[Bug]: lifecycle script triggering despite enableScripts=false

[legobeat]

Self-service

• I'd be willing to implement a fix

Describe the bug

It seems that for dependencies which themselves contain a yarn v1 lockfile, the enableScripts configuration value is ignored and lifecycle scripts are run regardless.

To reproduce

(Aside: The sherlock link in the GH template is 404ing)

• Set enableScripts: false in .yarnrc.yaml
• Add package with yarn v1 yarn.lock to dependencies
• Run yarn install

A reproduction PR on a minimal repo is available. As can be seen in the GitHub Actions workflow output from the yarn install step, the dependency preinstall and postinstall lifecycle scripts are triggered as part of the Resolution step.

Environment

System:
    OS: Linux 6.8 Debian GNU/Linux 12 (bookworm) 12 (bookworm)
    CPU: (10) x64 12th Gen Intel(R) Core(TM)
  Binaries:
    Node: 20.12.2 - /tmp/xfs-a3ccc8fc/node
    Yarn: 4.1.1 - /tmp/xfs-a3ccc8fc/yarn
    npm: 10.5.0 - /usr/local/bin/npm

Additional context

• Similar-looking but different: [Bug?]: disabled enableScripts setting still triggers postinstall script #4780
• Related: [Bug?]: Yarn 4 cannot install the packages from github #6240
• Addressing in fix: propagate --ignore-scripts to yarn v1 dependency bootstrap if enableScripts=false #6259

[legobeat]

@arcanis @merceyz PTAL