Merge pull request #568 from docker/sec-cli/npm-ci-20260612-184913

fix: replace npm install with npm ci (20260612-184913)
fix: use lockfile-aware install commands
2026-07-04 04:02:51 +08:00 · 2026-06-12 14:10:56 -05:00 · 2026-06-12 18:49:15 +00:00
1 changed files with 1 additions and 1 deletions
--- a/dev.Dockerfile
+++ b/dev.Dockerfile
@ -17,7 +17,7 @@ FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
-  yarn install && mkdir /vendor && cp yarn.lock /vendor
+  yarn install --immutable && mkdir /vendor && cp yarn.lock /vendor

 FROM scratch AS vendor-update
 COPY --from=deps /vendor /
Author	SHA1	Message	Date
temenuzhka-thede	c887d9748d	Merge pull request #568 from docker/sec-cli/npm-ci-20260612-184913 Some checks failed ci / buildkitd-config (push) Has been cancelled Details ci / buildkitd-config-inline (push) Has been cancelled Details ci / with-qemu (, all) (push) Has been cancelled Details ci / with-qemu (, arm64,riscv64,arm) (push) Has been cancelled Details ci / with-qemu (v0.9.1, all) (push) Has been cancelled Details ci / with-qemu (v0.9.1, arm64,riscv64,arm) (push) Has been cancelled Details ci / build-ref (cb185f095fd3d9444e0aa605d3789e9e05f2a1e7) (push) Has been cancelled Details ci / build-ref (master) (push) Has been cancelled Details ci / build-ref (refs/pull/731/head) (push) Has been cancelled Details ci / build-ref (refs/tags/v0.5.1) (push) Has been cancelled Details ci / standalone-cmd (push) Has been cancelled Details ci / standalone-action (push) Has been cancelled Details ci / append (push) Has been cancelled Details ci / platforms (push) Has been cancelled Details ci / docker-context (push) Has been cancelled Details ci / cleanup (false) (push) Has been cancelled Details ci / cleanup (true) (push) Has been cancelled Details ci / k3s (latest) (push) Has been cancelled Details ci / k3s (v0.10.5) (push) Has been cancelled Details ci / k3s (v0.11.0) (push) Has been cancelled Details ci / cache-binary (false) (push) Has been cancelled Details ci / cache-binary (true) (push) Has been cancelled Details ci / windows-error (push) Has been cancelled Details ci / keep-state (push) Has been cancelled Details ci / keep-state-error (push) Has been cancelled Details codeql / analyze (push) Has been cancelled Details test / test (push) Has been cancelled Details validate / prepare (push) Has been cancelled Details zizmor / zizmor (push) Has been cancelled Details validate / validate (push) Has been cancelled Details fix: replace npm install with npm ci (20260612-184913)	2026-06-12 14:10:56 -05:00
securityeng-bot[bot]	cfdae34ead	fix: use lockfile-aware install commands	2026-06-12 18:49:15 +00:00