I believe it is a good practice to use the npm ci command when building from your continuous integration pipeline.
https://docs.npmjs.com/cli/v6/commands/npm-ci
My understanding is that one major benefit is that it will fail builds if the package.json does not match the package-lock.json file. This is important when you want to keep track of your dependencies, especially for security audits as well as ensuring you are following license agreements correctly.
This brings me to the second aspect of this feature, which is that we should be using a package-lock file and checking it into our source control. There are messages about this during the build, and it is what is recommended by npm. Currently there does not seem to be any way to tell Electron .NET about a package-lock.json.
I believe the Electron .NET CLI tool, especially the build command, should have a flag to specify using npm ci rather than npm install and we should have an argument similar to /package-json but for the package-lock.json instead. Currently if you pass the package lock into /package-json, the build fails.
I believe it is a good practice to use the
npm cicommand when building from your continuous integration pipeline.https://docs.npmjs.com/cli/v6/commands/npm-ci
My understanding is that one major benefit is that it will fail builds if the package.json does not match the package-lock.json file. This is important when you want to keep track of your dependencies, especially for security audits as well as ensuring you are following license agreements correctly.
This brings me to the second aspect of this feature, which is that we should be using a package-lock file and checking it into our source control. There are messages about this during the build, and it is what is recommended by npm. Currently there does not seem to be any way to tell Electron .NET about a package-lock.json.
I believe the Electron .NET CLI tool, especially the build command, should have a flag to specify using
npm cirather thannpm installand we should have an argument similar to/package-jsonbut for the package-lock.json instead. Currently if you pass the package lock into/package-json, the build fails.