Stop using npm-install in CI. Use npm-ci instead #18773
Labels
area/qe
kind/task
Internal things, technical debt, and to-do tasks to be performed.
severity/P1
Has a major impact to usage or development of the system.
Milestone
Is your task related to a problem? Please describe.
We are currently using
npm install
in lot of places in our testing pipelines & docker image build of e2e-tests image.This is not safe, as npm install could produce different dependency tree each time (for example when new version of some dependency is published) [1].
For sake of reproducible builds&tests we should use
npm-ci
which doesn't compute new dependency tree, but instead of that just reproduces the dependency tree from package-lock.json.Documentation:
[1] https://stackoverflow.com/a/56254478/2556329
Describe the solution you'd like
We should not use
npm install
in any of our testing pipelines and build scripts.npm install
should be used only for local development and if upversioning of any dependency is needed, package-lock.json needs to be updated.The text was updated successfully, but these errors were encountered: