Spent a day on a CI build that worked locally and failed on the runner. Same Node version, same lock file, different result.
A transitive dependency published a patch between our two installs, and only one had it pinned. The lock file existed, but one pipeline step ran an install that ignored it.
The fix was one flag. The lesson: a lock file only works if every install path respects it.
Top comments (1)
“锁文件只是存在还不够”这句点到了要害，本地和 CI 走的安装路径不一致，中间夹一个补丁版本就能让结果分叉。我的习惯是把 CI 固定成干净安装并校验锁文件，任何绕过它的步骤都应当场失败。