[Bug]: "bazel run @nodejs//:npx_bin" should run Bazel's provided Node binary

[fasiha]

What happened?

When I run

bazel run @nodejs//:npx_bin -- jest

I expect the invoked npx to launch the same Node that Bazel provides (i.e., this Node: bazel run @nodejs//:node).

However, the above command actually will happily run against any random node it finds on my PATH because external/nodejs_linux_amd64/bin/nodejs/lib/node_modules/npm/bin/npx-cli.js starts with:

#!/usr/bin/env node

Therefore, I can't reliably use Bazel's npx.

Version

Development (host) and target OS/architectures: Rocky9 Linux (no target, just JavaScript)

Output of bazel --version: bazel 6.4.0

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file: We're using https://github.com/aspect-build/rules_js/releases/download/v1.30.0/rules_js-v1.30.0.tar.gz

Language(s) and/or frameworks involved: JavaScript, Node.js, and npx

How to reproduce

To reproduce, we need either (1) a system-wide install of Node.js that's a different version as the Node provided by Bazel, or (2) no system-wide Node installed.

Then, run

bazel run @nodejs//:npx_bin -- node-version-audit

This package will report your system-wide install of Node, equivalent to just running npx node-version-audit and calling the system-wide npx.

It will not report the version of Node that Bazel is using.

Any other information?

Apologies if I've miscategorized this by marking it as a bug instead of a feature request 🙇 I think the current behavior of //:npx_bin is wrong but maybe it's not quite a bug 😅.

This was discussed on Slack.

I can work around this by, instead of running //:npx_bin, running bazel run @nodejs//:npm exec. There are some subtle differences between npx and npm exec but the latter guarantees that npm's packaged Node runs the command.