Commit the Lockfile, Build with npm ci: A Practical npm Decision
Why committing package-lock.json and building with npm ci is one of the highest-leverage decisions in a JavaScript repo — and where npm install still belongs.
ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Why committing package-lock.json and building with npm ci is one of the highest-leverage decisions in a JavaScript repo — and where npm install still belongs.
Use npm ci for clean, reproducible dependency installs. Learn prerequisites, exact steps, verification, and recovery when the lockfile is out of sync.
Where the lockfile ends A reproducible Angular workspace is usually pinned in two places: package.json plus a lockfile, so npm ci restores the exact CLI, compiler, and build plugins on any machine, and the project-local ng binary rather than a global install whose version can drift. The one input the lockfile never captures is the Node.js runtime itself. The