| ▲ | sigotirandolas 4 days ago |
| Not the parent, but the default `npm install` / `yarn install` builds will ignore the lock file unless everything can be satisfied, if you want the lock file to be respected you must use `npm ci` / `yarn install --frozen-lockfile`. In my experience, it's common for CI pipelines to be misconfigured in this way, and for Node developers to misunderstand what the lock file is for. |
|
| ▲ | 0cf8612b2e1e 4 days ago | parent | next [-] |
| Not a web guy, but that seems a bonkers default. I would have naively assumed a lockfile would be used unless explicitly ignored. |
| |
| ▲ | metafunctor 4 days ago | parent | next [-] | | Welcome to the web side. Everything’s bonkers. Hard-earned software engineering truths get tossed out, because hey, wtf, I’ll just do some stuff and yippee. Feels like everyone’s stuck at year three of software engineering, and every three years the people get swapped out. | | |
| ▲ | jiggawatts 4 days ago | parent | next [-] | | > every three years the people get swapped out That's because they are being "replaced", in a sense! When an industry doubles every 5 years like web dev was for a long time, that by the mathematical definition means that the average developer has 5 years or less experience. Sure, the old guard eventually get to 10 or 15 years of experience, but they're simply outnumbered by an exponentially growing influx of total neophytes. Hence the childish attitude and behaviour with everything to do with JavaScript. | | |
| ▲ | metafunctor 4 days ago | parent [-] | | Good point! The web is going through its own endless September. And so, it seems, is everything else. Perhaps, this commentary adds no value — just old man yells at cloud stuff. |
| |
| ▲ | anonymars 3 days ago | parent | prev [-] | | The web saw "worse is better" and said "hold my beer" |
| |
| ▲ | Already__Taken 4 days ago | parent | prev [-] | | We didn't get locking until npm v5 (some memory and googling, could be wrong.) And it took a long time to do everything you'd think you want. Changing the main command `npm install` after 7 years isn't really "stable". Anyway didn't this replace versions, so locking won't have helped either? | | |
| ▲ | minitech 3 days ago | parent | next [-] | | You can’t replace existing versions on npm. (But probably more important is what @jffry mentioned – yes, lockfiles include hashes.) | |
| ▲ | jffry 3 days ago | parent | prev [-] | | > Anyway didn't this replace versions, so locking won't have helped either? The lockfile includes a hash of the tarball, doesn't it? | | |
|
|
|
| ▲ | DDerTyp 4 days ago | parent | prev | next [-] |
| TIL: I need to fix my CI pipeline. Gonna create a jira ticket I guess… Thank you! |
| |
| ▲ | josefbud 4 days ago | parent [-] | | Sorry, I had assumed this was what you were doing when I wrote my question but I should have specified. And sorry for now making your npm install step twice as long! ;) | | |
| ▲ | rimunroe 4 days ago | parent [-] | | npm ci should be much faster in CI as it can install the exact dependency versions directly from the lockfile rather than having to go through the whole dependency resolution algorithm. In CI environments you don't have to wait to delete a potentially large pre-existing node_modules directory since you should be starting fresh each time anyway. | | |
| ▲ | josefbud 4 days ago | parent [-] | | I've seen pipelines that cache node modules between runs to save time, but yeah if they're not doing that then you're totally right. | | |
|
|
|
|
| ▲ | josefbud 4 days ago | parent | prev [-] |
| Yeah, I think I had made the assumption that they were using `npm ci` / `yarn install --frozen-lockfile` / `pnpm install --frozen-lockfile` in CI because that's technically what you're always supposed to do in CI, but I shouldn't have made that assumption. |
