Pin NPM packages using npm shrinkwrap for repeatable builds
#794
Conversation
As of Less version 2, the `--clean-css` functionality is provided by a plugin, less-plugin-clean-css. See: http:https://lesscss.org/usage/#v2-upgrade-guide-clean-css
Run `make lessc` using Less version 2 to update `drone.css`:
» npm list -g uglify-js less autoprefixer less-plugin-clean-css
/opt/boxen/homebrew/lib
├── [email protected]
├─┬ [email protected]
│ └─┬ [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected]
│ │ └─┬ [email protected]
│ │ └── [email protected]
│ └── [email protected]
├── [email protected]
├── [email protected]
└── [email protected]
Pin NPM packages with `npm shrinkwrap --dev`. Adds a minimal `package.json` created by running `npm init` and removing some lines; just enough to satistify `npm install` without it showing warnings. Add the `node_modules/` directory to the `.gitignore` file as we can probably rely on the NPM registry server and this diverges as little as possible from the current behaviour (i.e. don't vendor anything). The decision not to vendor the NPM modules can always be reviewed later. This commit tells NPM to install the packages in the current directory rather than globally, which will make it easier to vendor the NPM packages in future if desired.
The NPM modules, used primarily to render the Less files into CSS, don't seem any less important than other build dependencies so I don't see the harm in running this every time `make deps` is invoked.
mattbostock
changed the title
npm shrinkwrapnpm shrinkwrap for repeatable builds
|
i think file |
|
@Bugagazavr I'm inclined to agree, since it's a generated file. I think the @bradrydzewski, what are your thoughts? |
|
Since we only have lessc as a dependency I'd prefer to keep it as a global dependency requirement (autoprefixer is being removed in an upcoming PR, and we can use @Bugagazavr since the majority of developers are contributing Go code I don't want them to have to install npm or node to test locally. My intention when checking in the CSS file was to minimize barrier to entry for Go developers that wanted to contribute to the project. |
Pin NPM packages with
npm shrinkwrap --dev.Adds a minimal
package.jsoncreated by runningnpm initand removing some lines; just enough to satistifynpm installwithout it showing warnings. Also, runnpm installeach timemake depsis invoked.Note that there are changes to the generated
drone.csswhen using Less version 2.2 (the latest) though in my testing I couldn't see any breakages.I'm not very familiar with NPM or Less, so I'd appreciate any feedback.