Travis CI currently broken

[nfischer]

Due to a npm change, npm install modifies package-lock.json, which turns bots red (we check for modified files at the end of the script).

Blocking #892, #889, and any other PRs.

[nfischer]

Regression is likely in npm, within the range 5.6.0 (good build) and 6.4.1 (bad build).

[nfischer]

Turns out, the fix is not as simple as committing the new format.

node version	v8.12.0	v9.4.0	v10.4.0
npm version	6.4.1	5.6.0	6.1.0
Accepts master branch?	no	yes	no
Accepts this commit?	yes	no	yes

Might have to remove package-lock.json, or exclude it from this the file-check at the end.

[nfischer]

Or, maybe we can use npm ci instead of npm install on npm v6+

[hutson]

Modifications of package-lock.json by npm install is intentional - npm/npm#21043 (comment)

The recommendation that I hear is to always use npm ci in CI builds to respect the package-lock.json as-is.

[nfischer]

@hbetts thanks for linking to the npm ticket. I figured this is probably intentional. The issue is that we need to conditionally run npm install for npm versions which don't know about npm ci.

It would be nice to just install the newest npm and use that to install dependencies, but I think shelljs supports a wider range of node versions than npm.

One way to detect support (since I forget which version introduced it) would be:

$ npm help | egrep '\bci\b'

[hutson]

For what it's worth, npm ci was added in version 5.7.0. I also finally found their Node support policy.

Though, I'm curious, even if you check for the existence of ci, how could the lock file changing issue get resolved on those versions of npm without ci?

[nfischer]

how could the lock file changing issue get resolved on those versions of npm without ci?

Basic algorithm is:

Check npm version
 - if >= 5.7, use `npm ci`
 - else, use `npm install`

In the else-case, I don't expect npm install to change the package-lock. In the if-case, I expect (1) npm ci understands the package-lock, and (2) npm ci understands the package-lock in its format.

I still need to verify these assumptions, however.

[nfischer]

Reopening because #896 is flaking on appveyor. Trying a different approach instead.

[nfischer]

#911 flakes as well, which makes me suspect ci-or-install works correctly (although is perhaps overly complicated), and it's appveyor which causes the flakiness.