fix: use npm ci instead of npm install in Docker and deployment configs - #1377
Open
omoh5 wants to merge 2 commits into
Open
fix: use npm ci instead of npm install in Docker and deployment configs#1377omoh5 wants to merge 2 commits into
omoh5 wants to merge 2 commits into
Conversation
Replace npm install with npm ci in backend/Dockerfile (both builder and runner stages), render.yaml, and vercel.json to ensure deterministic, lockfile-pinned dependency installs in production builds. This eliminates the risk of dependency drift between CI-tested and deployed versions. Closes LabsCrypt#1256 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
The backend Dockerfile uses npm ci (from PR LabsCrypt#1256) which requires a package-lock.json. Since this is an npm workspaces monorepo, the lockfile lived only at the root and wasn't available in the backend/ build context. Generated a standalone backend/package-lock.json so npm ci can resolve exact dependency versions in the Docker build. Also added a root .dockerignore for future-proofing. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces
npm installwithnpm ciin all production build/deployment configurations to ensure deterministic, lockfile-pinned dependency installs that match CI.Motivation
Both the backend Docker build (
backend/Dockerfile:14) and the Render.com production build command (render.yaml:8) usednpm install, which can resolve to different dependency versions than what CI tested withnpm ci. For a financial application, this "works in CI, different in prod" dependency drift is a real risk.Changes
backend/Dockerfile:14npm install→npm ci(builder stage)backend/Dockerfile:37npm install --omit=dev --ignore-scripts→npm ci --omit=dev --ignore-scripts(runner stage)render.yaml:8npm install && ...→npm ci && ...(Render build command)vercel.jsoninstallCommand: npm install→installCommand: npm ci(Vercel deploy)Acceptance Criteria
npm cinpm cinpm ciAdditional Notes
vercel.jsonwhich had the samenpm installissue but wasn't mentioned in the original issuenpm ciinstead ofnpm installCloses #1256
🤖 Generated with Codebuff
Co-Authored-By: Codebuff noreply@codebuff.com