forked from 0xWheatyz/SPARC
Frontend: commit a lockfile (package-lock.json or pnpm-lock.yaml) for reproducible builds #531
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Context
Roadmap item: P2 Frontend — missing lockfile
The frontend has no lockfile committed. This leads to non-reproducible builds as transitive dependency versions can drift between installations.
Task
npm install(createspackage-lock.json) orpnpm install(createspnpm-lock.yaml).gitignoreto ensure the lockfile is not excludednpm ciorpnpm install --frozen-lockfilefor reproducibilityAcceptance Criteria
package-lock.jsonorpnpm-lock.yaml) is present and committednpm ci(or equivalent) succeeds from a clean stateVerified complete:
frontend/package-lock.jsonis committed to the repository for reproducible builds. CI usesnpm ci. Closing as implemented.