[turborepo] prune package-lock.json not stable

[darthmaim]

What version of Turborepo are you using?

1.8.8

What package manager are you using / does the bug impact?

npm

What operating system are you using?

Mac, Windows, docker

Describe the Bug

Running turbo prune --scope=<workspace> --docker multiple times always generates a different package-lock.json.

This causes the docker build to never use the cache to install dependencies.

The keys in the generated JSON have a different order, see for example this screenshot:

This occurs on MacOS, Windows (WSL) and inside the docker build.

Expected Behavior

The generated package-lock.json should be stable to allow docker to cache the build step.

To Reproduce

1. Checkout the reproduction repo
2. Run npx turbo prune --scope=worker --docker to create pruned output
3. Copy out/package-lock.json somewhere…
4. Run npx turbo prune --scope=worker --docker again
5. Compare the newly created package-lock.json with the one from step 2.

The reproduction repo is kinda large, maybe I will create a smaller repro in the coming days.

Reproduction Repo

https://github.com/GW2Treasures/gw2treasures.com/tree/9c86b97ea829b25ee89cc2b28a07ec36b1cd8a0d

[darthmaim]

A workaround is to sort the package-lock.json

-RUN npm i -g turbo
+RUN npm i -g turbo sort-json
 COPY . .
-RUN turbo prune --scope=worker --docker
+RUN turbo prune --scope=worker --docker && sort-json out/package-lock.json

This will ensure the package-lock.json is always the same as long as no dependencies changed and later build stages can be cached.