Add a prepare script so dependicus installs from git

CHANGELOG.md

@@ -6,6 +6,11 @@
 
 ### Added
 
+- Dependicus can be installed from a git URL, not just from the registry, which is useful for trying a fix that isn't released yet.
+    - Dependicus now builds itself from the clone, so `npm install github:descriptinc/dependicus` gives you a working `dependicus` command instead of an empty one.
+    - pnpm and yarn refuse to run a git dependency's build script until you list the package as trusted. The README has the line of config each one wants.
+    - Bun and aube can't install Dependicus from git. Bun doesn't install a git dependency's devDependencies, so the build has nothing to run with, and aube doesn't accept git specifiers.
+
 ### Changed
 
 - `searchDependicusIssues` (in `@dependicus/github-issues`) now treats draft pull requests as not yet open for review and excludes them from results, while ready-for-review pull requests are returned alongside regular issues. Each returned entry carries an `isPullRequest` boolean so notification bots can count open Dependicus items accurately — drafts no longer pad the total — and the reconciler can avoid mutating pull requests. Anything explicitly flagged as a draft (PR or otherwise) is still skipped defensively.

README.md

@@ -52,6 +52,32 @@ pnpm dlx dependicus@latest make-github-issues \
 
 Dependicus offers extensive customization through its JavaScript API.
 
+## Installing from git
+
+To try a fix that isn't released yet, install from the repo instead of the registry. Dependicus builds itself from the clone, so you still get a working `dependicus` command.
+
+```sh
+npm install github:descriptinc/dependicus
+```
+
+Package managers don't run a git dependency's build script until you tell them the package is trusted, so pnpm and yarn need a line of config first.
+
+In `pnpm-workspace.yaml`:
+
+```yaml
+onlyBuiltDependencies:
+    - dependicus
+```
+
+In `.yarnrc.yml`:
+
+```yaml
+approvedGitRepositories:
+    - 'https://github.com/descriptinc/dependicus.git'
+```
+
+npm needs no configuration. Bun and aube can't do this at all: bun doesn't install a git dependency's devDependencies, so the build has nothing to run with, and aube doesn't accept git specifiers. Install from the registry with those two.
+
 ## Peer dependency note
 
 The Linear integration (`make-linear-issues`) depends on `@linear/sdk`, which has a transitive peer dependency on `graphql`. If your project uses `strictPeerDependencies`, you may need to add `graphql` to your own dependencies. This is only required for Linear ticket creation.

package.json

@@ -38,7 +38,8 @@
     "scripts": {
         "dependicus": "node dist/bin.mjs",
         "build": "node scripts/build-assets.mjs && tsdown",
-        "prepack": "pnpm run build",
+        "prepare": "node scripts/build-assets.mjs && tsdown",
+        "prepack": "node scripts/build-assets.mjs && tsdown",
         "clean": "rm -rf dist",
         "test": "vitest run",
         "typedoc": "typedoc --tsconfig tsconfig.typedoc.json --entryPoints src/index.ts --out typedoc-out --name 'Dependicus API Reference'",

src/packageScripts.test.ts

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const packageJson = JSON.parse(
+    readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf-8'),
+) as { scripts: Record<string, string> };
+
+// Installing dependicus from a git URL builds `dist/` from the clone, because
+// the published `dist/` only exists in registry tarballs. Package managers
+// disagree about which lifecycle script does that build: npm, pnpm and bun run
+// `prepare`, yarn runs `prepack`. Both have to do the same thing as `build` or
+// a git install ships something different from a release.
+const BUILD_SCRIPTS = ['prepare', 'prepack'] as const;
+
+describe('package.json scripts', () => {
+    for (const script of BUILD_SCRIPTS) {
+        it(`keeps ${script} in step with build`, () => {
+            expect(packageJson.scripts[script]).toBe(packageJson.scripts.build);
+        });
+
+        // These run under whichever package manager the installing project
+        // uses, and yarn runs them in a bootstrap environment that has only
+        // yarn on PATH, so they can't name a package manager.
+        it(`names no package manager in ${script}`, () => {
+            expect(packageJson.scripts[script]).not.toMatch(/\b(pnpm|npm|yarn|bun|aube)\b/);
+        });
+    }
+});