[BUG] "files" package.json property no longer takes precedence over .gitignore when publishing

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm v8 (and v7) ignores the files property of package.json when publishing, and follows the .gitignore, which takes precedence. In npm v6 and below this wasn't the case.

This breaks certain build workflows that utilized files and npm 6

Expected Behavior

Precedence of files property should stay the same.

Steps To Reproduce

I have a directory with a .gitignore'd lib/:

~/test-module
❯ tree
.
├── lib
│   └── file
└── package.json

❯ cat .gitignore
lib

My package.json contains "files": ["*"] to include the lib/ in the tarball:

❯ cat package.json | grep files
  "files": ["*"],

publishing with npm@6 includes the lib/ as expected:

❯  npx npm@6 publish --dry-run
npm notice
npm notice 📦  test-module@1.0.0
npm notice === Tarball Contents ===
npm notice 4B   .gitignore
npm notice 0    lib/file
npm notice 243B package.json

Publishing with npm@7 and npm@8 does not:

❯  npx npm@8 publish --dry-run
npm notice
npm notice 📦  test-module@1.0.0
npm notice === Tarball Contents ===
npm notice 4B   .gitignore
npm notice 243B package.json


❯  npx npm@7 publish --dry-run
npm notice
npm notice 📦  test-module@1.0.0
npm notice === Tarball Contents ===
npm notice 4B   .gitignore
npm notice 243B package.json

Environment

• npm: 8.1.2
• Node.js: v16.13.2
• OS Name: Darwin Kernel Version 21.3.0 / Mac OS 12.2