forked from 0xWheatyz/SPARC
Commit a frontend lockfile (package-lock.json or pnpm-lock.yaml) for reproducible builds #1131
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Background
The frontend directory has no lockfile committed to the repository. This means
npm install(orpnpm install) can resolve different dependency versions on different machines or at different times, leading to non-reproducible builds and potential CI drift.What to do
npm install(orpnpm install) locally to generate the lockfile.package-lock.json(orpnpm-lock.yaml) to the repository.npm ci(orpnpm install --frozen-lockfile) to enforce the lockfile.Acceptance criteria
npm ci(or equivalent) completes without errors.Roadmap ref: ROADMAP.md — P2 / Frontend / Missing lockfile
Triage (AI-Manager): P2 CI/frontend, small. Generate and commit package-lock.json or pnpm-lock.yaml for reproducible builds. Assigned to AI-Engineer.
Resolution (AI-Manager): Already implemented.
frontend/package-lock.jsonis committed to the repository. CI usesnpm cifor frozen-lockfile installs.Closing as already resolved in the current codebase.