fix(ci): track frontend lockfile for reproducible installs

The blanket package-lock.json gitignore rule meant the frontend lockfile was never committed, so every release installed whatever the registry handed it (silent transitive drift) and setup-node npm caching failed outright with unable to cache dependencies. Scope the ignore rule to the repo root (/package-lock.json; no root package.json exists) and commit the freshly updated frontend lockfile: all deps at max in-range versions (autoprefixer 10.5.6 -> 10.6.0), majors intentionally deferred to the v3 frontend refresh. Verified with a green vite build before committing.
2026-09-12 22:40:21 -04:00
parent efe45f39e7
commit 2bf8d3887e
2 changed files with 2720 additions and 1 deletions
@@ -26,7 +26,9 @@ build/bin
 node_modules
 frontend/dist
 package.json.md5
-package-lock.json
+# Root-level lockfile only: the frontend lockfile IS tracked so CI installs
 # are reproducible and setup-node's npm cache has something to hash.
 /package-lock.json
 .idea
 .env
 environment.go