5 ms·
If you can't get reproducible builds the team doesn't know how to use lock files properly. Don't go blaming it on the stack.
by kabes 5y ago
If you can't get reproducible builds the team doesn't know how to use lock files properly. Don't go blaming it on the stack.
- xcambar 5y agoWhat's your workflow with lock files? Do you force them in CI/prod only or also in dev? I'm tempted to enforce lockfiles at every stage of the product cycle, making upgrades an explicit action, rather than the side-effect/byproduct of another action. Does it make sense? What do you think?
- TheAceOfHearts 5y agoLockfiles get commited to the repo and used everywhere to avoid version differences. Upgrade dependencies as needed and have everyone reinstall when they change. I'm amazed anyone wouldn't do this, it's the only sensible course of action.
- xcambar 5y agoSome things go without saying, yet go better with saying.
- kabes 5y agoBasically what TheAceOfHearts said. Always use them everywhere, except when explicitly upgrading dependencies. It's also much faster to do a 'npm ci' than an 'npm i'