feat(config): Support frozen lockfile config option in deno.json

cli/args/flags.rs

@@ -585,7 +585,7 @@ pub struct Flags {
   pub argv: Vec<String>,
   pub subcommand: DenoSubcommand,
 
-  pub frozen_lockfile: bool,
+  pub frozen_lockfile: Option<bool>,
   pub ca_stores: Option<Vec<String>>,
   pub ca_data: Option<CaData>,
   pub cache_blocklist: Vec<String>,
@@ -4924,7 +4924,7 @@ fn cached_only_arg_parse(flags: &mut Flags, matches: &mut ArgMatches) {
 
 fn frozen_lockfile_arg_parse(flags: &mut Flags, matches: &mut ArgMatches) {
   if let Some(&v) = matches.get_one::<bool>("frozen") {
-    flags.frozen_lockfile = v;
+    flags.frozen_lockfile = Some(v);
   }
 }
 
@@ -10384,10 +10384,10 @@ mod tests {
   #[test]
   fn run_with_frozen_lockfile() {
     let cases = [
-      (Some("--frozen"), true),
-      (Some("--frozen=true"), true),
-      (Some("--frozen=false"), false),
-      (None, false),
+      (Some("--frozen"), Some(true)),
+      (Some("--frozen=true"), Some(true)),
+      (Some("--frozen=false"), Some(false)),
+      (None, None),
     ];
     for (flag, frozen) in cases {
       let mut args = svec!["deno", "run"];

cli/args/lockfile.rs

@@ -147,22 +147,28 @@ impl CliLockfile {
       },
     };
 
+    let root_folder = workspace.root_folder_configs();
+    // CLI flag takes precedence over the config
+    let frozen = flags.frozen_lockfile.unwrap_or_else(|| {
+      root_folder
+        .deno_json
+        .as_ref()
+        .and_then(|c| c.to_lock_config().ok().flatten().map(|c| c.frozen()))
+        .unwrap_or(false)
+    });
+
     let lockfile = if flags.lock_write {
       log::warn!(
         "{} \"--lock-write\" flag is deprecated and will be removed in Deno 2.",
         crate::colors::yellow("Warning")
       );
-      CliLockfile::new(
-        Lockfile::new_empty(filename, true),
-        flags.frozen_lockfile,
-      )
+      CliLockfile::new(Lockfile::new_empty(filename, true), frozen)
     } else {
-      Self::read_from_path(filename, flags.frozen_lockfile)?
+      Self::read_from_path(filename, frozen)?
     };
 
     // initialize the lockfile with the workspace's configuration
     let root_url = workspace.root_dir();
-    let root_folder = workspace.root_folder_configs();
     let config = deno_lockfile::WorkspaceConfig {
       root: WorkspaceMemberConfig {
         package_json_deps: pkg_json_deps(root_folder.pkg_json.as_deref()),

cli/tools/installer.rs

@@ -472,7 +472,7 @@ async fn resolve_shim_data(
     executable_args.push("--cached-only".to_string());
   }
 
-  if flags.frozen_lockfile {
+  if flags.frozen_lockfile.unwrap_or(false) {
     executable_args.push("--frozen".to_string());
   }
 

tests/specs/lockfile/frozen_lockfile/__test__.jsonc

@@ -114,6 +114,35 @@
         }
       ]
     },
+
+    "lockfile_config": {
+      "steps": [
+        {
+          "args": [
+            "eval",
+            "Deno.writeTextFileSync('deno.json', JSON.stringify({ lock: { frozen: true }, ...JSON.parse(Deno.readTextFileSync('deno.json')) }))"
+          ],
+          "output": ""
+        },
+        {
+          "args": "cache --frozen=false add.ts",
+          "output": "[WILDCARD]"
+        },
+        {
+          // sub.ts imports from an npm package
+          // that's not in the lockfile
+          "args": "run sub.ts",
+          "output": "frozen_new_dep_run.out",
+          "exitCode": 1
+        },
+        {
+          "args": "cache sub.ts",
+          "output": "frozen_new_dep_cache.out",
+          "exitCode": 1
+        }
+      ]
+    },
+
     "non_analyzable_dynamic_npm": {
       "steps": [
         {