mirror of
https://github.com/facebook/react-native.git
synced 2024-11-22 06:29:46 +00:00
Summary:
This reverts commit 0cb97f0261
.
Revert this commit that adds a `post install` script for a couple of reasons:
1. (EDIT: This turns out to be unrelated) The `postinstall` script causes `yarn install` to fail on React Native macOS, where we use Yarn 4. I'm not entirely sure why, but I probably won't debug it for the rest of the reasons.
2. `postinstall` scripts (at least inside Microsoft) are viewed as a security risk. Any package in your dependency tree can get compromised, add the phase, and run arbitrary code. This has happened in the past with React Native past if I recall correctly. As such, we disable `postinstall` scripts in many of our repos (including `rnx-kit` and `react-native-test-app`).
3. The issue this is trying to solve is to help newcomers avoid a stale cache when they switch branches in the React Native monorepo and only run `yarn install`. I think it would be sufficient to add some documentation somewhere that it is expected one runs `yarn && yarn build` to use this repo locally? That's a fairly common practice in monorepos, at least ones inside Microsoft.
## Changelog:
[INTERNAL] [SECURITY] - Remove post install script phase in the React Native monorepo
Pull Request resolved: https://github.com/facebook/react-native/pull/46420
Test Plan: CI should pass
Reviewed By: christophpurrer, robhogan, cortinico, rshest
Differential Revision: D62755022
Pulled By: huntie
fbshipit-source-id: bf94ed33e3e451ea337ef7a6984f7ba964d0b212
This commit is contained in:
parent
8f1c227721
commit
8ac80e39ea
@ -32,8 +32,7 @@
|
||||
"test-typescript": "dtslint packages/react-native/types",
|
||||
"test": "jest",
|
||||
"trigger-react-native-release": "node ./scripts/releases-local/trigger-react-native-release.js",
|
||||
"update-lock": "npx yarn-deduplicate",
|
||||
"postinstall": "cd packages/react-native-codegen && yarn build"
|
||||
"update-lock": "npx yarn-deduplicate"
|
||||
},
|
||||
"workspaces": [
|
||||
"packages/*",
|
||||
|
Loading…
Reference in New Issue
Block a user