node.js - 当package.json和yarn.lock不同步时，如何让yarn安装失败？

Question

在一个项目中，我用yarn替换了npm以获得它的好处，并且还强制我们的依赖项通过yarn.lock锁定。

现在，开发人员使用 npm@4 添加了一个库，它只更改了 package.json，当然没有更改 yarn.lock。

我本以为 yarn install 命令会在构建服务器上崩溃，但对我来说，yarn 却出现了意想不到的行为:在最新版本中添加这些库，然后在远程更新 yarn.lock:

$ yarn install
[1/4] Resolving packages...
[2/4] Fetching packages...
warning fsevents@1.1.2: The platform "linux" is incompatible with this module.
info "fsevents@1.1.2" is an optional dependency and failed compatibility check. Excluding it from installation.
[3/4] Linking dependencies...
[4/4] Building fresh packages...
success Saved lockfile.
Done in 5.07s.

这与yarn的目的相矛盾，因为构建作业不会也不应该将yarn.lock推回存储库。

我希望每个开发人员都对他们 checkin 的版本负责。

因此，如果 package.json 和 yarn.lock 不同步，是否有办法让 yarn install 退出并显示错误代码？

Answer 1

您想要--frozen-lockfile参数:

$ yarn install --frozen-lockfile
yarn install v0.27.5
warning ../package.json: No license field
[1/4] Resolving packages...
error Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.

最近在 docs for yarn install 中也明确了这一点:

yarn install

Install all the dependencies listed within package.json in the local node_modules folder.

The yarn.lock file is utilized as follows:

• If yarn.lock is present and is enough to satisfy all the dependencies listed in package.json, the exact versions recorded in yarn.lock are installed, and yarn.lock will be unchanged. Yarn will not check for newer versions.
• If yarn.lock is absent, or is not enough to satisfy all the dependencies listed in package.json (for example, if you manually add a dependency to package.json), Yarn looks for the newest versions available that satisfy the constraints in package.json. The results are written to yarn.lock.

If you want to ensure yarn.lock is not updated, use --frozen-lockfile.