From 7ddec041a0f8b5d023dfc1ab3523f981c7e600cf Mon Sep 17 00:00:00 2001
From: Ruy Adorno <ruyadorno@hotmail.com>
Date: Wed, 2 Feb 2022 22:42:20 -0500
Subject: [PATCH] fix(ci): should not use package-lock config

`npm ci` should never be affected by the `package-lock` config.

Fixes: https://github.com/npm/cli/issues/4185
---
 docs/content/using-npm/config.md                             | 2 ++
 lib/commands/ci.js                                           | 1 +
 lib/utils/config/definitions.js                              | 2 ++
 tap-snapshots/test/lib/utils/config/definitions.js.test.cjs  | 2 ++
 tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs | 2 ++
 test/lib/commands/ci.js                                      | 3 ++-
 6 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/docs/content/using-npm/config.md b/docs/content/using-npm/config.md
index 83a385e08344f..0af538fed52bc 100644
--- a/docs/content/using-npm/config.md
+++ b/docs/content/using-npm/config.md
@@ -1190,6 +1190,8 @@ When package package-locks are disabled, automatic pruning of extraneous
 modules will also be disabled. To remove extraneous modules with
 package-locks disabled use `npm prune`.
 
+This configuration does not affect `npm ci`.
+
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
diff --git a/lib/commands/ci.js b/lib/commands/ci.js
index 2c2f8da866653..16c8bf22f9e85 100644
--- a/lib/commands/ci.js
+++ b/lib/commands/ci.js
@@ -37,6 +37,7 @@ class CI extends ArboristWorkspaceCmd {
     const where = this.npm.prefix
     const opts = {
       ...this.npm.flatOptions,
+      packageLock: true, // npm ci should never skip lock files
       path: where,
       log,
       save: false, // npm ci should never modify the lockfile or package.json
diff --git a/lib/utils/config/definitions.js b/lib/utils/config/definitions.js
index 95d79f0f05325..79222881c9734 100644
--- a/lib/utils/config/definitions.js
+++ b/lib/utils/config/definitions.js
@@ -1417,6 +1417,8 @@ define('package-lock', {
     When package package-locks are disabled, automatic pruning of extraneous
     modules will also be disabled.  To remove extraneous modules with
     package-locks disabled use \`npm prune\`.
+
+    This configuration does not affect \`npm ci\`.
   `,
   flatten: (key, obj, flatOptions) => {
     flatten(key, obj, flatOptions)
diff --git a/tap-snapshots/test/lib/utils/config/definitions.js.test.cjs b/tap-snapshots/test/lib/utils/config/definitions.js.test.cjs
index 459c5de8dc284..ab706be89b835 100644
--- a/tap-snapshots/test/lib/utils/config/definitions.js.test.cjs
+++ b/tap-snapshots/test/lib/utils/config/definitions.js.test.cjs
@@ -1271,6 +1271,8 @@ will also prevent _writing_ \`package-lock.json\` if \`save\` is true.
 When package package-locks are disabled, automatic pruning of extraneous
 modules will also be disabled. To remove extraneous modules with
 package-locks disabled use \`npm prune\`.
+
+This configuration does not affect \`npm ci\`.
 `
 
 exports[`test/lib/utils/config/definitions.js TAP > config description for package-lock-only 1`] = `
diff --git a/tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs b/tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs
index ffa6617328bc6..58958ebdab954 100644
--- a/tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs
+++ b/tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs
@@ -1064,6 +1064,8 @@ When package package-locks are disabled, automatic pruning of extraneous
 modules will also be disabled. To remove extraneous modules with
 package-locks disabled use \`npm prune\`.
 
+This configuration does not affect \`npm ci\`.
+
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
diff --git a/test/lib/commands/ci.js b/test/lib/commands/ci.js
index 537d0784f8963..f77ddc0f7771b 100644
--- a/test/lib/commands/ci.js
+++ b/test/lib/commands/ci.js
@@ -199,7 +199,7 @@ t.test('should throw ECIGLOBAL', async t => {
 })
 
 t.test('should remove existing node_modules before installing', async t => {
-  t.plan(2)
+  t.plan(3)
   const testDir = t.testdir({
     node_modules: {
       'some-file': 'some contents',
@@ -212,6 +212,7 @@ t.test('should remove existing node_modules before installing', async t => {
     '@npmcli/arborist': function () {
       this.loadVirtual = () => Promise.resolve(true)
       this.reify = async (options) => {
+        t.equal(options.packageLock, true, 'npm ci should never ignore lock')
         t.equal(options.save, false, 'npm ci should never save')
         // check if node_modules was removed before reifying
         const contents = await readdir(testDir)