fix(mama): always remove ./node_modules/.bin from integrity hash (#513)

Author: fraxken

.changeset/violet-trains-argue.md

@@ -0,0 +1,5 @@
+---
+"@nodesecure/mama": patch
+---
+
+Always remove ./bin/node_modules from hash integrity

workspaces/mama/src/utils/integrity-hash.ts

@@ -56,9 +56,7 @@ export function packageJSONIntegrityHash(
      * Note: NPM registry automatically add `./node_modules/.bin/` to scripts
      * This artifact do not concern raw scripts in the tarball package.json.
      */
-    scripts: isFromRemoteRegistry ?
-      removeNodeModulesBin(scripts) :
-      scripts
+    scripts: removeNodeModulesBin(scripts)
   };
 
   return {

workspaces/mama/test/packageJSONIntegrityHash.spec.ts

@@ -50,16 +50,18 @@ describe("packageJSONIntegrityHash", () => {
   });
 
   test("Given a script with an instance of './node_modules/.bin/'", () => {
-    const { object } = packageJSONIntegrityHash({
-      ...kMinimalPackageJSON,
-      scripts: {
-        test: "./node_modules/.bin/istanbul cover ./node_modules/tape/bin/tape ./test/integration/*.js"
-      }
-    }, { isFromRemoteRegistry: true });
+    for (const arg of [undefined, { isFromRemoteRegistry: true }]) {
+      const { object } = packageJSONIntegrityHash({
+        ...kMinimalPackageJSON,
+        scripts: {
+          test: "./node_modules/.bin/istanbul cover ./node_modules/tape/bin/tape ./test/integration/*.js"
+        }
+      }, arg);
 
-    assert.strictEqual(
-      object.scripts.test,
-      "istanbul cover ./node_modules/tape/bin/tape ./test/integration/*.js"
-    );
+      assert.strictEqual(
+        object.scripts.test,
+        "istanbul cover ./node_modules/tape/bin/tape ./test/integration/*.js"
+      );
+    }
   });
 });