From 0379eab698b78ae4aa89bbe2043607f420e52f11 Mon Sep 17 00:00:00 2001
From: Gar <gar+gh@danger.computer>
Date: Tue, 23 Mar 2021 15:48:52 -0700
Subject: [PATCH] fix(install): ignore auditLevel

`npm install` should not be affected by the `auditLevel` config, as the
results of audit do not change its exit status.

PR-URL: https://github.com/npm/cli/pull/2929
Credit: @wraithgar
Close: #2929
Reviewed-by: @ljharb, @ruyadorno
---
 lib/install.js      | 12 ++++++------
 test/lib/install.js |  6 ++++--
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/install.js b/lib/install.js
index 54ea6d8251051..d3f11983df918 100644
--- a/lib/install.js
+++ b/lib/install.js
@@ -126,15 +126,15 @@ class Install extends BaseCommand {
     if (this.npm.config.get('dev'))
       log.warn('install', 'Usage of the `--dev` option is deprecated. Use `--include=dev` instead.')
 
-    const arb = new Arborist({
+    const opts = {
       ...this.npm.flatOptions,
+      auditLevel: null,
       path: where,
-    })
-
-    await arb.reify({
-      ...this.npm.flatOptions,
       add: args,
-    })
+    }
+    const arb = new Arborist(opts)
+    await arb.reify(opts)
+
     if (!args.length && !isGlobalInstall && !ignoreScripts) {
       const scriptShell = this.npm.config.get('script-shell') || undefined
       const scripts = [
diff --git a/test/lib/install.js b/test/lib/install.js
index b44452a69cc6f..619f0bb346984 100644
--- a/test/lib/install.js
+++ b/test/lib/install.js
@@ -32,7 +32,7 @@ test('should install using Arborist', (t) => {
 
   const npm = mockNpm({
     config: { dev: true },
-    flatOptions: { global: false },
+    flatOptions: { global: false, auditLevel: 'low' },
     globalDir: 'path/to/node_modules/',
     prefix: 'foo',
   })
@@ -42,7 +42,9 @@ test('should install using Arborist', (t) => {
     install.exec(['fizzbuzz'], er => {
       if (er)
         throw er
-      t.match(ARB_ARGS, { global: false, path: 'foo' })
+      t.match(ARB_ARGS,
+        { global: false, path: 'foo', auditLevel: null },
+        'Arborist gets correct args and ignores auditLevel')
       t.equal(REIFY_CALLED, true, 'called reify')
       t.strictSame(SCRIPTS, [], 'no scripts when adding dep')
       t.end()