pnpm runs postpublish script of depedency on install

[florianmutter]

pnpm version:

8.6.9

Code to reproduce the issue:

Minimal package json:

{
  "name": "pnpm-test",
  "version": "1.0.0",
  "dependencies": {
    "kameleoon-client-nodejs": "3.3.0"
  }
}

Expected behavior:

pnpm should install the dependency and everything that is needed (including eventsource).

Actual behavior:

pnpm install fails with the following output (empty lines added to make it easier to read):

Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /Users/p306268/Library/pnpm/store/v3
  Virtual store is at:             node_modules/.pnpm

../Library/pnpm/store/v3/tmp/_tmp_74402_02a46952dcbb6cb044a3f4295ec282ce [eventsource@2.0.2]: Running npm-install script, done in 3.9s

Packages: +5
+++++

../Library/pnpm/store/v3/tmp/_tmp_74402_02a46952dcbb6cb044a3f4295ec282ce [eventsource@2.0.2]: Running postpublish script, failed in 10ms
...4402_02a46952dcbb6cb044a3f4295ec282ce postpublish$ git push && git push --tags
│ fatal: not a git repository (or any of the parent directories): .git
└─ Failed in 10ms at /Users/p306268/Library/pnpm/store/v3/tmp/_tmp_74402_02a46952dcbb6cb044a3f4295ec282ce
 ERR_PNPM_PREPARE_PACKAGE  Failed to prepare git-hosted package fetched from "https://codeload.github.com/DmitryAE/js-eventsource/tar.gz/c7faf2cc28cb290424b56d8e44b3a7263bfa5e5d": eventsource@2.0.2 postpublish: `git push && git push --tags`
Exit status 128

Progress: resolved 5, reused 4, downloaded 0, added 0

Seems like pnpm is running the postpublish script of the eventsource package.

Additional information:

• node -v prints: v16.18.0
• Windows, macOS, or Linux?: mac

[zkochan]

Looks like kameleoon-client-nodejs has a git-hosted dependency. Git-hosted dependencies are built, that is why the publish script is executed.

Looks like it works with npm and Yarn, so postpublish should not be executed.