build: commit package-lock.json and install with npm ci

.github/workflows/ci.yml

@@ -44,6 +44,7 @@ jobs:
               - 'package.json'
               - '.c8rc.json'
               - '.npmrc'
+              - 'package-lock.json'
               - '.github/workflows/ci.yml'
             core: [*shared, 'core/**']
             fetchindex: [*shared, 'fetchindex/**']
@@ -82,11 +83,11 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
-          # setup-node caches npm when package.json has devEngines, and caching
-          # needs a lockfile, which this repo doesn't keep
+          # no npm cache: npm ci takes seconds, and devEngines in package.json would
+          # otherwise switch one on
           package-manager-cache: false
-      - name: Run npm install
-        run: npm install --workspaces=false
+      - name: Run npm ci
+        run: npm ci --workspaces=false
       - name: Run npm lint
         run: npm run lint
       # npm rejects a provenance publish when repository.url doesn't match the
@@ -119,8 +120,8 @@ jobs:
           node-version: current
           package-manager-cache: false
       # the packages import each other, so link the workspaces
-      - name: Run npm install
-        run: npm install --workspaces --include-workspace-root
+      - name: Run npm ci
+        run: npm ci
       - name: Build the types
         run: npm run types
       - name: Check the committed types match the source
@@ -152,10 +153,8 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           package-manager-cache: false
-      - name: Install most recent npm
-        run: npm install -g npm
-      - name: Run npm install -w ${{ matrix.package }}
-        run: npm install -w "$PACKAGE"
+      - name: Run npm ci -w ${{ matrix.package }}
+        run: npm ci -w "$PACKAGE"
       - name: Run npm run coverage -w ${{ matrix.package }}
         run: npm run coverage -w "$PACKAGE"
 

.github/workflows/docs.yml

@@ -8,6 +8,7 @@ on:
       - 'docs/**'
       - 'doc-kit.config.mjs'
       - 'package.json'
+      - 'package-lock.json'
       # the site shows core's version, which every release bumps
       - 'core/package.json'
       - '.github/workflows/docs.yml'
@@ -39,11 +40,11 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: lts/*
-          # setup-node caches npm when package.json has devEngines, and caching
-          # needs a lockfile, which this repo doesn't keep
+          # no npm cache in a job that deploys the docs, so a poisoned cache can't
+          # reach the site
           package-manager-cache: false
-      - name: Run npm install
-        run: npm install --workspaces=false
+      - name: Run npm ci
+        run: npm ci --workspaces=false
       - name: Build the docs
         run: npm run docs
       - name: Upload the site

.github/workflows/nightly-static-build.yaml

@@ -21,11 +21,11 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: latest
-          # setup-node caches npm when package.json has devEngines, and caching
-          # needs a lockfile, which this repo doesn't keep
+          # no npm cache in a job that opens the data PR, so a poisoned cache can't
+          # reach it
           package-manager-cache: false
-      - name: Run npm install
-        run: npm install --workspaces --include-workspace-root
+      - name: Run npm ci
+        run: npm ci
       - name: Run build:default
         run: npm run build:default -w static
       - name: Run build:releases

.github/workflows/release.yml

@@ -82,10 +82,8 @@ jobs:
   # workspace and uploads the tarballs as a workflow artifact. Manual
   # recovery uses the same path (Run workflow -> pick a `v*` tag).
   #
-  # uppt/pack's own install step refuses to run without a lockfile, and
-  # this repo has none (`.npmrc` sets `package-lock=false`). No published
-  # package has a `prepack` or `prepare` script, so `npm pack` needs no
-  # dependencies: skip the install and only put Node on PATH.
+  # No published package has a `prepack` or `prepare` script, so `npm pack`
+  # needs no dependencies: skip uppt/pack's install and only put Node on PATH.
   pack:
     if: github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest

.npmrc

@@ -1,5 +1,3 @@
-package-lock=false
-
 ## Avoid installing packages published in last 3 days.
 min-release-age=3