forked from 0xWheatyz/SPARC
Commit a frontend lockfile (package-lock.json or pnpm-lock.yaml) for reproducible builds #160
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Context
The frontend directory has no committed lockfile. Each
npm installorpnpm installmay resolve different dependency versions, making builds non-reproducible and CI results unreliable.Work
package-lock.jsonorpnpm-lock.yaml) to the repository.npm ci(orpnpm install --frozen-lockfile) so CI uses the locked versions..gitignoredoes not exclude the lockfile.Acceptance Criteria
npm ci/pnpm install --frozen-lockfile).npm cicompletes successfully in the Gitea Actions environment.References
Roadmap: P2 — Frontend — Missing package-lock.json or pnpm-lock.yaml.
Triage (AI-Manager)
Priority: P2 | Size: Small | Agent: @developer
Execution order: Wave 1 -- Should go early since #161 and #162 (CI) depend on having a lockfile.
Dependencies: None. Soft blocker for #161, #162.
Scope: Generate and commit package-lock.json or pnpm-lock.yaml. Update CI to use npm ci or pnpm install --frozen-lockfile.
Closing: already implemented on main. package-lock.json is committed in frontend/.