fix: honour package.pattern over internally set exclusion list

[codingnuclei]

Hey,

This PR enables the package.pattern to behave such that the user has the final say over what files are packaged.

Currently a list of predefined files are always excluded from the final zip, which is not great from a flexibility point of view #315

serverless-esbuild/src/pack.ts

Line 38 in a233a1a

const excludedFilesDefault = ['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'package.json'];

Further more currently the files returned from the pattern glob are added to an include list...

serverless-esbuild/src/pack.ts

Line 171 in a233a1a

const includedFiles = [...packageFiles, ...functionFiles];

... so although I may have used a glob like !**/*.md, those files will still be included into the final zip as the filterFilesForZipPackage will return true for any file that does not meet an exclusion criteria.

Taking the view that what is defined in both package.pattern and function.pattern as what files the user wants then we can remove files as needed.

Let me know what you think :)

Considerations:

• Some perf improvements should be seen in larger repos as one use of globby has been removed.
• The glob search is ordered, so that a user can override the excludedFilesDefault.
• To keep this a none breaking change - the package.json is still being excluded by default. Users will manually have to include it via patterns. In the future this could be reversed.

[OlivierCuyp]

@floydspace is there a chance for this PR to be merge ?
I have a logger that takes information from the package.json when instanciating, so that all logs contains the name of the package and its version.
I couldn't understand why, even with the following esbuild config I didn't get the package.json in the lambda:

const copyStaticFiles = require('esbuild-copy-static-files');

module.exports = (serverless) => ({
  bundle: true,
  minify: true,
  format: 'cjs',
  logLevel: 'info',
  platform: 'node',
  sourcemap: true,
  tsconfig: 'tsconfig.json',
  watch: {
    pattern: ['src/**/*.ts'],
    ignore: ['.serverless/**/*', '.build']
  },
  plugins: [
    copyStaticFiles({
      src: './package.json',
      dest: '.esbuild/.build/package.json',
      dereference: true,
      recursive: false
    }),
    copyStaticFiles({
      src: './src/docs',
      dest: '.esbuild/.build/src/docs',
      dereference: true,
      recursive: true
    })
  ]
});

Until I read the code and the felt on this issue...

[OlivierCuyp]

Btw, I'm not event sure why we should exclude any files from the build folder.
All package.* files won't be there except if it is requested by the user...

[paulgalow]

Amazon Inspector can now scan Lambda functions for vulnerabilities. However it looks like it is using package.json and package-lock.json to achieve this for Node.js functions. So having an option to manually include those files in the ZIP artifacts to be deployed would be really useful.