Skip to content
This repository has been archived by the owner on Oct 9, 2023. It is now read-only.

Update recommendations for lockfiles #25

Merged
merged 28 commits into from Jul 13, 2022
Merged

Update recommendations for lockfiles #25

Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
c8a9d3b
Update lockfile description
laurentsimon Jun 28, 2022
f2e06a8
update
laurentsimon Jun 28, 2022
ed3eaf1
update
laurentsimon Jun 28, 2022
cc5c654
update
laurentsimon Jun 28, 2022
5d9d5fc
update
laurentsimon Jun 28, 2022
8b81f9c
Update review/npm.md
laurentsimon Jun 28, 2022
2fd0659
Update review/npm.md
laurentsimon Jun 28, 2022
ce3c62f
Update review/npm.md
laurentsimon Jun 28, 2022
a19a020
update
laurentsimon Jun 28, 2022
9cca608
Update review/npm.md
laurentsimon Jun 28, 2022
d014ad6
update
laurentsimon Jun 28, 2022
1db3592
update
laurentsimon Jun 28, 2022
46ec483
update
laurentsimon Jun 28, 2022
7908deb
Update review/npm.md
laurentsimon Jun 28, 2022
e8253af
Update review/npm.md
laurentsimon Jun 28, 2022
1ee1de4
update
laurentsimon Jun 28, 2022
6d8eb0e
update
laurentsimon Jun 28, 2022
238630e
Update review/npm.md
laurentsimon Jun 28, 2022
5bb7a87
comments
laurentsimon Jun 28, 2022
ecff088
update
laurentsimon Jun 28, 2022
575b376
update
laurentsimon Jul 1, 2022
0d5e822
update
laurentsimon Jul 1, 2022
893832d
update
laurentsimon Jul 1, 2022
044fc7f
update
laurentsimon Jul 1, 2022
425571e
update
laurentsimon Jul 1, 2022
a47c8be
update
laurentsimon Jul 1, 2022
7ce831f
update
laurentsimon Jul 1, 2022
42663ca
update
laurentsimon Jul 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 7 additions & 3 deletions review/npm.md
View file
Open in desktop
Expand Up @@ -287,7 +287,7 @@ unpinned dependencies and update the lockfiles:
being installed at build-time in your CI or otherwise automated environment.

1. Developers should declare and commit a lockfile for ***all*** their
projects. The reasoning is that this lockfile will provide of
projects. The reasoning is that this lockfile will provide the benefits of
[Reproducible installation](#reproducible-installation)
by default for privileged environments (project developers' machines,
CI, production or other environments with access to sensitive data,
Expand All @@ -309,9 +309,13 @@ unpinned dependencies and update the lockfiles:
calculator](https://semver.npmjs.com/) to help you define the ranges.

1. The lockfile `package-lock.json` ***should*** be ignored for tests running in CI
(e.g. via `npm install --no-package-lock`). The reasoning is that developers should
(e.g. via `npm install --no-package-lock`). The reasoning is that CI tests should
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to be fair tho, this is also true for developers, despite the (relatively small) risk to their local machines.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't entirely disagree. I think developers will do in practice regardless of what we say (e.g. when troubleshooting/repdoducing a problem). I think the intention is to raise awareness and encourage users to run these non-locked tests in CI/less-privileged env when possible.

Let me know if you think we should change it or if this is acceptable as-is.

exercise a wide range of dependency versions in order to discover / fix problems
before their users do, so tests need to pull the latest versions of packages.
before the library users do, so tests need to pull the latest versions of packages.

1. Locally, developers should only run npm commands that treat the lockfile as
read-only (see [Lockfiles and commands](#lockfiles-and-commands)), except
when intentionally adding /removing a dependency.

1. Follow the principle of least privilege in your [CI configuration](#ci-configuration).
This is particularly important since the lockfile is ignored.
Expand Down