Merge branch 'master' into DeployAuditUser

Author: purplecabbage

README.md

@@ -74,7 +74,7 @@ DESCRIPTION
   Create, run, test, and deploy Adobe I/O Apps
 ```
 
-_See code: [src/commands/app/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/index.js)_
+_See code: [src/commands/app/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/index.js)_
 
 ## `aio app add`
 
@@ -92,7 +92,7 @@ DESCRIPTION
   Add a new component to an existing Adobe I/O App
 ```
 
-_See code: [src/commands/app/add/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/add/index.js)_
+_See code: [src/commands/app/add/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/add/index.js)_
 
 ## `aio app add action`
 
@@ -117,7 +117,7 @@ ALIASES
   $ aio app add actions
 ```
 
-_See code: [src/commands/app/add/action.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/add/action.js)_
+_See code: [src/commands/app/add/action.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/add/action.js)_
 
 ## `aio app add ci`
 
@@ -135,7 +135,7 @@ DESCRIPTION
   Add CI files
 ```
 
-_See code: [src/commands/app/add/ci.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/add/ci.js)_
+_See code: [src/commands/app/add/ci.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/add/ci.js)_
 
 ## `aio app add event`
 
@@ -160,7 +160,7 @@ ALIASES
   $ aio app add events
 ```
 
-_See code: [src/commands/app/add/event.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/add/event.js)_
+_See code: [src/commands/app/add/event.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/add/event.js)_
 
 ## `aio app add extension`
 
@@ -186,7 +186,7 @@ ALIASES
   $ aio app add extensions
 ```
 
-_See code: [src/commands/app/add/extension.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/add/extension.js)_
+_See code: [src/commands/app/add/extension.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/add/extension.js)_
 
 ## `aio app add service`
 
@@ -210,7 +210,7 @@ ALIASES
   $ aio app add services
 ```
 
-_See code: [src/commands/app/add/service.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/add/service.js)_
+_See code: [src/commands/app/add/service.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/add/service.js)_
 
 ## `aio app add web-assets`
 
@@ -231,7 +231,7 @@ DESCRIPTION
   Add web assets support
 ```
 
-_See code: [src/commands/app/add/web-assets.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/add/web-assets.js)_
+_See code: [src/commands/app/add/web-assets.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/add/web-assets.js)_
 
 ## `aio app build`
 
@@ -261,7 +261,7 @@ DESCRIPTION
   Use the --force-build flag to force a build even if one already exists.
 ```
 
-_See code: [src/commands/app/build.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/build.js)_
+_See code: [src/commands/app/build.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/build.js)_
 
 ## `aio app clean`
 
@@ -286,7 +286,7 @@ DESCRIPTION
   Note that this will require a full rebuild on your next build command.
 ```
 
-_See code: [src/commands/app/clean.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/clean.js)_
+_See code: [src/commands/app/clean.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/clean.js)_
 
 ## `aio app create [PATH]`
 
@@ -308,7 +308,7 @@ DESCRIPTION
   Create a new Adobe I/O App with default parameters
 ```
 
-_See code: [src/commands/app/create.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/create.js)_
+_See code: [src/commands/app/create.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/create.js)_
 
 ## `aio app delete`
 
@@ -326,7 +326,7 @@ DESCRIPTION
   Delete a component from an existing Adobe I/O App
 ```
 
-_See code: [src/commands/app/delete/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/delete/index.js)_
+_See code: [src/commands/app/delete/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/delete/index.js)_
 
 ## `aio app delete action [ACTION-NAME]`
 
@@ -352,7 +352,7 @@ ALIASES
   $ aio app delete actions
 ```
 
-_See code: [src/commands/app/delete/action.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/delete/action.js)_
+_See code: [src/commands/app/delete/action.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/delete/action.js)_
 
 ## `aio app delete ci`
 
@@ -371,7 +371,7 @@ DESCRIPTION
   Delete existing CI files
 ```
 
-_See code: [src/commands/app/delete/ci.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/delete/ci.js)_
+_See code: [src/commands/app/delete/ci.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/delete/ci.js)_
 
 ## `aio app delete extension`
 
@@ -397,7 +397,7 @@ ALIASES
   $ aio app delete extensions
 ```
 
-_See code: [src/commands/app/delete/extension.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/delete/extension.js)_
+_See code: [src/commands/app/delete/extension.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/delete/extension.js)_
 
 ## `aio app delete service`
 
@@ -421,7 +421,7 @@ ALIASES
   $ aio app delete services
 ```
 
-_See code: [src/commands/app/delete/service.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/delete/service.js)_
+_See code: [src/commands/app/delete/service.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/delete/service.js)_
 
 ## `aio app delete web-assets`
 
@@ -440,7 +440,7 @@ DESCRIPTION
   Delete existing web assets
 ```
 
-_See code: [src/commands/app/delete/web-assets.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/delete/web-assets.js)_
+_See code: [src/commands/app/delete/web-assets.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/delete/web-assets.js)_
 
 ## `aio app deploy`
 
@@ -486,7 +486,7 @@ DESCRIPTION
   Use the --force-deploy flag to force deploy changes, regardless of production Workspace being published in Exchange.
 ```
 
-_See code: [src/commands/app/deploy.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/deploy.js)_
+_See code: [src/commands/app/deploy.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/deploy.js)_
 
 ## `aio app get-url [ACTION]`
 
@@ -508,7 +508,7 @@ DESCRIPTION
   Get action URLs
 ```
 
-_See code: [src/commands/app/get-url.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/get-url.js)_
+_See code: [src/commands/app/get-url.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/get-url.js)_
 
 ## `aio app info`
 
@@ -530,7 +530,7 @@ DESCRIPTION
   Display settings/configuration in use by an Adobe I/O App
 ```
 
-_See code: [src/commands/app/info.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/info.js)_
+_See code: [src/commands/app/info.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/info.js)_
 
 ## `aio app init [PATH]`
 
@@ -572,30 +572,31 @@ DESCRIPTION
   Create a new Adobe I/O App
 ```
 
-_See code: [src/commands/app/init.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/init.js)_
+_See code: [src/commands/app/init.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/init.js)_
 
 ## `aio app install PATH`
 
 This command will support installing apps packaged by 'aio app pack'.
 
 ```
 USAGE
-  $ aio app install PATH [-v] [--version] [-o <value>] [--tests]
+  $ aio app install PATH [-v] [--version] [--allow-scripts] [-o <value>] [--tests]
 
 ARGUMENTS
   PATH  Path to the app package to install
 
 FLAGS
-  -o, --output=<value>  [default: .] The packaged app output folder path
-  -v, --verbose         Verbose output
-      --[no-]tests      Run packaged app unit tests (e.g. aio app:test)
-      --version         Show version
+  -o, --output=<value>      [default: .] The packaged app output folder path
+  -v, --verbose             Verbose output
+      --[no-]allow-scripts  Allow post and preinstall scripts during npm install/npm ci
+      --[no-]tests          Run packaged app unit tests (e.g. aio app:test)
+      --version             Show version
 
 DESCRIPTION
   This command will support installing apps packaged by 'aio app pack'.
 ```
 
-_See code: [src/commands/app/install.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/install.js)_
+_See code: [src/commands/app/install.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/install.js)_
 
 ## `aio app list`
 
@@ -613,7 +614,7 @@ DESCRIPTION
   List components for Adobe I/O App
 ```
 
-_See code: [src/commands/app/list/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/list/index.js)_
+_See code: [src/commands/app/list/index.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/list/index.js)_
 
 ## `aio app list extension`
 
@@ -638,7 +639,7 @@ ALIASES
   $ aio app list extensions
 ```
 
-_See code: [src/commands/app/list/extension.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/list/extension.js)_
+_See code: [src/commands/app/list/extension.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/list/extension.js)_
 
 ## `aio app logs`
 
@@ -662,29 +663,30 @@ DESCRIPTION
   Fetch logs for an Adobe I/O App
 ```
 
-_See code: [src/commands/app/logs.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/logs.js)_
+_See code: [src/commands/app/logs.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/logs.js)_
 
 ## `aio app pack [PATH]`
 
 This command will support packaging apps for redistribution.
 
 ```
 USAGE
-  $ aio app pack [PATH] [-v] [--version] [-o <value>]
+  $ aio app pack [PATH] [-v] [--version] [--lock-file] [-o <value>]
 
 ARGUMENTS
   PATH  [default: .] Path to the app directory to package
 
 FLAGS
   -o, --output=<value>  [default: dist/app.zip] The packaged app output file path
   -v, --verbose         Verbose output
+      --[no-]lock-file  Include the package-lock.json file in the packaged app
       --version         Show version
 
 DESCRIPTION
   This command will support packaging apps for redistribution.
 ```
 
-_See code: [src/commands/app/pack.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/pack.js)_
+_See code: [src/commands/app/pack.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/pack.js)_
 
 ## `aio app run`
 
@@ -706,7 +708,7 @@ DESCRIPTION
   Run an Adobe I/O App
 ```
 
-_See code: [src/commands/app/run.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/run.js)_
+_See code: [src/commands/app/run.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/run.js)_
 
 ## `aio app test`
 
@@ -734,7 +736,7 @@ DESCRIPTION
   If the extension has a hook called 'test' in its 'ext.config.yaml', the script specified will be run instead.
 ```
 
-_See code: [src/commands/app/test.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/test.js)_
+_See code: [src/commands/app/test.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/test.js)_
 
 ## `aio app undeploy`
 
@@ -759,7 +761,7 @@ DESCRIPTION
   Undeploys an Adobe I/O App
 ```
 
-_See code: [src/commands/app/undeploy.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/undeploy.js)_
+_See code: [src/commands/app/undeploy.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/undeploy.js)_
 
 ## `aio app use [CONFIG_FILE_PATH]`
 
@@ -806,5 +808,5 @@ DESCRIPTION
   page in https://developer.adobe.com/console/
 ```
 
-_See code: [src/commands/app/use.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.1.3/src/commands/app/use.js)_
+_See code: [src/commands/app/use.js](https://github.com/adobe/aio-cli-plugin-app/blob/14.3.0/src/commands/app/use.js)_
 <!-- commandsstop -->

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@adobe/aio-cli-plugin-app",
   "description": "Create, Build and Deploy Adobe I/O Applications",
-  "version": "14.1.3",
+  "version": "14.3.0",
   "author": "Adobe Inc.",
   "bugs": "https://github.com/adobe/aio-cli-plugin-app/issues",
   "dependencies": {
@@ -14,7 +14,7 @@
     "@adobe/aio-lib-ims": "^7",
     "@adobe/aio-lib-runtime": "^7.1.3",
     "@adobe/aio-lib-templates": "^3",
-    "@adobe/aio-lib-web": "^7",
+    "@adobe/aio-lib-web": "^7.0.6",
     "@adobe/generator-aio-app": "^9",
     "@adobe/generator-app-common-lib": "^3",
     "@adobe/inquirer-table-checkbox": "^2",

src/commands/app/install.js

@@ -19,7 +19,7 @@ const execa = require('execa')
 const unzipper = require('unzipper')
 const { validateJsonWithSchema } = require('../../lib/install-helper')
 const jsYaml = require('js-yaml')
-const { USER_CONFIG_FILE, DEPLOY_CONFIG_FILE } = require('../../lib/defaults')
+const { USER_CONFIG_FILE, DEPLOY_CONFIG_FILE, PACKAGE_LOCK_FILE } = require('../../lib/defaults')
 const ora = require('ora')
 
 // eslint-disable-next-line node/no-missing-require
@@ -51,7 +51,14 @@ class InstallCommand extends BaseCommand {
       await this.unzipFile(args.path, outputPath)
       await this.validateAppConfig(outputPath, USER_CONFIG_FILE)
       await this.validateDeployConfig(outputPath, DEPLOY_CONFIG_FILE)
-      await this.npmInstall(flags.verbose)
+
+      const packageLockPath = path.join(outputPath, PACKAGE_LOCK_FILE)
+      if (fs.existsSync(packageLockPath)) {
+        await this.npmCI(flags.verbose, flags['allow-scripts'])
+      } else {
+        this.warn('No lockfile found, running standard npm install. It is recommended that you include a lockfile with your app bundle.')
+        await this.npmInstall(flags.verbose, flags['allow-scripts'])
+      }
       if (flags.tests) {
         await this.runTests()
       }
@@ -131,15 +138,26 @@ class InstallCommand extends BaseCommand {
     }
   }
 
-  async npmInstall (isVerbose) {
+  async npmInstall (isVerbose = false, allowScripts = true) {
+    const ignoreScripts = allowScripts ? undefined : '--ignore-scripts'
     this.spinner.start('Running npm install...')
     const stdio = isVerbose ? 'inherit' : 'ignore'
-    return execa('npm', ['install'], { stdio })
+    return execa('npm', ['install', ignoreScripts], { stdio })
       .then(() => {
         this.spinner.succeed('Ran npm install')
       })
   }
 
+  async npmCI (isVerbose = false, allowScripts = true) {
+    const ignoreScripts = allowScripts ? undefined : '--ignore-scripts'
+    this.spinner.start('Running npm ci...')
+    const stdio = isVerbose ? 'inherit' : 'ignore'
+    return execa('npm', ['ci', ignoreScripts], { stdio })
+      .then(() => {
+        this.spinner.succeed('Ran npm ci')
+      })
+  }
+
   async runTests (isVerbose) {
     this.spinner.start('Running app tests...')
     return this.config.runCommand('app:test').then((result) => {
@@ -157,6 +175,11 @@ InstallCommand.description = `This command will support installing apps packaged
 
 InstallCommand.flags = {
   ...BaseCommand.flags,
+  'allow-scripts': Flags.boolean({
+    description: 'Allow post and preinstall scripts during npm install/npm ci',
+    default: true,
+    allowNo: true
+  }),
   output: Flags.string({
     description: 'The packaged app output folder path',
     char: 'o',