Changeset 62330

Timestamp:

05/08/2026 02:10:59 AM (8 days ago)

Author:

desrosj

Message:

Build/Test Tools: Remove gutenberg:verify script on postinstall.

In [61458], a postinstall script was introduced that ensured the source code from the gutenberg repository was present before attempting to run the build script.

The WordPress.org Hosting Tests surfaced an edge case where the postinstall script was failing when nodevenv is used. Because it serves as a wrapper for Node.js, NPM_CONFIG_PREFIX is set to the virual envirnoment directory and not the actual project source directory.

This removes gutenberg:verify from postinstall entirely. gutenberg:verify is responsible for confirming that the gutenberg directory exists, that the commit SHA value in gutenberg/.gutenberg-hash matches gutenberg.sha in the package.json file, and it downloads a fresh copy if not.

While this will result in the necessary files not being present locally after running npm install, gutenberg:verify is specified as the first task executed when the build and build:dev scripts are run. Running either build script has been a requirement to run WordPress locally for some time now, so this does not introduce a new required step. It simply delays when the built asset will be retrieved from the GitHub Container Registry when necessary.

postinstall scripts should also be avoided entirely due to their significantly insecure nature (see #64543).

Follow up to [61492], [61873], and [62021].

Reviewed by jorbin.
Merges [62321] to the 7.0.

Props jorbin, johnbillion, desrosj.
Fixes #64874. See #64393, #64543.

Location:

branches/7.0

Files:

• . (modified) (1 prop)
• package-lock.json (modified) (1 diff)
• package.json (modified) (1 diff)

branches/7.0/package-lock.json

@@ -8 +8 @@
             "name": "WordPress",
             "version": "7.0.0",
-            "hasInstallScript": true,
             "license": "GPL-2.0-or-later",
             "dependencies": {

branches/7.0/package.json

@@ -114 +114 @@
     },
     "scripts": {
-        "postinstall": "npm run gutenberg:verify",
         "build": "grunt build",
         "build:dev": "grunt build --dev",