this repository should contain a package-lock.json

[baywet]

Follow up to the conversation on today's call @handrews
Having only a package.json makes it so the CI installs might install different versions from what was originally installed and tested.
TODO:

• remove exclusion from gitignore (if any)
• npm i locally, and commit the package-lock.json
• update all workflows to use npm ci instead of npm i/install
• update the checkout in Always checkout JavaScript environment from main #3554 to also include that file.

I'm happy to take this on if we agree on the content. :)

[handrews]

@baywet all of that sounds good to me. I'll note that our workflows don't all expect the same version of node, which means different packages give different warnings and errors in each workflow, but it somehow more-or-less works.

We don't need to fix that immediately unless the package-lock.json file might be different for different versions of node (I have no idea if npm downgrades some packages to make them work on older versions?)

[baywet]

That's a good callout, the workflows should ALWAYS specify which version of tooling they except through a setup action or equivalent. Otherwise we expose ourselves to the underlying image changing under our feet and things starting to break randomly (happened to me in the past, never fun). I've added setup node actions where I think it was needed. Right now it's not changing the default because the default for node has been 20.x lately (hence all the actions bumping their major version over the last few months)

No, it doesn't downgrade packages dependencies depending on the engine version AFAIK, but it produces warning like those:

npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'abnf@0.0.5',
npm WARN EBADENGINE   required: { node: '~0.10.10' },
npm WARN EBADENGINE   current: { node: 'v20.11.0', npm: '10.2.4' }
npm WARN EBADENGINE }

(that's from this repo, we might want to reach out to the package owner to understand why the specific version, if anything could be upgraded, and if no answer from them, consider an alternative as this is a very old version of node)

Authored #3564