Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Removed package-lock.json #2208

Merged
merged 2 commits into from
May 23, 2024
Merged

Conversation

jsumners-nr
Copy link
Contributor

As we discussed prior to stand-up on 2024-05-22, this PR removes the package-lock.json from this repo. Doing so provides:

  1. No more useless Dependabot updates that change items in the lock file: when people npm install newrelic, the lock file does not get consulted and thus none of the Dependabot changes have any affect on our customers.
  2. Easier detection of dependency updates in workflows. This will allows chore: Added updating of docs site with compat table #2205 to be updated in such a fashion that we can detect changes to dependency blocks in package.json so that test suites can be triggered or skipped accordingly. With the lock file in place, this sort of workflow detection will be very difficult.

@@ -45,9 +45,9 @@ jobs:
- name: Install Dependencies
run: |
# Install deps in caller repo
npm ci
npm install
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The only concern I have in this PR is this line. I do not expect any problem as npm install should still install all dependencies. The difference would be if a repo that is reusing this workflow has updates to package.json and not package-lock.json. In that case, npm ci would notice the discrepancy and generate an error. Whereas npm install will install the dependencies as noted by package.json.

@jsumners-nr jsumners-nr marked this pull request as ready for review May 22, 2024 21:11
Copy link
Member

@bizob2828 bizob2828 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should add package-lock.json to .gitignore to be safe. I know you set it in npmignore but wouldn't hurt.

@jsumners-nr
Copy link
Contributor Author

I think we should add package-lock.json to .gitignore to be safe. I know you set it in npmignore but wouldn't hurt.

Good call. Done.

@jsumners-nr jsumners-nr merged commit b267695 into newrelic:main May 23, 2024
26 checks passed
@jsumners-nr jsumners-nr deleted the no-lock branch May 23, 2024 13:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

2 participants