deno cache --lock dep.ts writes to lockfile even without --lock-write

[fnune]

deno 1.40.5 (release, x86_64-unknown-linux-gnu)
v8 12.1.285.27
typescript 5.3.3

Expected behavior

When I run deno cache --lock deps.ts, the lockfile is checked, but never written to, as specified by deno cache --help:

 ~/Development/warden.nvim => deno cache --help | grep lock
      --lock [<FILE>]
          Check the specified lock file.
          If value is not provided, defaults to "deno.lock" in the current working directory.
      --lock-write
          Force overwriting the lock file.

If the lockfile does not check, the command exits with code 1, otherwise 0.

Two things imply the expected behavior:

• The existence of --lock-write (why does --lock-write exist if --lock also writes?)
• The documentation saying that lock "Check(s) the specified lock file" (checking does not imply writing)

Actual behavior

• Running deno cache --lock deps.ts actually writes to the lockfile if the dependencies have changed
• It works differently from --lock-write: it appends to the entries, whereas --lock-write rewrites the file completely

Here is an example resulting diff from running deno cache --lock deps.ts in my project after changing the version of a dependency (I did not add a new dependency):

@@ -3,6 +3,7 @@
   "remote": {
     "https://deno.land/x/denops_core@v6.0.5/denops.ts": "ef651e49a74f4b70fa02b6405211e904e94bb6652f7bc2499f802226295b50bb",
     "https://deno.land/x/denops_core@v6.0.5/mod.ts": "a1e6a5d202687a2bda4f630ee590de36a0e3d4b1a019b74833656db66838c675",
+    "https://deno.land/x/denops_std@v6.0.0/mod.ts": "c98131cc01c9c7fd1e600ee2b28f6e6377edbfee0366e6d3a22b2a3750f070f6",
     "https://deno.land/x/denops_std@v6.0.1/mod.ts": "c56d0d066e7ce7db8735f091f35f806b1f20b3c72aaca0e18a7f8762750a505e"
   }
 }

Screencast.from.2024-02-22.13-24-49.webm

Why is this a problem

• I can't use deno cache --lock deps.ts as a way to check in CI or in a pre-commit hook whether my dependencies are still resolving to the same thing
• The behavior of appending to the lockfile when a dependency changes its version is undefined as far as the documentation (and deno cache --help) indicates

[dsherret]

This is expected. Deno's going to have a --frozen-lockfile flag/config option in the future to get the behaviour, if I understand correctly, you've described.

Follow #18296 and #24167 for updates.