Security deps lock: npm i -> ci - #679
Conversation
| - run: /opt/bin/ec-linux-amd64 -v | ||
|
|
||
| - run: npm i eslint | ||
| - name: Install ESLint |
There was a problem hiding this comment.
I see that eslint is listed in package.json so looks like npm ci should be able to restore necessary version without a manual search, nah?
There was a problem hiding this comment.
Npm ci can only perform a clean install of everything that is listed in package-lock, but for the lint step we only need the eslint package, there's no reason to install all dependencies
There was a problem hiding this comment.
Oh, it's a little bit tricky approach, but formally everything alright here
We take specific version from the package-lock.json and we really need only eslint here for lint checks (for now)
So, everything legal :D
But in future, if eslint will require additional packages (such as plugins), it'll be more tricky to support it this way
3 participants
No description provided.