From 51afd0cf717c7118ba90a911f16395c5d9870f02 Mon Sep 17 00:00:00 2001
From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
Date: Thu, 9 Jul 2026 13:19:31 +0200
Subject: [PATCH] build: use npm ci for clean, reproducible installs (#839)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch pr-build and the Docker image from `npm install` to `npm ci` (`npm ci --omit=dev` in the image), and enable setup-node's npm cache. Deterministic installs from the committed lockfile; CI now fails fast on an out-of-sync lockfile.

Depends on the lockfile being tracked (PR #838) — npm ci requires a committed package-lock.json.
---
 .github/workflows/pr-build.yml | 3 ++-
 docker/Dockerfile              | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 88d2c70d..2d5daca4 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -22,9 +22,10 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          cache: 'npm'
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Lint MDX heading hierarchy
         run: npm run lint:mdx
diff --git a/docker/Dockerfile b/docker/Dockerfile
index ac7cc4a0..0deb1ea3 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -10,8 +10,8 @@ RUN npm install --global pm2
 # Utilise Docker cache to save re-installing dependencies if unchanged
 COPY ./package*.json ./
 
-# Install dependencies
-RUN npm install --production
+# Install dependencies (npm ci = clean, reproducible install from the lockfile)
+RUN npm ci --omit=dev
 
 # Copy all files
 COPY ./ ./