Install devDependencies by default

bin/compile

@@ -211,6 +211,17 @@ cache_build() {
 header "Caching build"
 cache_build | output "$LOG_FILE"
 
+prune_devdependencies() {
+  if $YARN; then
+    yarn_prune_devdependencies "$BUILD_DIR"
+  else
+    npm_prune_devdependencies "$BUILD_DIR"
+  fi
+}
+
+header "Pruning devDependencies"
+prune_devdependencies | output "$LOG_FILE"
+
 summarize_build() {
   if $NODE_VERBOSE; then
     list_dependencies "$BUILD_DIR"

lib/dependencies.sh

@@ -87,14 +87,34 @@ log_build_scripts() {
 
 yarn_node_modules() {
   local build_dir=${1:-}
+  local production=${YARN_PRODUCTION:-false}
 
   echo "Installing node modules (yarn.lock)"
   cd "$build_dir"
-  yarn install --frozen-lockfile --ignore-engines 2>&1
+  yarn install --production=$production --frozen-lockfile --ignore-engines 2>&1
+}
+
+yarn_prune_devdependencies() {
+  local build_dir=${1:-} 
+
+  if [ $NODE_ENV == "test" ]; then
+    echo "Skipping because NODE_ENV is 'test'"
+    return 0
+  elif [ $NODE_ENV != "production" ]; then
+    echo "Skipping because NODE_ENV is not 'production'"
+    return 0
+  elif [ -n "$YARN_PRODUCTION" ] && [ "$YARN_PRODUCTION" != "true" ]; then
+    echo "Skipping because YARN_PRODUCTION is not 'true'"
+    return 0
+  else 
+    cd "$build_dir" 
+    yarn install --frozen-lockfile --ignore-engines --ignore-scripts --prefer-offline 2>&1
+  fi
 }
 
 npm_node_modules() {
   local build_dir=${1:-}
+  local production=${NPM_CONFIG_PRODUCTION:-false}
 
   if [ -e $build_dir/package.json ]; then
     cd $build_dir
@@ -106,14 +126,15 @@ npm_node_modules() {
     else
       echo "Installing node modules (package.json)"
     fi
-    npm install --unsafe-perm --userconfig $build_dir/.npmrc 2>&1
+    npm install --production=$production --unsafe-perm --userconfig $build_dir/.npmrc 2>&1
   else
     echo "Skipping (no package.json)"
   fi
 }
 
 npm_rebuild() {
   local build_dir=${1:-}
+  local production=${NPM_CONFIG_PRODUCTION:-false}
 
   if [ -e $build_dir/package.json ]; then
     cd $build_dir
@@ -124,8 +145,32 @@ npm_rebuild() {
     else
       echo "Installing any new modules (package.json)"
     fi
-    npm install --unsafe-perm --userconfig $build_dir/.npmrc 2>&1
+    npm install --production=$production --unsafe-perm --userconfig $build_dir/.npmrc 2>&1
   else
     echo "Skipping (no package.json)"
   fi
 }
+
+npm_prune_devdependencies() {
+  local build_dir=${1:-} 
+  local npm_version=$(npm --version)
+
+  if [ $NODE_ENV == "test" ]; then
+    echo "Skipping because NODE_ENV is 'test'"
+    return 0
+  elif [ $NODE_ENV != "production" ]; then
+    echo "Skipping because NODE_ENV is not 'production'"
+    return 0
+  elif [ -n "$NPM_CONFIG_PRODUCTION" ] && [ "$NPM_CONFIG_PRODUCTION" != "true" ]; then
+    echo "Skipping because NPM_CONFIG_PRODUCTION is not 'true'"
+    return 0
+  elif [ $npm_version == "5.3.0" ]; then
+    mcount "skip-prune-issue-npm-5.3.0"
+    echo "Skipping because npm 5.3.0 fails when running 'npm prune' due to a known issue"
+    echo "https://github.com/npm/npm/issues/17781"
+    return 0
+  else
+    cd "$build_dir" 
+    npm prune --userconfig $build_dir/.npmrc 2>&1
+  fi
+}

lib/environment.sh

@@ -16,7 +16,6 @@ platform="$os-$cpu"
 export JQ="$BP_DIR/vendor/jq-$os"
 
 create_default_env() {
-  export NPM_CONFIG_PRODUCTION=${NPM_CONFIG_PRODUCTION:-true}
   export NPM_CONFIG_LOGLEVEL=${NPM_CONFIG_LOGLEVEL:-error}
   export NODE_MODULES_CACHE=${NODE_MODULES_CACHE:-true}
   export NODE_ENV=${NODE_ENV:-production}
@@ -68,7 +67,7 @@ write_ci_profile() {
   local bp_dir="$1"
   local build_dir="$2"
   write_profile "$1" "$2"
-  cp $bp_dir/ci-profile/* $build_dir/.profile.d/ 
+  cp $bp_dir/ci-profile/* $build_dir/.profile.d/
 }
 
 write_export() {

lib/failure.sh

@@ -122,8 +122,7 @@ fail_yarn_outdated() {
   local log_file="$1"
   local yarn_engine=$(read_json "$BUILD_DIR/package.json" ".engines.yarn")
 
-  if grep -qi 'error: unknown option .--frozen-lockfile' "$log_file"; then
-    echo "ran"
+  if grep -qi 'error .install. has been replaced with .add. to add new dependencies' "$log_file"; then
     mcount "failures.outdated-yarn"
     echo ""
     warn "Outdated Yarn version: $yarn_engine

test/fixtures/ci-dependencies-yarn/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "node-buildpack-test-app",
+  "version": "0.0.1",
+  "description": "node buildpack integration test app",
+  "repository": {
+    "type": "git",
+    "url": "http://github.com/example/example.git"
+  },
+  "dependencies": {
+    "hashish": "*"
+  },
+  "license": "MIT",
+  "engines": {
+    "yarn": "1.4.0"
+  },
+  "devDependencies": {
+    "lodash": "^2.4.1"
+  },
+  "scripts": {
+    "test": "ls node_modules"
+  }
+}

test/fixtures/ci-dependencies-yarn/yarn.lock

@@ -0,0 +1,17 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+hashish@*:
+  version "0.0.4"
+  resolved "https://registry.yarnpkg.com/hashish/-/hashish-0.0.4.tgz#6d60bc6ffaf711b6afd60e426d077988014e6554"
+  dependencies:
+    traverse ">=0.2.4"
+
+lodash@^2.4.1:
+  version "2.4.2"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-2.4.2.tgz#fadd834b9683073da179b3eae6d9c0d15053f73e"
+
+traverse@>=0.2.4:
+  version "0.6.6"
+  resolved "https://registry.yarnpkg.com/traverse/-/traverse-0.6.6.tgz#cbdf560fd7b9af632502fed40f918c157ea97137"

test/fixtures/ci-dependencies/README.md

@@ -0,0 +1 @@
+A fake README, to keep npm from polluting stderr.

test/fixtures/dev-dependencies/package.json → test/fixtures/ci-dependencies/package.json

@@ -10,9 +10,12 @@
     "hashish": "*"
   },
   "engines": {
-    "node": "~0.10.0"
+    "node": "8.x"
   },
   "devDependencies": {
     "lodash": "^2.4.1"
+  },
+  "scripts": {
+    "test": "ls node_modules"
   }
 }

test/fixtures/dependencies-modules-checked-in-with-devdependencies/README.md

@@ -0,0 +1 @@
+A fake README, to keep npm from polluting stderr.