fix: Fix attribution generation

Fix the `attribution:generate` command by ensuring that it is possible
to install just production dependencies.

Previously the command `yarn workspaces focus --production` (used to
discard development dependencies, keeping just production dependencies
installed) would fail because `rimraf` was not found. `rimraf` was a
development dependency used in the `postinstall` script. This was
resolved by replacing `rimraf` with a Node.js script that does the
same thing without needing any dependency.

Once that failure was resolved, another was revealed. The
`allow-scripts` step of the installation began failing because there
was a package detected that had an install script that was missing from
our configuration. This package was in our configuration already, but
the `allow-scripts` configuration is sensitive to changes in the
directory structure of `node_modules`, and that structure changed due
to differences in which packages were hoisted in the production-only
install.

That failure was resolved by updating `generate-attributions.sh` to
remove the `allow-scripts` plugin while generating attributions. We
don't need `postinstall` scripts to run in order to read licences from
disk.

Fixes #28412

development/clear-webpack-cache.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs/promises');
+const path = require('node:path');
+
+const WEBPACK_CACHE_DIRECTORY = path.resolve(
+  __dirname,
+  '..',
+  'node_modules',
+  '.cache',
+  'webpack',
+);
+
+/**
+ * Clear the Webpack cache.
+ *
+ * This is typically run in the `postinstall` npm/Yarn lifecycle script.
+ */
+async function main() {
+  await fs.rm(WEBPACK_CACHE_DIRECTORY, { force: true, recursive: true });
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

development/generate-attributions.sh

@@ -27,6 +27,13 @@ main() {
   # relative to the project root irrespective of where this script was run.
   cd "${PROJECT_DIRECTORY}"
 
+  # Remove allow-scripts plugin.
+  # Allow-scripts won't run correctly after a production-only install because the configuration
+  # includes exact paths to each dependency, and those paths can change in a production-only
+  # install because of the hoisting algorithm.
+  # We don't need postinstall scripts to run in order to generate attributions anyway.
+  yarn plugin remove @yarnpkg/plugin-allow-scripts
+
   # Instruct Yarn to only install production dependencies
   yarn workspaces focus --production
 
@@ -38,7 +45,9 @@ main() {
 
   # Check if the script is running in a CI environment (GitHub Actions sets the CI variable to true)
   if [ -z "${CI:-}" ]; then
-    # If not running in CI, restore development dependencies
+    # If not running in CI, restore the allow-scripts plugin and development dependencies.
+    cd "${PROJECT_DIRECTORY}"
+    git checkout -- .yarnrc.yml .yarn
     yarn
   fi
 }

package.json

@@ -8,7 +8,7 @@
   },
   "scripts": {
     "webpack": "tsx ./development/webpack/launch.ts",
-    "webpack:clearcache": "rimraf node_modules/.cache/webpack",
+    "webpack:clearcache": "./development/clear-webpack-cache.js",
     "postinstall": "yarn webpack:clearcache",
     "env:e2e": "SEGMENT_HOST='https://api.segment.io' SEGMENT_WRITE_KEY='FAKE' yarn",
     "start": "yarn build:dev dev --apply-lavamoat=false --snow=false",