npm_install is non-deterministic about rules_nodejs

[pcj]

A bit surprised you're using npm here.

I struggled with non-determinism issues with npm in rules_node for a while and ultimately ditched npm altogether for yarn. The problems included npm adding fields that are themselves non-deterministic like you're seeing above (requiring stripping certain "blacklisted" fields), and even weird "flaky" problems where the package contents were occasionally different (i.e., sometimes I'd get a tarball back where the hash was unexpected, only to find an extra README file in there).

[alexeagle]

Changing to Yarn is totally an option. It's only npm because the contributor who added the feature did it that way, and I wasn't aware of the determinism issues. Thanks Paul!

…

On Thu, Feb 1, 2018 at 12:02 PM Paul Cody Johnston ***@***.***> wrote: A bit surprised you're using npm here. I struggled with non-determinism issues with npm in rules_node for a while and ultimately ditched npm altogether for yarn. The problems included npm adding fields that are themselves non-deterministic like you're seeing above (requiring stripping certain "blacklisted" fields), and even weird "flaky" problems where the package *contents* were occasionally different (i.e., sometimes I'd get a tarball back where the hash was unexpected, only to find an extra README file in there). — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#98 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAC5I_uV20VJub-p7ebMkcQ3wARROz-pks5tQhhjgaJpZM4Ryt4c> .

[gregmagolan]

#106 adds yarn_install which can accept a yarn.lock file

[alexeagle]

@gregmagolan I think this is fixed?

[gregmagolan]

@gregmagolan I think this is fixed?

Yes. npm_install should now be deterministic. I'll verify and add something to CI to check for both npm_install and yarn_install.