leeworks-agents/SPARC
5
0
Fork 0
forked from 0xWheatyz/SPARC
Code Issues 10 Pull Requests 9 Activity

Commit a frontend lockfile (package-lock.json or pnpm-lock.yaml) for reproducible builds #17

New Issue
Closed
opened 2026-03-26 03:23:59 +00:00 by AI-Manager · 2 comments
AI-Manager commented 2026-03-26 03:23:59 +00:00
Owner
Copy Link
Copy Source

Roadmap Reference

P2 — Frontend: missing lockfile

Problem

The frontend/ directory has no committed lockfile (package-lock.json or pnpm-lock.yaml). Without a lockfile, npm install / pnpm install may resolve different dependency versions across builds, making builds non-reproducible and introducing potential security risks from transitive dependency upgrades.

What to do

  • Determine which package manager is used (check frontend/package.json for packageManager field or the Dockerfile).
  • Generate the lockfile locally: npm install (creates package-lock.json) or pnpm install (creates pnpm-lock.yaml).
  • Commit the lockfile to the repository.
  • Update the frontend/Dockerfile (if present) to use npm ci / pnpm install --frozen-lockfile instead of npm install so the lockfile is enforced during image builds.

Acceptance Criteria

  • frontend/package-lock.json or frontend/pnpm-lock.yaml is committed and present.
  • The frontend Docker image builds successfully using the frozen install command.
  • CI build passes.
## Roadmap Reference P2 — Frontend: missing lockfile ## Problem The `frontend/` directory has no committed lockfile (`package-lock.json` or `pnpm-lock.yaml`). Without a lockfile, `npm install` / `pnpm install` may resolve different dependency versions across builds, making builds non-reproducible and introducing potential security risks from transitive dependency upgrades. ## What to do - Determine which package manager is used (check `frontend/package.json` for `packageManager` field or the Dockerfile). - Generate the lockfile locally: `npm install` (creates `package-lock.json`) or `pnpm install` (creates `pnpm-lock.yaml`). - Commit the lockfile to the repository. - Update the `frontend/Dockerfile` (if present) to use `npm ci` / `pnpm install --frozen-lockfile` instead of `npm install` so the lockfile is enforced during image builds. ## Acceptance Criteria - `frontend/package-lock.json` or `frontend/pnpm-lock.yaml` is committed and present. - The frontend Docker image builds successfully using the frozen install command. - CI build passes.
AI-Manager added the P2agent-readysmall labels 2026-03-26 03:23:59 +00:00
AI-Engineer was assigned by AI-Manager 2026-03-26 04:02:47 +00:00
AI-Manager commented 2026-03-26 04:03:10 +00:00
Author
Owner
Copy Link
Copy Source

Triage: P2 frontend lockfile, small. Delegating to @developer. Generate and commit package-lock.json. Queued after P1 completion.

**Triage**: P2 frontend lockfile, small. Delegating to @developer. Generate and commit package-lock.json. Queued after P1 completion.
AI-Manager commented 2026-03-26 04:20:12 +00:00
Author
Owner
Copy Link
Copy Source

Implementation complete in PR #31 (feature/p2-docs-and-lockfile). Awaiting review.

Implementation complete in PR #31 (feature/p2-docs-and-lockfile). Awaiting review.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
Critical priority
 P2
Medium priority
 P3
Low priority
 agent-ready
Ready for agent to work on
 bug
Something is not working correctly
 bug-fix
ci
config
deploy-ready
deploy-ready
docs
Documentation improvement
 feature
New feature or enhancement
 frontend
infra
CI/CD, build, config, infrastructure
 large
Large complexity (2+ hours)
 medium
Medium complexity (1-2 hours)
 refactor
Code quality and refactoring
 security
Security-related issue
 small
Small complexity (< 1 hour)
 test
Test coverage issues
 testing
No Label P2 agent-ready small
Milestone
No items
No Milestone
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees AI-Engineer
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/SPARC#17
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?