Lockfile Discipline Guardian

How It Works

Lockfiles are essential for reproducible installs, but workflows can make them a source of

friction (conflicts, constant churn). This recipe introduces a disciplined approach.

Triggers

• People delete lockfiles to "fix installs"
• Lockfile merge conflicts are frequent
• CI and local resolve dependencies differently

Steps

1. Pick a single package manager per repo and document it.
2. Enforce "install from lockfile" in CI (clean install).
3. Add a lockfile consistency check:

• lockfile is present,
• lockfile matches the manifest,
• only one lockfile type exists.

1. Add merge conflict guidance for lockfiles (how to regenerate correctly).
2. Establish a dependency update cadence (batched updates reduce churn).

Expected Outcome

• More reproducible builds and fewer "works on my machine" incidents.
• Less time wasted in dependency resolution chaos.

Example Inputs

• "We have both yarn.lock and package-lock.json."
• "Lockfile conflicts happen in every PR."
• "CI resolves a different dependency tree than local."

Tips

• Prefer batched updates to constant trickle churn.