fix: drop no-op install script that triggers Yarn build warning - #180
Merged
Merged
Conversation
Yarn Berry (Plug'n'Play) prints "YN0007: @datadog/native-appsec must be built" for any dependency that declares an install/preinstall/postinstall script, even the no-op "exit 0". The package ships prebuilt binaries and excludes binding.gyp from the published tarball, so a consumer has nothing to build; the script only suppressed npm's implicit node-gyp rebuild in the dev tree. Removing it stops the spurious warning for Yarn Berry consumers. The static-checks job ran a bare `npm ci`. Without the install script npm would implicitly run node-gyp there, but that job lacks the libddwaf artifact, so it now installs with --ignore-scripts. The build job already uses action-prebuildify with --ignore-scripts, so prebuilds are unaffected. Refs: DataDog/dd-trace-js#5432
This comment has been minimized.
This comment has been minimized.
Without an install script, npm's publish-time normalization synthesizes node-gyp rebuild when binding.gyp is present. Consumers then try to build against a binding.gyp excluded from the tarball instead of loading the shipped prebuild. Setting gypfile:false suppresses npm's implicit hook without restoring the lifecycle script that triggers Yarn Berry's YN0007 warning. Refs: DataDog/dd-trace-js#5432
actions/download-artifact@v7 flattens libddwaf when it is the run's only artifact, so binding.gyp cannot find libddwaf/include/ddwaf.h. Name the input artifact explicitly so action-prebuildify restores the layout used by local builds and releases.
BridgeAR
commented
Jul 28, 2026
Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
BridgeAR
marked this pull request as ready for review
July 28, 2026 10:10
IlyasShabi
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Yarn Berry (Plug'n'Play) prints
YN0007: @datadog/native-appsec must be builtfor any dependency that declares aninstall/preinstall/postinstallscript, including the no-op"install": "exit 0". The package ships prebuilt binaries and excludesbinding.gypfrom the published tarball, so a consumer has nothing to build.The script also suppressed npm's implicit
node-gyp rebuildin the dev tree. Thestatic-checksjob ran a barenpm ciwithout thelibddwafartifact, so it now installs with--ignore-scripts; the build job already usesaction-prebuildify(--ignore-scripts), so prebuilds are unaffected.A regression test asserts the manifest declares no build lifecycle scripts.
Test plan
yarn add @datadog/native-appsecunder Yarn Berry no longer prints YN0007Refs: DataDog/dd-trace-js#5432