You can use `npm ci` for "don't update the lockfile, fail if an exact lockfile match can't be collected"