[Bug?]: disabled enableScripts setting still triggers postinstall script

[JuliusHenke]

Self-service

• I'd be willing to implement a fix

Describe the bug

Disabling the enableScripts setting does not seem to have an effect on the postinstall script defined in package.json. I am experiencing the same behaviour both with yarn install and yarn workspaces focus -A --production.
Setting enableScripts=false in .yarnrc.yml or YARN_ENABLE_SCRIPTS=false as an environment variable still triggers the postinstall script after an install.

To reproduce

const {promises: {writeFile}, existsSync} = require(`fs`);

await packageJson({
  scripts: {
    postinstall: `touch should-not-exist.txt`,
  }
})
await yarn("config", "set", "enableScripts", "false")
await yarn("install")

expect(await existsSync(`should-not-exist.txt`)).toBe(false);

Environment

System:
    OS: macOS 12.5
    CPU: (10) arm64 Apple M1 Pro
  Binaries:
    Node: 16.15.0 - /private/var/folders/h8/hjlmyjyn6s12t1t0sx5v0fc00000gp/T/xfs-72b90306/node
    Yarn: 4.0.0-rc.14.dev - /private/var/folders/h8/hjlmyjyn6s12t1t0sx5v0fc00000gp/T/xfs-72b90306/yarn
    npm: 8.5.5 - /usr/local/bin/npm

Additional context

This has also been reported in #4386 and #4547.

Btw: I could not use the suggested Playgrond instance for Sherlock, since it threw CORS network errors and did not execute my code. So I reproduced the issue with Sherlock locally.

[arcanis]

enableScripts has no effect for workspaces, which are assumed to be safe. I'll open a PR to reflect that in the documentation.

[JuliusHenke]

Ok, thanks for the clarification!
I think a config option like enableLocalScripts or a CLI option for yarn install/yarn workspaces focus to disable the local scripts in a workspace would still be useful for CI purposes.

My current use case: disabling the postinstall script to not install a git hooks manager, when building a Docker image with yarn