`npm ci` instead of `npm install`

[KristjanESPERANTO]

What do you think about switching from npm install to npm ci?

I’m not an npm/node expert, but my understanding is that there could be some advantages.

If we use npm ci, we’ll get reliable builds. Users who install a release get exactly the versions that worked on the release.

[bugsounet]

@KristjanESPERANTO :

Hi, many developer don’t know what is package.json file
in your case, this command need package-lock.json (auto generated by npm install or by developer)
Many, many modules are not maintened, i don’t think it’s very usable (maybe module need some new system tools before this command)

[KristjanESPERANTO]

many developer don’t know what is package.json file

Isn’t that one of the first things you learn when you start using npm? :-)

this command need package-lock.json

Yes, of course. And the core system has the package-lock.json. I was not talking about modules. Sorry if that was not clear.

[sdetweil]

@kristjanesperanto said in `npm ci` instead of `npm install`:

Isn’t that one of the first things you learn when you start using npm?

no. I hadn’t heard about packages on til at least a year after I had written my first module.

[karsten13]

@kristjanesperanto

I used npm ci for a while. Because the package-lock.json format changed meanwhile I had problems with npm ci --no-optional with node 14, so I switched back to npm install.

But main point is you don’t get needed updates, e.g. we had in October an electron update because of invalid certs, in this case you had to use npm install.

As this is no direct part of the code we could update the documentation and explain both variants but I would prefer npm install as the default variant. Everyone who knows the difference can use what he wants.

[sdetweil]

@karsten13 I use npm install in the installer and updater for all these reasons

[karsten13]

@sdetweil

yes, and AFAIK you are using npm install --only=prod. This is may a thing to be mentioned in the docs because 99% of the users don’t need the dev dependencies …

[sdetweil]

@karsten13 right

but that is not ci

[KristjanESPERANTO]

Okay, thanks for your opinions. I’ll use npm ci for a while with my instances to gain more experience.

I mark this thread as solved for now. Further opinions are of course welcome.