Narzędzia
tooling/one-lockfile
A project has exactly one committed lockfile, and CI installs from it with the frozen command (npm ci, pnpm install --frozen-lockfile).
umiarkowanaręcznefe-tooling
Dlaczego
Two lockfiles (package-lock.json and pnpm-lock.yaml) disagree about versions, so developers, CI and production install different code. A missing lockfile, or a CI install that may update it, lets a new and possibly compromised version slip in between review and deploy.
Poprawka
Keep the lockfile of the package manager in packageManager (or the one the team uses), delete the others, commit it, and install in CI with npm ci, pnpm install --frozen-lockfile, yarn install --immutable or bun install --frozen-lockfile.
Przykłady
# good: CI
corepack enable 2>/dev/null; pnpm install --frozen-lockfileŹródła
Fakty
- Identyfikator
tooling/one-lockfile- Waga
- umiarkowana
- Sprawdzanie
- ręczne ocenia człowiek; raport podaje to jako listę kontrolną
- Dotyczy plików
project- Uczy jej skill
fe-toolingBuild, lint and format tooling- Od wersji
- 0.1.0
Przeczytaj w terminalu
npx github:dawidolko/frontend-skills explain tooling/one-lockfile