chore: use lockfiles for NPM dependencies

Author: daniel-graham-amplitude

.github/workflows/release.yml

@@ -133,14 +133,8 @@ jobs:
           GIT_COMMITTER_NAME: amplitude-sdk-bot
           GIT_COMMITTER_EMAIL: amplitude-sdk-bot@users.noreply.github.com
         run: |
-          npx \
-          -p lodash \
-          -p semantic-release \
-          -p @semantic-release/changelog \
-          -p @semantic-release/git \
-          -p @google/semantic-release-replace-plugin \
-          -p @semantic-release/exec \
-          semantic-release --dry-run
+          npm ci
+          npm exec semantic-release -- --dry-run
 
       - name: Semantic Release
         if: ${{ github.event.inputs.dryRun == 'false'}}
@@ -152,12 +146,5 @@ jobs:
           GIT_COMMITTER_NAME: amplitude-sdk-bot
           GIT_COMMITTER_EMAIL: amplitude-sdk-bot@users.noreply.github.com
         run: |
-          npx \
-          -p lodash \
-          -p semantic-release \
-          -p @semantic-release/changelog \
-          -p @semantic-release/git \
-          -p @google/semantic-release-replace-plugin \
-          -p @semantic-release/exec \
-          semantic-release
-
+          npm ci
+          npm exec semantic-release

.gitignore

@@ -4,3 +4,4 @@
 xcuserdata/
 .swiftpm/
 Carthage/
+node_modules/