Assets from paths outside the project end up the the wrong place

[h4de5]

Type of Issue

[] Bug Report
[x] Feature Request

(I'll file this as feature request, as I am not sure if this is done intentially or if I am doing something wrong.)

Description

I am trying to publish a single library from an nx monorepo workspace. In the published package I want to include files from outside the library folder. my ng-package.json looks like this:

{
  "$schema": "../../../node_modules/ng-packagr/ng-package.schema.json",
  "dest": "../../../dist/libs/development-kits/widget",
  "lib": {
    "entryFile": "src/index.ts",
  },
  "assets": [
    "../../../HOWTO-*.md"
  ]
}

this HOWTO files are found and copied to the dist folder, but not in the correct output path for this library. so instead of placing it at: dist/libs/development-kits/widget/HOWTO-x.md it ends up at: dist/HOWTO-x.md which does not help during packaging.

How To Reproduce

to reproduce I took the sample integration and add another asset from another folder e.g.: https://github.com/ng-packagr/ng-packagr/blob/master/integration/samples/embed-assets/ng-package.json

{
  "$schema": "../../../src/ng-package.schema.json",
  "assets": ["./assets/**/*.png", "./assets-2", "../../README.md"],
  "lib": {
    "entryFile": "public_api.ts",
    "cssUrl": "inline"
  }
}

README.md does not end up in the targeted output path, but above.

Expected Behaviour

It would be ok to have them placed at the output path defined in the build settings. Alternatively it would be great to have more options like:

"assets": ["./assets/**/*.png", "./assets-2", "../../README.md": "docs/README.md"],

Version Information

$ node_modules/.bin/ng-packagr --version
ng-packagr:            12.2.3
@angular/compiler:     12.2.9
rollup:                2.58.0
typescript:            4.3.5

[SchnWalter]

This should either be closed as won't fix or we should just throw an explicit error when a file outside the project root is included in the list. If we allow files outside the root, how will we handle them? Will we allow the current project source code to be included, what about things from ../../../etc/passwd?

And we should check if the assets actually exists, I've tried this config and the build was successful and there were no warnings:

# jq .assets src/ng-package.json 
[
  "../../etc/passwd",
  "../../../etc/passwd",
  "../../../../etc/passwd",
  "../../../../../etc/passwd"
]

# npx ng-packagr --version
ng-packagr:            13.1.2
@angular/compiler:     13.1.1
rollup:                2.63.0
typescript:            4.5.4

P.S. You can always add a symbolic link. Have you tried that? Is it working properly?