`yarn pack` includes unexpected files with a negative expression in `files` of package.json

[eunjae-lee]

Bug description

Command

yarn pack

What is the current behavior?

When files of package.json includes a negative expression, yarn pack includes unexpected files (I guess the whole directory).

What is the expected behavior?

It should include only what it's supposed to include. The output is different from npm pack.

Steps to Reproduce

1. git clone [email protected]:eunjae-lee/yarn-pack-issue.git
2. Run touch .env && yarn pack
3. You will see this-file-should-not-be-packed.js and .env are included in the tgz file.

What is worse is that .env is in .gitignore. (It's the same even if it's also included in .npmignore.)

4. If you remove the line 8 of package.json which is "!**/__tests__/**",
5. then run again yarn pack
6. This time, it doesn't include this-file-should-not-be-packed.js or .env.

Environment

• Node Version: 12.18.0
• Yarn v1 Version: 1.16.0 and 1.22.5
• OS and version: macOS 10.15.3

Related Issues

• https://github.com/yarnpkg/yarn/issues/5779
• https://github.com/yarnpkg/yarn/issues/7391

[nicklozon]

It seems yarn is matching all files against all matchers, but only files that match on positive matchers should be compared against negative matchers and then omitted.

[wcandillon]

is there a way to have the files property handled exactly the same way than on npm?

[stevebaxter]

This is completely broken, caught me when moving from npm to yarn.