Add an eslint rule to forbid adding devDependencies in packages

[simison]

If adding devDependencies to package.json in packages/apps can cause trouble (see e.g. #32383), we'll need an Eslint rule to stop folks doing this.

Monorepo docs say:

The only exception are devDependencies which must be declared in the wp-calypso root package.json. devDependencies of sub-packages in a monorepo are not reliably installed and cannot be relied on.

Note also conflicting import/no-extraneous-dependencies rule in packages (#32294 (comment))

FYI @Automattic/team-calypso

[griffbrad]

I'll give this a shot. Looks like the no-extraneous-dependencies rule is actually a decent model for what we need.

[stale]

This issue has been marked as stale and will be closed in seven days. This happened because:

• It has been inactive in the past 9 months.
• It isn't a project or a milestone, and hasn’t been labeled `[Pri] Blocker`, `[Pri] High`, `[Status] Keep Open`, or `OSS Citizen`.

You can keep the issue open by adding a comment. If you do, please provide additional context and explain why you’d like it to remain open. You can also close the issue yourself — if you do, please add a brief explanation.

[blowery]

I think we're still working on this. Should be made easier / proper by #38190

[jsnajdr]

Big part of this issue was solved in #36534 by @simison himself when he added the npm-package-json-lint linter and enabled its prefer-no-devDependencies rule. But the config still allows adding dev depenencies to the apps/*/package.json files.

I pushed a commit to #38190 (its sha is ae80bab as I write this, but will change after the next rebase) that modifies the linter config to allow dev dependencies only in the root package.json.

[scinos]

The original issue was raised when we were using lerna + npm. Since then we have moved to yarn and reduced our usage of lerna.

I do think having packages with devDependencies is a good thing and helps having a sane dependency tree without a bloated root package and packages relying on undeclared dependencies.

I'm closing this for now, if anybody has strong opinions about it we can revisit.