基本示例

Question

假设你有一个带有以下package.json的npm项目：

{
  "name": "XXX",
  "version": "YYY",
  "license": "ZZZ",
  "scripts": {
    "scriptA": "...",
    "scriptB": "...",
    "preinstall": "...",
    "postinstall": "..."
  },
  "devDependencies": {
    "depA": "vA",
    "depB": "vB"
  },
  "dependencies": {
    "depC": "vC",
    "depD": "vD"
  }
}

打包/发布包裹时，您不需要scripts或devDependencies个键。但更危险的是，当人们将您的软件包作为依赖项安装时，preinstall和postinstall脚本可能会触发奇怪/不需要的操作。

那么如何清理package.json，即删除不需要的密钥？

我目前正在使用npm 3.10。如果我使用npm pack命令，根据npm documentation，如果没有提供参数（因此从磁盘获取原始package.json），它将只包装当前包，并且没有选项我可以提供清理它。

我当然可以编写自己的脚本来压缩包并生成我自己的package.json。它是要走的路吗？

Answer 1

使用npm本身，这似乎不可能。从npm 3.10开始，npm publish或npm pack确实只会在您的tgz中包含package.json的纯副本。

因此，解决方案是生成自己的打包文件，以完全控制所包含的package.json。

基本示例

注意：这是使用npm fs

中的shell和同步方法

const fs = require('fs');
const os = require('os');

const shell = require('shelljs');
const targz = require('tar.gz');

// create temp directory
const tempDirectory = fs.mkdtempSync(`${os.tmpdir()}/your-project-tarball-`);
const packageDirectory = `${tempDirectory}/package`;

// create subfolder package
fs.mkdirSync(packageDirectory);

// read existing package.json
const packageJSON = require('./package.json');

// copy all necessary files
// https://docs.npmjs.com/files/package.json#files
shell.cp('-R', packageJSON.files, packageDirectory);
shell.cp('-R', ['README.md', 'CHANGELOG.md', 'LICENSE'], packageDirectory);

// create your own package.json or modify it here
Reflect.deleteProperty(packageJSON, 'scripts');
fs.writeFileSync(`${packageDirectory}/package.json`, JSON.stringify(packageJSON, null, 2));

// create tgz and put it in dist folder
targz().compress(packageDirectory, 'your-package.tgz');

Lodash的实际例子

这是例如版本4.17.2中lodash lib所执行的操作。他们原来的package.json看起来像（cf https://github.com/lodash/lodash/blob/4.17.2/package.json）：

{
  "name": "lodash",
  "version": "4.17.2",
  "license": "MIT",
  "private": true,
  "main": "lodash.js",
  "engines": { "node": ">=4.0.0" },
  "scripts": {
    "build": "npm run build:main && npm run build:fp",
    "build:fp": "node lib/fp/build-dist.js",
    "build:fp-modules": "node lib/fp/build-modules.js",
    "build:main": "node lib/main/build-dist.js",
    "build:main-modules": "node lib/main/build-modules.js",
    "doc": "node lib/main/build-doc github && npm run test:doc",
    "doc:fp": "node lib/fp/build-doc",
    "doc:site": "node lib/main/build-doc site",
    "doc:sitehtml": "optional-dev-dependency marky-markdown@^9.0.1 && npm run doc:site && node lib/main/build-site",
    "pretest": "npm run build",
    "style": "npm run style:main && npm run style:fp && npm run style:perf && npm run style:test",
    "style:fp": "jscs fp/*.js lib/**/*.js",
    "style:main": "jscs lodash.js",
    "style:perf": "jscs perf/*.js perf/**/*.js",
    "style:test": "jscs test/*.js test/**/*.js",
    "test": "npm run test:main && npm run test:fp",
    "test:doc": "markdown-doctest doc/*.md",
    "test:fp": "node test/test-fp",
    "test:main": "node test/test",
    "validate": "npm run style && npm run test"
  },
  "devDependencies": {
    "async": "^2.1.2",
    "benchmark": "^2.1.2",
    "chalk": "^1.1.3",
    "cheerio": "^0.22.0",
    "codecov.io": "~0.1.6",
    "coveralls": "^2.11.15",
    "curl-amd": "~0.8.12",
    "docdown": "~0.7.1",
    "dojo": "^1.11.2",
    "ecstatic": "^2.1.0",
    "fs-extra": "~1.0.0",
    "glob": "^7.1.1",
    "istanbul": "0.4.5",
    "jquery": "^3.1.1",
    "jscs": "^3.0.7",
    "lodash": "4.17.1",
    "lodash-doc-globals": "^0.1.1",
    "markdown-doctest": "^0.9.0",
    "optional-dev-dependency": "^2.0.0",
    "platform": "^1.3.3",
    "qunit-extras": "^3.0.0",
    "qunitjs": "^2.0.1",
    "request": "^2.78.0",
    "requirejs": "^2.3.2",
    "sauce-tunnel": "^2.5.0",
    "uglify-js": "2.7.4",
    "webpack": "^1.13.3"
  },
  "greenkeeper": {
    "ignore": [
      "lodash"
    ]
  }
}

但已发布的package.json看起来像（cf https://unpkg.com/lodash@4.17.2/package.json）

{
  "name": "lodash",
  "version": "4.17.2",
  "description": "Lodash modular utilities.",
  "keywords": "modules, stdlib, util",
  "homepage": "https://lodash.com/",
  "repository": "lodash/lodash",
  "icon": "https://lodash.com/icon.svg",
  "license": "MIT",
  "main": "lodash.js",
  "author": "John-David Dalton <john.david.dalton@gmail.com> (http://allyoucanleet.com/)",
  "contributors": [
    "John-David Dalton <john.david.dalton@gmail.com> (http://allyoucanleet.com/)",
    "Mathias Bynens <mathias@qiwi.be> (https://mathiasbynens.be/)"
  ],
  "scripts": { "test": "echo \"See https://travis-ci.org/lodash/lodash-cli for testing details.\"" }
}

您可以看到例如scripts和devDependencies键不再存在。只要nodejs脚本package.jst

，就可以使用JavaScript模板Lodash CLI完成此操作

包装前清洁package.json

1 个答案:

基本示例

Lodash的实际例子