We check our node_modules folder into source control • Hacker News Board

Re: We check our node_modules folder into source control

#11

Post by DaiPlusPlus » Sun, Dec 12, 2021, 12:31 AM UTC

Bellend wrote: post #8

cj wrote: post #6

> Once you check your node_modules in, there's no need to run an install step before you can get up and running on the codebase Is this really true for packages with pre/post install scripts?

No it's not. They are talking about their personal preference and it has nothing to do with real life employers.

RTFA.

It says, quite succinctly:

> I currently work at Google on the Chrome DevTools team and we check our node_modules folder into source control

Re: We check our node_modules folder into source control

#12

Post by aaronyarborough » Sun, Dec 12, 2021, 12:32 AM UTC

This is insane. The only pro I'll even entertain is the potential to cut a few minutes off your CI/CD build time, but for the vast majority, even that brings no actual benefits.

Re: We check our node_modules folder into source control

#13

Post by ilumanty » Sun, Dec 12, 2021, 12:33 AM UTC

Yarn offers "Plug'n'play" mode since v2, which basically promotes what the author says. It takes the idea further: dependencies are stored as zip archives instead of thousands of small files, which reduces the "git noise" and actually makes this viable as a performant workflow.

https://yarnpkg.com/features/pnp

Re: We check our node_modules folder into source control

#14

Post by saghm » Sun, Dec 12, 2021, 12:34 AM UTC

wtfrmyinitials wrote: post #4

Perhaps you could achieve the best of both worlds by checking node_modules into a git submodule

I don't disagree with the general idea, but in practice, using git submodules always ends up feeling like I'm in the worst of most worlds

Re: We check our node_modules folder into source control

#15

Post by bitlax » Sun, Dec 12, 2021, 12:34 AM UTC

Bellend wrote: post #9

danlugo92 wrote: post #7

No, this is what the lock file is for.

"I delete my lock file" is so common that I would say it has no value.

Check in your lock file.

Re: We check our node_modules folder into source control

#16

Post by Supermancho » Sun, Dec 12, 2021, 12:34 AM UTC

Bellend wrote: post #9

danlugo92 wrote: post #7

No, this is what the lock file is for.

"I delete my lock file" is so common that I would say it has no value.

Then this solution has no value either. They achieve the same goal.

Re: We check our node_modules folder into source control

#17

Post by Bellend » Sun, Dec 12, 2021, 12:36 AM UTC

DaiPlusPlus wrote: post #11

Bellend wrote: post #8

Earlier quoted context omitted.

No it's not. They are talking about their personal preference and it has nothing to do with real life employers.

RTFA. It says, quite succinctly: > I currently work at Google on the Chrome DevTools team and we check our node_modules folder into source control

Yeah I read that and I disagree because at google if I checked in my node_modules I would fail my commit.

Re: We check our node_modules folder into source control

#18

Post by kello » Sun, Dec 12, 2021, 12:38 AM UTC

This seems like an unnecessary space hog. If you are that concerned about reproducibility isn't that what npm shrinkwrap tries to solve?

Re: We check our node_modules folder into source control

#19

Post by 01acheru » Sun, Dec 12, 2021, 12:38 AM UTC

bitlax wrote: post #15

Bellend wrote: post #9

Earlier quoted context omitted.

"I delete my lock file" is so common that I would say it has no value.

Check in your lock file.

I think that checking in your lock file is an actual best practice

Re: We check our node_modules folder into source control

#20

Post by Bellend » Sun, Dec 12, 2021, 12:39 AM UTC

bitlax wrote: post #15

Bellend wrote: post #9

Earlier quoted context omitted.

"I delete my lock file" is so common that I would say it has no value.

Check in your lock file.

Done. Then I delete it, and `npm install`. Then commit. The majority of people I have worked with do that. On Friday some dude was saying "shrinkwrap v2 is not shrinkwrap v1" and the advice was "delete it and npm install" then commit. (Payment company software manager).