1345287 - Document best practices for managing node.js dependencies

Status: RESOLVED FIXED

(Taskcluster :: Services, enhancement)

Description

[Greg Arndt [:garndt]]

Tracker for adding documents describing the best practices for managing dependencies of node.js applications within TaskCluster.  

Some notes from the email thread:
1) lock node version in package.json
2) move to use yarn.lock instead of npm-shrinkwrap.json
3) lock yarn version in package.json

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

4) document it in taskcluster-docs manual/devel/best-practices :)

Comment 2

[Brian Stack [:bstack]]

Progress is trackable at https://public.etherpad-mozilla.org/p/yarnification

Comment 3

[Brian Stack [:bstack]]

PRs have been submitted and approved. The libraries have all been merged to master and I'm just slowly rolling out the services now.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

:my hero:

Comment 5

[Brian Stack [:bstack]]

This is now deployed everywhere except for cloud-mirror, where there is still a review out and docker-worker which is going to take a bit more work. I'm closing this bug. To follow docker-worker stuff, go to bug 1345638.

Comment 6

[Ed Morley [:emorley]]

I'd recommend using `--frozen-lockfile` with yarn install for the Travis runs, since otherwise if someone updates package.json and forgets to update yarn.lock (either by using npm or by forgetting to git add etc), then the CI won't pick it up.

There's also https://github.com/travis-ci/travis-ci/issues/7395 for making Travis default to this.