[BUG] npm publish with folder package-spec acts on CWD instead

[mycroes]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Given the following directory structure:

• package\
• package\package.json
• package\build\
• package\build...
• package\build\package.json
• package\src\
• package\src...

I develop my package in the src folder. When building I build to the build folder, copy package.json to build and alter package.json so it matches what I want to publish (to an internal server). Previously I would run npm publish build, however with npm 8(.7.0) that no longer results in the desired behavior. However, the package-spec documentation states I can actually refer to the build folder by using ./build, or perhaps .\build on Windows (assuming CWD is package). Using either results in a publish of the folder package and all its content instead of package\build. CD-ing to build and running npm publish results in the expected behavior.

Expected Behavior

npm publish <package-spec> where package-spec is a folder acts identical to pushd <package-spec> && npm publish && popd.

Steps To Reproduce

1. In described environment
2. With no specific configuration
3. Run npm publish ./build --dry-run
4. See output to see src and build folders end up in package, instead of build contents only.

Environment

• npm: 8.7.0
• Node.js: 18.4.0
• OS Name: Windows 10
• System Model Name: N/A
• npm config:

; "builtin" config from C:\Users\michaelc\AppData\Roaming\npm\node_modules\npm\npmrc

prefix = "C:\\Users\\michaelc\\AppData\\Roaming\\npm"

; "user" config from C:\Users\michaelc\.npmrc

@vlc:registry = "https://npm.vlc.viscon.eu"
//npm.vlc.viscon.eu/:_authToken = (protected)

; node bin location = C:\Program Files\nodejs\node.exe
; node version = v18.4.0
; npm local prefix = C:\Users\michaelc\Documents\Projects\VLC\VLC.Infrastructure.Web.Tables
; npm version = 8.7.0
; cwd = C:\Users\michaelc\Documents\Projects\VLC\VLC.Infrastructure.Web.Tables
; HOME = C:\Users\michaelc
; Run `npm config ls -l` to show all defaults.

[nlf]

your npm is pretty old, can you try updating?

i'm going to close this as i'm not able to reproduce this on the latest published release. feel free to reopen if it's still not working for you after updating, though.

here's what i did to try:

> mkdir project
> cd project
> npm init -y
> mkdir build
> cd build
> npm init -y
> cd ..
> npm publish ./build --dry-run

npm notice 
npm notice 📦  [email protected]
npm notice === Tarball Contents === 
npm notice 258B package.json
npm notice === Tarball Details === 
npm notice name:          build                                   
npm notice version:       1.0.0                                   
npm notice filename:      build-1.0.0.tgz                         
npm notice package size:  278 B                                   
npm notice unpacked size: 258 B                                   
npm notice shasum:        5c98428681eccf130f1f9a407f23193686498101
npm notice integrity:     sha512-YuoskojI8dMFn[...]j5jUCJQiQBNwA==
npm notice total files:   1                                       
npm notice 
npm notice Publishing to https://registry.npmjs.org/ (dry-run)

[mycroes]

Thanks @nlf. I upgraded NodeJS last week and was under the impression I was using a new npm version (that was installed alongside NodeJS). However I had previously followed the upgrade guide and was still on the version I had previously installed. It does indeed seems to work without issues, on npm 8.14.0 now though.

[mycroes]

@nlf I was still experiencing the issue on my CI server, so I did some more investigation and actually still have the same issue locally as well. However, there's one more package.json involved:

> mkdir root
> cd root
> mkdir proj
> cd proj
> npm init -y
> mkdir build
> cd build
> npm init -y
> cd ..
> mkdir src
> echo src > src\src.txt
> echo build > build\build.txt
> echo {"name":"root","workspaces":["proj"]} > ..\package.json
> npm publish ./build --dry-run
npm notice
npm notice package: [email protected]
npm notice === Tarball Contents ===
npm notice 8B   build/build.txt
npm notice 218B package.json
npm notice 6B   src/src.txt
npm notice === Tarball Details ===
npm notice name:          proj
npm notice version:       1.0.0
npm notice filename:      proj-1.0.0.tgz
npm notice package size:  313 B
npm notice unpacked size: 232 B
npm notice shasum:        50e174f63fccec2d1a67571fda17a825a45ebdee
npm notice integrity:     sha512-4qqlR6hnfl+VM[...]yS287fBgam4YQ==
npm notice total files:   3
npm notice
npm WARN This command requires you to be logged in to https://registry.npmjs.org/ (dry-run)
npm notice Publishing to https://registry.npmjs.org/ (dry-run)
+ [email protected]

> npm pack ./build --dry-run
npm WARN Ignoring workspaces for specified package(s)
npm notice
npm notice package: [email protected]
npm notice === Tarball Contents ===
npm notice 8B   build.txt
npm notice 219B package.json
npm notice === Tarball Details ===
npm notice name:          build
npm notice version:       1.0.0
npm notice filename:      build-1.0.0.tgz
npm notice package size:  282 B
npm notice unpacked size: 227 B
npm notice shasum:        f7ecede13e1ea48f174bbfea4f5a084b976efd64
npm notice integrity:     sha512-hryfO1NUvfGER[...]lFMnGTGbNywrw==
npm notice total files:   2
npm notice
build-1.0.0.tgz

As you can see, pack will actually honor the supplied path, publish will just ignore it and use the workspace instead. Another interesting thing I noticed is that if I create the root package.json first, I can no longer create a package.json in build using npm init -y, because that also uses the workspace (parent folder) instead of CWD and just recreates the proj package.json.

I'm actually unable to reopen this, please reopen it for me.

[ddbtrmatic]

I'm having a similar issue. Running npm publish ./dist in the package directory results in packing the ./src/ directory instead. If I remove the package from my workspace list, then npm publish ./dist correctly packages the specified ./dist folder.

This is npm version 8.19.2

Edit:

This is the only solution I've been able to use as a work-around

  "scripts": {
    "pub": "cd dist && npm publish"
  },

[csj0oe]

Hello, any updates on this ? i still have the same issue in workspaces project using npm v10.7.0