fix: warn message on engine mismatch

[ruyadorno]

Overview

Messages for mismatching engine fields are not printed to users currently, contrary to the documented behavior, this PR fixes it by making sure that warning messages from packages containing mismatch engines are actually printed at WARN level for users of the cli.

✏️ Changes

• Fixed setting engine check warnings to each package
• Added proper catching of package warnings during validation phase
• Added tap test that validates print of engine warn msgs

🔗 References

• Bug report: https://npm.community/t/engines-and-engines-strict-ignored/4792
• Documented behavior: https://docs.npmjs.com/files/package.json#engines

📸 Screenshots

Before

After

🔍 Testing

Manual testing

1. Setup a package with some invalid engines.node value, eg:

{
  "name": "engine-module",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "engines": {
    "node": ">=100"
  }
}

2. Try to install from it, eg: npm install ./engine-module
3. Should be able to observer WARN messages of type notsup

Automated testing

• unit test at test/tap/validate-tree-check-warnings.js checking that package warnings are correctly collected to top level tree
• integration test at test/tap/check-engine-reqs.js validating that warning messages are printed to users upon npm install

✅ This change has unit test coverage
✅ This change has integration test coverage

🔥 Rollback

If we observe something wrong with this change in production, how should we respond?

This can be reverted at any time

[ruyadorno]

@npm/cli-team pushed a new implementation that uses the top tree instead:

• pros: less disruptive, needs less lines of code and it’s closer to the original intent there
• cons: had to change the signature of the isInstallable method from lib/install/validate-args.js in order to pass in a tree reference
• cons: one of the place that consumes isInstallable doesn’t seem to have a tree reference (lib/install/actions.js) but I made sure the implementation is resilient to that (will just ignore warnings as it did before)

those are the cons that made me steer away from this implementation originally but seeing the unexpected behavior (such as saving metadata) from using the manifest package I’m seeing this as a safer option now 😊 would be nice to have your insight