Should we include the workspace root lockfile in git?

[romainmenke]

see : https://github.com/csstools/postcss-plugins/projects/1#card-74561431

The current release process is overcomplicated to ensure builds are correct.

• delete any local lock file
• delete node_modules
• do a fresh npm install

If we include package-lock.json from the workspace root in git it would become :

• run : npm ci

An added benefit of checking in package-lock.json is that builds would become reproducible.
At the moment it is not possible to go back in git to a previous release and build everything exactly as it was build for that release.

package-lock.json is never included when publishing to npm so it would not impact anything for users.

Thoughts?

[Antonio-Laguna]

@romainmenke I think this makes sense, especially with the issue we've had with TS.

[romainmenke]

package-lock.json has been added in git.

We'll see how this goes and can revisit this if it causes issues for anyone :)