bikash-barnwal opened a new pull request, #43168: URL: https://github.com/apache/superset/pull/43168
### SUMMARY `docker/docker-frontend.sh` installed the frontend with a bare `npm install`. When `package.json` and `package-lock.json` disagree, `npm install` re-resolves versions and rewrites the lockfile, so a dev image can be built against dependency versions that were never reviewed — and the repository has no `.npmrc` cooldown backing the lockfile up. This switches that install to `npm ci`, which installs exactly what the lockfile pins and fails loudly when the lockfile is out of sync with `package.json`. The `Dockerfile` already uses `npm ci` for the equivalent install, so the two paths are now consistent. Trade-off worth noting for reviewers: `npm ci` removes `node_modules` before installing, so with the dev bind mount the first container start after this change reinstalls from scratch. `NPM_RUN_PRUNE` (the existing knob for that directory) is unaffected. Fixes #42979 ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A — build script change. ### TESTING INSTRUCTIONS 1. Set `BUILD_SUPERSET_FRONTEND_IN_DOCKER=true` in `docker/.env-local`. 2. `docker compose up --detach`. 3. The frontend container logs `Running "npm ci"` and the dev server comes up on http://localhost:9000. 4. To see the guard work, edit a dependency version in `superset-frontend/package.json` without updating the lockfile and restart: the install now fails with npm's lockfile-out-of-sync error instead of silently resolving a different version. ### ADDITIONAL INFORMATION - [x] Has associated issue: #42979 - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
