Preserve delegated native build detection

Constraint: Maintainer pointed out install scripts can delegate to other package scripts.
Rejected: Only scan preinstall/install/postinstall bodies | Misses install scripts that call build scripts using node-gyp.
Confidence: high
Scope-risk: narrow
Directive: Keep test-only node-gyp references ignored unless an install lifecycle script makes package scripts reachable during install.
Tested: corepack yarn jest packages/plugin-npm/tests/NpmSemverResolver.test.ts --runInBand; corepack yarn jest packages/plugin-npm/tests --runInBand; corepack yarn test:lint; corepack yarn constraints; corepack yarn version check; corepack yarn dedupe --check; corepack yarn typecheck:all; YARN_ENABLE_HARDENED_MODE=1 corepack yarn install --immutable --immutable-cache; git diff --check.
Not-tested: Netlify docs build, already failing on upstream master for an unrelated schema example issue.

Author: ychampion

packages/plugin-npm/sources/NpmSemverResolver.ts

@@ -11,7 +11,7 @@ import * as npmHttpUtils
 
 const NODE_GYP_IDENT = structUtils.makeIdent(null, `node-gyp`);
 const NODE_GYP_MATCH = /\b(node-gyp|prebuild-install)\b/;
-const NODE_GYP_BUILD_SCRIPTS = [`preinstall`, `install`, `postinstall`];
+const NODE_GYP_INSTALL_SCRIPTS = [`preinstall`, `install`, `postinstall`];
 
 export class NpmSemverResolver implements Resolver {
   supportsDescriptor(descriptor: Descriptor, opts: MinimalResolveOptions) {
@@ -153,12 +153,15 @@ export class NpmSemverResolver implements Resolver {
     // Manually add node-gyp dependency if there is a script using it and not already set
     // This is because the npm registry will automatically add a `node-gyp rebuild` install script
     // in the metadata if there is not already an install script and a binding.gyp file exists.
-    // Also, node-gyp is not always set as a dependency in packages, so it will also be added if used in build scripts.
-    if (!manifest.dependencies.has(NODE_GYP_IDENT.identHash) && !manifest.peerDependencies.has(NODE_GYP_IDENT.identHash)) {
-      for (const scriptName of NODE_GYP_BUILD_SCRIPTS) {
-        const value = manifest.scripts.get(scriptName);
-
-        if (typeof value !== `undefined` && NODE_GYP_MATCH.test(value)) {
+    // Also, node-gyp is not always set as a dependency in packages, so it will also be added
+    // if used in package scripts that may be reached from an install lifecycle script.
+    if (
+      !manifest.dependencies.has(NODE_GYP_IDENT.identHash) &&
+      !manifest.peerDependencies.has(NODE_GYP_IDENT.identHash) &&
+      NODE_GYP_INSTALL_SCRIPTS.some(scriptName => manifest.scripts.has(scriptName))
+    ) {
+      for (const value of manifest.scripts.values()) {
+        if (NODE_GYP_MATCH.test(value)) {
           manifest.dependencies.set(NODE_GYP_IDENT.identHash, structUtils.makeDescriptor(NODE_GYP_IDENT, `latest`));
           break;
         }

packages/plugin-npm/tests/NpmSemverResolver.test.ts

@@ -83,5 +83,19 @@ describe(`NpmSemverResolver`, () => {
 
       expect(pkg.dependencies.has(nodeGypIdent.identHash)).toEqual(true);
     });
+
+    it(`should inject node-gyp when an install script delegates to another script using it`, async () => {
+      mockPackageMetadata({
+        build: `node-gyp rebuild`,
+        install: `yarn build`,
+      });
+
+      const resolver = new NpmSemverResolver();
+      const locator = structUtils.makeLocator(ident, `npm:1.0.0`);
+
+      const pkg = await resolver.resolve(locator, makeResolveOptions());
+
+      expect(pkg.dependencies.has(nodeGypIdent.identHash)).toEqual(true);
+    });
   });
 });