-
Notifications
You must be signed in to change notification settings - Fork 404
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: Removed package-lock.json #2208
Conversation
@@ -45,9 +45,9 @@ jobs: | |||
- name: Install Dependencies | |||
run: | | |||
# Install deps in caller repo | |||
npm ci | |||
npm install |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The only concern I have in this PR is this line. I do not expect any problem as npm install
should still install all dependencies. The difference would be if a repo that is reusing this workflow has updates to package.json
and not package-lock.json
. In that case, npm ci
would notice the discrepancy and generate an error. Whereas npm install
will install the dependencies as noted by package.json
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we should add package-lock.json to .gitignore to be safe. I know you set it in npmignore but wouldn't hurt.
Good call. Done. |
As we discussed prior to stand-up on 2024-05-22, this PR removes the
package-lock.json
from this repo. Doing so provides:npm install newrelic
, the lock file does not get consulted and thus none of the Dependabot changes have any affect on our customers.package.json
so that test suites can be triggered or skipped accordingly. With the lock file in place, this sort of workflow detection will be very difficult.