ci: take package-lock into account in devcontainer (#5278)

Consider package-lock.json when building the dev-container so we can
enforce a known-working dependency chain. This caused issues in the past
when commitlint and release-please had bugs in new versions  that
impacted our build pipeline.

.github/dependabot.yml

@@ -9,73 +9,84 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    open-pull-requests-limit: 100
 
   - package-ecosystem: github-actions
     commit-message:
       prefix: "deps(github-actions)"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "npm"
     commit-message:
       prefix: "deps(npm)"
     directory: "/dependencies"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "bundler"
     commit-message:
       prefix: "deps(bundler)"
     directory: "/dependencies"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "docker"
     commit-message:
       prefix: "deps(docker)"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "pip"
     commit-message:
       prefix: "deps(python)"
     directory: "/dependencies/python/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "gradle"
     commit-message:
       prefix: "deps(java)"
     directory: "/dependencies/checkstyle"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "gradle"
     commit-message:
       prefix: "deps(java)"
     directory: "/dependencies/google-java-format"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "gradle"
     commit-message:
       prefix: "deps(java)"
     directory: "/dependencies/ktlint"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "docker"
     commit-message:
       prefix: "deps(dev-docker)"
     directory: "/dev-dependencies"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100
 
   - package-ecosystem: "npm"
     commit-message:
       prefix: "deps(dev-npm)"
     directory: "/dev-dependencies"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 100

dev-dependencies/Dockerfile

@@ -7,16 +7,16 @@ RUN apt-get update \
   jq \
   && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /app
+ENV APP_DIR=/app
+WORKDIR "${APP_DIR}"
 
-COPY package.json ./
+COPY package.json package-lock.json ./
 
-ENV NPM_PACKAGES_FILE_PATH="npm-packages.txt"
+RUN npm ci \
+  && rm -rf ~/.npm
 
-RUN jq '.dependencies | to_entries[] | select(.key | startswith("@commitlint/")) | .key + "@" + .value' package.json >> "${NPM_PACKAGES_FILE_PATH}" \
-  && jq '.dependencies | to_entries[] | select(.key | startswith("release-please")) | .key + "@" + .value' package.json >> "${NPM_PACKAGES_FILE_PATH}" \
-  && xargs npm install -g < "${NPM_PACKAGES_FILE_PATH}" \
-  && rm package.json "${NPM_PACKAGES_FILE_PATH}"
+ENV NODE_PATH="${APP_DIR}/node_modules"
+ENV PATH="${NODE_PATH}/.bin:${PATH}"
 
 # Split this from the previous RUN instruction so we can cache the costly installation step
 # hadolint ignore=DL3059