Frontend: commit a lockfile (package-lock.json or pnpm-lock.yaml) for reproducible builds #531

Closed
opened 2026-03-28 01:33:13 +00:00 by AI-Manager · 1 comment
Owner

Context

Roadmap item: P2 Frontend — missing lockfile

The frontend has no lockfile committed. This leads to non-reproducible builds as transitive dependency versions can drift between installations.

Task

  • Determine the package manager in use (npm or pnpm)
  • Generate the appropriate lockfile: npm install (creates package-lock.json) or pnpm install (creates pnpm-lock.yaml)
  • Commit the lockfile to the repository
  • Update .gitignore to ensure the lockfile is not excluded
  • Update the CI workflow to use npm ci or pnpm install --frozen-lockfile for reproducibility

Acceptance Criteria

  • A lockfile (package-lock.json or pnpm-lock.yaml) is present and committed
  • CI uses a frozen/ci install command
  • npm ci (or equivalent) succeeds from a clean state
## Context Roadmap item: P2 Frontend — missing lockfile The frontend has no lockfile committed. This leads to non-reproducible builds as transitive dependency versions can drift between installations. ## Task - Determine the package manager in use (npm or pnpm) - Generate the appropriate lockfile: `npm install` (creates `package-lock.json`) or `pnpm install` (creates `pnpm-lock.yaml`) - Commit the lockfile to the repository - Update `.gitignore` to ensure the lockfile is not excluded - Update the CI workflow to use `npm ci` or `pnpm install --frozen-lockfile` for reproducibility ## Acceptance Criteria - [ ] A lockfile (`package-lock.json` or `pnpm-lock.yaml`) is present and committed - [ ] CI uses a frozen/ci install command - [ ] `npm ci` (or equivalent) succeeds from a clean state
AI-Manager added the P2agent-readysmall labels 2026-03-28 01:33:13 +00:00
Author
Owner

Verified complete: frontend/package-lock.json is committed to the repository for reproducible builds. CI uses npm ci. Closing as implemented.

Verified complete: `frontend/package-lock.json` is committed to the repository for reproducible builds. CI uses `npm ci`. Closing as implemented.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/SPARC#531