--ignore-scripts vs --filter for credential isolation in CI

Answer

Combining --filter with --ignore-scripts guarantees that no lifecycle scripts run for the selected package or any of its transitive dependencies.

Confirmed facts

• --ignore-scripts suppresses all lifecycle hooks (preinstall, install, postinstall, prepare, etc.) for every package in the resolved installation graph.
• --filter <pkg> limits the installation to that workspace package and its dependencies, but does not suppress scripts unless combined with --ignore-scripts.
• When both flags are used, pnpm first resolves the subgraph defined by --filter, then applies --ignore-scripts to that entire subgraph, covering transitive dependencies as well.

Steps for complete script isolation

1. Identify the test package name, e.g., my-app/tests.
2. Run installation with both flags:

   pnpm install --filter=my-app/tests --ignore-scripts

3. Execute tests (or any other script) limited to the same filter:

   pnpm --filter=my-app/tests run test

Allowing local setup scripts while isolating credentials

If the test package needs its own setup scripts (e.g., database migrations) but you want to block scripts in dependencies:

• Use --filter without --ignore-scripts for the test package.
• Ensure any dependency scripts that could access credentials are conditional on CI environment variables (e.g., if (!process.env.CI) { … }) or moved to separate prepare scripts that you can skip via --ignore-scripts when running a pure install.
• Alternatively, split concerns: keep essential setup in the test package’s own scripts, and place credential‑risky logic in optional scripts that check process.env.CI before executing.

Missing diagnostic detail

Do you require any postinstall or prepare scripts to run for the test package itself? If yes, the conditional‑script approach above is needed; if not, the combined --filter + --ignore-scripts method is sufficient.