npm ci results in modified package-lock.json

[stevejpurves]

Describe the problem

npm ci is modifying our package-lock.json, locally and on ci even though this is not documented behavior.

This causes our lint test on CI to fail.

Steps to reproduce.

• checkout thebe master branch
• git status shows no local mods
• npm ci
• git status shows package-lock.json as modified

Link to your repository or website

No response

Provide steps to reproduce

• checkout thebe master branch
• git status shows no local mods
• npm ci
• git status shows package-lock.json as modified

Describe your environment.

• node 15
• npm 7

The version of Python you're using

3.7

Your operating system

macos

Versions of your packages

No response

Additional context

No response

[stevejpurves]

SO can't find a bug on the npm repo about this, but some others are experiencing it and it's clearly a problem here.

We have 2 options:

• remove the git diff step from lint. This only catches this bug in npm! it does not stop someone from unintentionally updating dependencies anyway.
• or move to yarn as package manager over npm. yarn is better and more robust and an easy upgrade.

I've use yarn consistently for years over npm and would say it's pretty standard, it would require updates to the docs, CI workflows and a single additional global install for people who don't already have it

I'd recommend the second option, which should just solve this and we can move on :) cc @moorepants @choldgraf @minrk

[moorepants]

I've experienced this behavior too. It's not clear to me why package-lock.json is ever modified. I thought the purpose of lock files was to stay static unless you explicitly want it changed.

We can remove the git diff command, but I'd couldn't ever determine why it was there in the first place. What was the intended purpose of that command? As you imply, it was just to catch the npm bug?

yarn is fine with me too. We use yarn on our other js packages and I haven't had any issues.

[choldgraf]

We use yarn in the other JS packages of ebp, I believe, so I'm +1 on using yarn just for the sake of standardizing if anything else