Support NPM workspaces in Git dependencies

[kayahr]

(Copied from npm/cli#6253)

Nowadays NPM supports workspaces everywhere but there is one important feature which has currently no workspace support: Git Dependencies. It is not possible to reference a specific NPM workspace in a monorepo with a Git URL.

Let's say I have a monorepo project named math using NPM workspaces to provide the modules math-vector, math-matrix, math-geometry and math-probability. And I have an application project myapp in which I want to install math-matrix and math-geometry via a Git URL. This would look like this:

dependencies: {
    "math-matrix": "git+https://gitserver/path/math#hash",
    "math-geometry": "git+https://gitserver/path/math#hash"
}

The Git URL references the root of the monorepo which is just an empty NPM module so this currently doesn't work. And the same URL is referenced twice so most likely the repo is checked out twice which is unnecssary.

If we assume that the monorepo uses NPM workspaces then NPM can easily know that the checked out project has workspaces and also knows which workspaces are available, how they are named and which NPM modules they produce. And NPM knows the names of the requested NPM modules from the package.json of myapp. So it shouldn't be too hard to install the correct dependencies:

1. Take the first dependency (math-matrix)
2. Checkout the repository defined for this dependency.
3. Check if there are more referenced dependencies with the same Git URL. Now NPM knows that it needs to install math-matrix and math-geometry from the same Git repository.
4. Resolve the package.json files from the workspaces to determine internal dependencies in the monorepo. Lets say math-matrix depends on math-vector in the same monorepo so this must be installed, too. Now NPM knows that it needs to install math-matrix, math-vector and math-geometry.
5. Run npm install and then npm pack for each needed workspace to create the tarballs.
6. Install the tarballs in the referencing myapp.

Wouldn't that be a nice feature for a future NPM version? This could replace very ugly "solutions" found on the internet which involve complicated custom scripting or using specialized Github services like https://gitpkg.vercel.app/

[ARitz-Cracker]

I'm just here to show my support for this. Traversing through a workspace to find the matching package name is exactly how cargo handles git dependencies with mono-repos, and regardless of the personal opinions of the npm team, this would be a very useful feature when handling multiple modules of a privately-maintained project without having to set up and deal with your own verdaccio instance

[ARitz-Cracker]

Alright Mr. "star dependencies are just fine except when I personally feel the consequences of them" @MylesBorins, How is this "resolved" exactly? Needing to have a self-hosted verdaccio instance for private projects is extremely cumbersome, especially when we don't want to manage yet another set of credentials. I understand that verdaccio isn't in your scope of work specifically, but we shouldn't have to use it, and not everyone's is going to be publishing on npmjs.com.

[ljharb]

You need to have a private registry always, for supply chain security and robustness in the event of internet outage, even if you never use any private packages.