Pin Vega and related dependencies on Dockerfile

[0x2b3bfa0]

Detected by users on Discord

• Closes Installing unpinned vega-lite package breaks Node 12 support setup-cml#40 for containers

[casperdcl]

wouldn't it be better to run some tests with the docker images after building but before pushing?

[0x2b3bfa0]

wouldn't it be better to run some tests with the docker images after building but before pushing?

Doesn't look precisely easy/trivial/maintainable/beautiful, but I definitely see the value of running the test suite on the built containers before pushing them.

[casperdcl]

https://github.com/docker/build-push-action/blob/master/docs/advanced/test-before-push.md

would've prevented #726 too

[0x2b3bfa0]

Definitely! If our package can test itself after being installed (turtles all the way down), it would be nice to have this kind of test.

[0x2b3bfa0]

🔔 @iterative/cml, it would be nice to expedite the approval of this pull request.

[casperdcl]

• Installing unpinned vega-lite package breaks Node 12 support setup-cml#40 was closed so what issue does this PR solve?
• why aren't these deps included in package.json?

[0x2b3bfa0]

Installing unpinned vega-lite package breaks Node 12 support setup-cml#40 was closed so what issue does this PR solve?

• Installing unpinned vega-lite package breaks Node 12 support setup-cml#40 was closed prematurely, before we even noticed that the very same issue affected both our setup-cml GitHub Action and all of our container images.

• Pin Vega and related dependencies on Dockerfile #720 solves the issue for container images, and Pin manually installed packages to major versions setup-cml#41 solved the same issue for the GitHub Action.

I have linked both pull requests to the same issue because they cover exactly the same issue, and I can't link pull requests to cross–repository issues without a closing keyword.

why aren't these deps included in package.json?

It looks like we're on the same page: iterative/setup-cml#47 (comment). As far as I can tell, those dependencies are “optional” and only required to run commands like vl2svg in workflows.