fix(ci): should not use package-lock config

ruyadorno · ruyadorno · commit c0519edc16f6 · 2022-02-03T14:25:08.000-05:00
`npm ci` should never be affected by the `package-lock` config. Fixes: #4185
diff --git a/docs/content/using-npm/config.md b/docs/content/using-npm/config.md
@@ -1190,6 +1190,8 @@ When package package-locks are disabled, automatic pruning of extraneous
 modules will also be disabled. To remove extraneous modules with
 package-locks disabled use `npm prune`.
 
+This configuration does not affect `npm ci`.
+
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
diff --git a/lib/commands/ci.js b/lib/commands/ci.js
@@ -38,6 +38,7 @@ class CI extends ArboristWorkspaceCmd {
     const where = this.npm.prefix
     const opts = {
       ...this.npm.flatOptions,
+      packageLock: true, // npm ci should never skip lock files
       path: where,
       log,
       save: false, // npm ci should never modify the lockfile or package.json
diff --git a/lib/utils/config/definitions.js b/lib/utils/config/definitions.js
@@ -1417,6 +1417,8 @@ define('package-lock', {
     When package package-locks are disabled, automatic pruning of extraneous
     modules will also be disabled.  To remove extraneous modules with
     package-locks disabled use \`npm prune\`.
+
+    This configuration does not affect \`npm ci\`.
   `,
   flatten: (key, obj, flatOptions) => {
     flatten(key, obj, flatOptions)
diff --git a/tap-snapshots/test/lib/utils/config/definitions.js.test.cjs b/tap-snapshots/test/lib/utils/config/definitions.js.test.cjs
@@ -1271,6 +1271,8 @@ will also prevent _writing_ \`package-lock.json\` if \`save\` is true.
 When package package-locks are disabled, automatic pruning of extraneous
 modules will also be disabled. To remove extraneous modules with
 package-locks disabled use \`npm prune\`.
+
+This configuration does not affect \`npm ci\`.
 `
 
 exports[`test/lib/utils/config/definitions.js TAP > config description for package-lock-only 1`] = `
diff --git a/tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs b/tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs
@@ -1064,6 +1064,8 @@ When package package-locks are disabled, automatic pruning of extraneous
 modules will also be disabled. To remove extraneous modules with
 package-locks disabled use \`npm prune\`.
 
+This configuration does not affect \`npm ci\`.
+
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
diff --git a/test/lib/commands/ci.js b/test/lib/commands/ci.js
@@ -232,7 +232,7 @@ t.test('should throw ECIGLOBAL', async t => {
 })
 
 t.test('should remove existing node_modules before installing', async t => {
-  t.plan(2)
+  t.plan(3)
   const testDir = t.testdir({
     node_modules: {
       'some-file': 'some contents',
@@ -245,6 +245,7 @@ t.test('should remove existing node_modules before installing', async t => {
     '@npmcli/arborist': function () {
       this.loadVirtual = () => Promise.resolve(true)
       this.reify = async (options) => {
+        t.equal(options.packageLock, true, 'npm ci should never ignore lock')
         t.equal(options.save, false, 'npm ci should never save')
         // check if node_modules was removed before reifying
         const contents = await readdir(testDir)

Original file line number	Diff line number	Diff line change
@@ -1271,6 +1271,8 @@ will also prevent _writing_ \`package-lock.json\` if \`save\` is true.
`1271`	`1271`	`When package package-locks are disabled, automatic pruning of extraneous`
`1272`	`1272`	`modules will also be disabled. To remove extraneous modules with`
`1273`	`1273`	package-locks disabled use \`npm prune\`.
	`1274`	`+`
	`1275`	+This configuration does not affect \`npm ci\`.
`1274`	`1276`	`
`1275`	`1277`
`1276`	`1278`	exports[`test/lib/utils/config/definitions.js TAP > config description for package-lock-only 1`] = `