npm ci should never save package.json or lockfile

Via: https://github.com/targos/npm7-cra#issue-1-npm-ci-changes-packagejson

Author: isaacs

lib/ci.js

@@ -33,7 +33,8 @@ const ci = async () => {
     }),
     rimraf(`${where}/node_modules/`)
   ])
-  await arb.reify()
+  // npm ci should never modify the lockfile or package.json
+  await arb.reify({ save: false })
   reifyOutput(arb)
 }
 

test/lib/ci.js

@@ -100,7 +100,8 @@ test('should remove existing node_modules before installing', (t) => {
     },
     '@npmcli/arborist': function () {
       this.loadVirtual = () => Promise.resolve(true)
-      this.reify = async () => {
+      this.reify = async (options) => {
+        t.equal(options.save, false, 'npm ci should never save')
         // check if node_modules was removed before reifying
         const contents = await readdir(testDir)
         t.equals(contents.indexOf('node_modules'), -1, 'node_modules does not exist')