Running postinstall scripts and including changes in Renovate commits

[breadadams]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

Is there any existing way for Renovate to include all (or specific) changed files in the commit? For example those generated by the postinstall script of a package it's updating.

Our use case is that we're using msw in a project where we use Renovate, and it has a postinstall script that generates (or updates if it already exists) a file that we track in git. When Renovate updates this dependency the PR doesn't include that file, however if you check out the branch and run npm install for example, the changes appear of course.

I've seen the ignoreScripts config option, and I've tried setting it to false - however there doesn't appear to be any difference. I'm also not entirely sure if that setting is for self-hosted since it mentions the allowScripts option in the docs - even though it's listed in the "Repository" settings (instead of the self-hosted page).

Logs (if relevant)

No response

[rarkins]

You must be self-hosted to enable scripts. Install scripts are a security risk (open source packages can steal credentials or install back doors with them)

[breadadams]

Thanks @rarkins, good point.

We've resolved this by setting up a GH workflow for PRs opened by Renovate, that simply runs yarn install and commits any changed files.