Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is the difference between "npm install" and "npm ci"?

I'm working with continuous integration and discovered the npm ci command.

I can't figure what the advantages are of using this command for my workflow.

Is it faster? Does it make the test harder, okay, and after?

like image 342
Webwoman Avatar asked Sep 25 '18 13:09

Webwoman


People also ask

Is npm init the same as npm install?

npm init is a convenient way of scaffolding your package. json; you may need to run it everytime you are starting a new project. npm install , however, installs your dependencies in node_modules folder. You may need to run this everytime you manually add a dependency to your package.

Why you should never use npm install in your ci CD pipelines?

TLDR: npm install can update your npm packages potentially destabilizing your build process by using untested dependency versions.

What is node ci?

npm ci (also known as Clean Install) is meant to be used in automated environments — such as test platforms, continuous integration, and deployment — or, any situation where you want to make sure you're doing a clean install of your dependencies. It installs dependencies directly from package-lock.

Does npm ci install Dev?

You're correct. npm ci also installs dev dependencies. Adding --only=prod or --production would not install devDependencies and just install dependencies .


2 Answers

From the npm docs:

In short, the main differences between using npm install and npm ci are:

  • The project must have an existing package-lock.json or npm-shrinkwrap.json.
  • If dependencies in the package lock do not match those in package.json, npm ci will exit with an error, instead of updating the package lock.
  • npm ci can only install entire projects at a time: individual dependencies cannot be added with this command.
  • If a node_modules is already present, it will be automatically removed before npm ci begins its install.
  • It will never write to package.json or any of the package-locks: installs are essentially frozen.

Essentially, npm install reads package.json to create a list of dependencies and uses package-lock.json to inform which versions of these dependencies to install. If a dependency is not in package-lock.json it will be added by npm install.

npm ci (named after Continuous Integration) installs dependencies directly from package-lock.json and uses package.json only to validate that there are no mismatched versions. If any dependencies are missing or have incompatible versions, it will throw an error.

Use npm install to add new dependencies, and to update dependencies on a project. Usually, you would use it during development after pulling changes that update the list of dependencies but it may be a good idea to use npm ci in this case.

Use npm ci if you need a deterministic, repeatable build. For example during continuous integration, automated jobs, etc. and when installing dependencies for the first time, instead of npm install.

npm install

  • Installs a package and all its dependencies.
  • Dependencies are driven by npm-shrinkwrap.json and package-lock.json (in that order).
  • without arguments: installs dependencies of a local module.
  • Can install global packages.
  • Will install any missing dependencies in node_modules.
  • It may write to package.json or package-lock.json.
    • When used with an argument (npm i packagename) it may write to package.json to add or update the dependency.
    • when used without arguments, (npm i) it may write to package-lock.json to lock down the version of some dependencies if they are not already in this file.

npm ci

  • Requires at least npm v5.7.1.
  • Requires package-lock.json or npm-shrinkwrap.json to be present.
  • Throws an error if dependencies from these two files don't match package.json.
  • Removes node_modules and install all dependencies at once.
  • It never writes to package.json or package-lock.json.

Algorithm

While npm ci generates the entire dependency tree from package-lock.json or npm-shrinkwrap.json, npm install updates the contents of node_modules using the following algorithm (source):

load the existing node_modules tree from disk clone the tree fetch the package.json and assorted metadata and add it to the clone walk the clone and add any missing dependencies   dependencies will be added as close to the top as is possible   without breaking any other modules compare the original tree with the cloned tree and make a list of actions to take to convert one to the other execute all of the actions, deepest first   kinds of actions are install, update, remove and move 
like image 66
lucascaro Avatar answered Oct 11 '22 12:10

lucascaro


npm ci will delete any existing node_modules folder and relies on the package-lock.json file to install the specific version of each package. It is significantly faster than npm install because it skips some features. Its clean state install is great for ci/cd pipelines and docker builds! You also use it to install everything all at once and not specific packages.

like image 43
James Harrison Avatar answered Oct 11 '22 10:10

James Harrison