Provide reproducible installation method

[njam]

The current installation procedure is:

npm install netlify-cli -g

This command will install the latest version of netlify-cli and the latest compatible versions of all dependencies. At the moment there are 293 NPM packages installed when installing this tool.

There's a high chance that at any given moment there's a problem/bug with one of those modules, and thus netlify-cli will fail. For using this tool in CI that's a big problem.

It would be nice if you would provide an official way to install this tool in a reproducible manner.
For example provide an official docker image? wdyt?

[bcomnes]

There is supposed to be a package-lock.json in the published module, however now that I am looking it looks like it isn't getting published with the module. It is my understanding that publishing with that file provides a deterministic install strategy for all dependencies. I'll get that added in today. I'll close this issue once I get that out.

The backstory to this issue: oclif originally used a shrinkwrap file for deterministic installs, but switched over to package-lock.json files at some point. This repo was migrated from shrinkwrap to lock files at some point but it looks like the files field in the package.json was overlooked. Thanks for bringing it to my attention!

While npm install -g is convenient for most of the web dev crowd, I agree offering additional avenues to install the tool via conventional system package managers and/or a docker image would also be nice for those not interested in wading into the npm ecosystem. Utilizing some kind of bundling strategy or pkg or something would like be involved in this process. I would personally like to see this explored as the tool matures and expands more this year. I'll open a new issue with my ideas and link from here if you are interested in following along.

[bcomnes]

My mistake, lock files aren't published. Ill add the shrinkwrap step back to the build.

[njam]

I don't know much about shrinkwrap and package-lock for published NPM packages.
But agree, if there's a way to have specific set of dependencies installed for a specific version of this tool, then that's a good solution!

[bcomnes]

For anyone curious:

• See https://docs.npmjs.com/cli/shrinkwrap.html for a short explanation.
• Even more info: https://medium.com/coinmonks/everything-you-wanted-to-know-about-package-lock-json-b81911aa8ab8

[bcomnes]

This should be complete now.

[njam]

Nice, thanks!