dev/ci: use npm ci instead of npm install (#228)

Closes #226

Author: lread

.github/workflows/unit-test.yml

@@ -64,8 +64,8 @@ jobs:
           key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
           restore-keys: ${{ runner.os }}-node-
 
-      - name: Install node modules
-        run: npm install
+      - name: Install node packages
+        run: npm ci
 
       - name: Run Tests
         run: ${{ matrix.cmd }}

doc/02-developer-guide.adoc

@@ -67,7 +67,7 @@ After checking out this project from GitHub,
 1. Install JavaScript libraries and tools required by https://github.com/bensu/doo[doo] and https://github.com/thheller/shadow-cljs[shadow-cljs]:
 +
 ----
-npm install
+npm ci
 ----
 
 2. If you are on macOS or linux, https://github.com/planck-repl/planck#installing[install planck].
@@ -291,7 +291,14 @@ This task uses:
 
 * https://github.com/liquidz/antq[antq] for Clojure.
 * npm for JavaScript.
-It only checks against installed `./node_modules`, so you may want to run `npm install` first.
+It only checks against installed `./node_modules`, so you may want to run `npm ci` first.
+
+To bump JavaScript npm packages:
+
+. make appropriate changes to `package.json`
+. delete the `./node_modules` directory and `./package-lock.json`
+. run `npm install`
+. after you are happy the updates work, commit both `package.json` and `package-lock.json`
 
 [#linting]
 == Linting

script/outdated.clj

@@ -15,7 +15,7 @@
   (status/line :head "Checking Node.js deps")
   (when (not (.exists (io/file "node_modules")))
     (status/line :detail "node_modules, not found, installing.")
-    (shell/command "npm install"))
+    (shell/command "npm ci"))
 
   (let [{:keys [:exit]} (shell/command {:continue true}
                                        "npm outdated")]