This repository was archived by the owner on Oct 5, 2022. It is now read-only.
build switch to npm ci recreate lockfile #32
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 3 commits
August 27, 2020 18:18
we used npm in our github actions ci pipeline but yarn in dev this does prevent reproducible builds furthermore we now can use npm ci in CI
Merged
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We are using yarn in development according to the lockfile in the repository but our CI uses npm.
Therefore we don't get reproducible installs and builds and all the good things that lockfiles have been invested for.
Therefore I switched to npm and recreated a new lockfile for npm.
Now it is also possible to use
npm ciinstead ofnpm iin our github-action CI.This will only work, if we stay with one package manager and make use of the lockfile.
There's some weird formatting in the yaml and I couldn't run the actions locally, only validated the yaml.
Wouldn't hurt if there's a second pair of eyes that checks it.