Spago-only lockfile vs. combined Spago + npm lockfile for reproducible PureScript FFI builds

Answer

Treat the npm lockfile as authoritative for JavaScript dependencies and keep it in sync with Spago’s lockfile; this gives deterministic builds for FFI code.

Likely explanation

Spago’s lockfile pins the exact PureScript package set, while an npm lockfile (package‑lock.json or yarn.lock) pins the exact Node modules used by foreign imports. Using both together fixes the two ecosystems simultaneously, preventing version drift between the PureScript code and its FFI‑bound JavaScript.

Confirmed facts

• Spago creates a lockfile (spago.lock or via spago.dhall) that records the precise set and versions resolved by spago install.
• npm (or Yarn) creates package-lock.json/yarn.lock that records the exact versions of all Node modules, including those required by FFI imports.
• When both lockfiles are committed, running npm ci (or yarn install --frozen-lockfile) followed by spago build (without re‑running spago install or npm install) guarantees the same dependency tree on every machine.

Steps for reproducible builds

1. Commit both lockfiles (spago.lock and package-lock.json or yarn.lock) to the repository.
2. In CI (or local dev) run:

   # install exact Node modules
   npm ci        # or: yarn install --frozen-lockfile
   # build PureScript using the already‑installed packages
   spago build   # or spago test, spago bundle, etc.
   

3. Add an automated check that fails if either lockfile changes after a dependency update. For example, a pre‑commit hook or CI step that runs:

   npm install   # updates package-lock.json if needed
   spago install # updates spago.lock if needed
   git diff --exit-code spago.lock package-lock.json
   

   If the diff exits with a non‑zero status, the commit is rejected, forcing the developer to re‑run the lock‑sync steps.

Missing diagnostic detail

Do you already have a CI step that installs dependencies from the lockfiles without re‑solving (i.e., runs npm ci or yarn install --frozen-lockfile)? If not, add that step; otherwise the dual‑lockfile approach is recommended.