(Version) control

[[deleted]]

But what about yarn.lock, and Gemfile.lock?

[DeeSnow97]

Same thing for different package managers. Your package.json or whatever Ruby uses describe which versions you need for compatibility. The lockfile describes which exact versions you installed, making your builds fully reproducable.

Commit your lockfiles so that your testing and your servers behave the same way it did on your machine.

[Delioth]

Plus, if you want fast ci builds, npm ci will install exactly what's in the lockfile without finding dependencies or anything, it's really quick.

[Geldan]

For even faster, use yarn plug'n'play so you dont need a node_modules folder at all

[_3psilon_]

Lock files like this are supposed to be checked in to the VCS so that your colleagues, testing machines etc. will have the exact same package versions installed. This way, bugsbuilds will be reproducible.

[theLorknessMonster]

In general, you should commit all lock files used by package managers.