where that error is coming from nor how to debug it. I haven't made any notable changes to the "Upload to Deno Deploy" step:

- name: Upload to Deno Deploy
  uses: denoland/deployctl@v1
  with:
    project: "urban-admin"
    entrypoint: "main.ts"
    root: "."

At first when I submitted this GitHub Issue I was thinking that it might be an issue with Fresh, either 1) because there isn't a way to pass --allow-scripts or 2) because there is a way to do so but it's not documented. I now see that (1) is not an issue. I'm not sure if (2) is an issue or not; I could see arguments on both sides.

Anyway, I'm not sure if my current issue is really related to Fresh. It probably isn't. And so I think it'd be understandable to want to close this issue. On the other hand, Prisma is a popular ORM, I expect that people trying to use Prisma with Fresh will run into issues similar to the ones I'm running into, and that this conversation will help those people. For that reason I feel like it'd be worth keeping this issue open and working to resolve it, but I don't feel strongly.