fix(config): avoid exporting persistent allow-scripts

workspaces/config/lib/definitions/definitions.js

@@ -271,6 +271,7 @@ const definitions = {
     default: '',
     type: [String, Array],
     hint: '<package-list>',
+    envExport: false,
     description: `
       Comma-separated list of packages whose install-time lifecycle scripts
       (\`preinstall\`, \`install\`, \`postinstall\`, and \`prepare\` for

workspaces/config/test/set-envs.js

@@ -241,3 +241,31 @@ t.test('dont set configs marked as envExport:false', t => {
   t.strictSame(env, { ...extras }, 'not exported, because envExport=false')
   t.end()
 })
+
+t.test('does not export persistent allow-scripts config', t => {
+  const { definitions, defaults } = mockDefinitions(t)
+  const userConf = Object.create(defaults)
+  userConf['allow-scripts'] = 'canvas'
+  const envConf = Object.create(userConf)
+  const cliConf = Object.create(envConf)
+  const env = {}
+  const config = {
+    list: [cliConf, envConf],
+    env,
+    defaults,
+    definitions,
+    execPath,
+    globalPrefix,
+    localPrefix,
+    npmPath,
+    npmBin,
+  }
+
+  setEnvs(config)
+  t.equal(
+    env.npm_config_allow_scripts,
+    undefined,
+    'persistent policy is reloaded instead of exported to lifecycle scripts'
+  )
+  t.end()
+})