Welcome to Software Development on Codidact!
Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.
Comments on Is it necessary for a build server to remove node_modules before an AOT build?
Parent
Is it necessary for a build server to remove node_modules before an AOT build?
I am currently dealing with an Angular application that is being deployed using an CI orchestrator and Jenkins.
Jenkins job is configured to do the following (relevant steps only):
- fetch sources from Git
- remove node_modules
npm install- perform AOT build (
--prod+ other optimizations) - deploy
I have noticed that node_modules removal + npm install + AOT build takes way more time than simply calling npm install + perform AOT build, so I am wondering why the removal.
I have asked a few colleagues about this configuration and no one seems to know why the removal is required.
From what I know, removing node_modules is very rarely required (maybe some major update messes up some packages or similar) and I haven't removed any node_modules for any project in years (development environment).
So, is it necessary for a build server to remove node_modules before an AOT build?
Post
I suspect this is an outdated practice:
Prior to npm 3, npm did not keep track of resolved dependencies, and npm install would try to reconcile the existing with the declared dependencies. Since node_modules is not commonly under version control, this meant that the build would depend on hidden state, and therefore be non-reproducible. Back then, the easiest and most reliable way to ensure reproducible builds was deleting node_modules.
Since npm 3, npm keeps track of resolved dependencies in package-lock.json, thereby guaranteeing that the same dependency versions are used irrespective of the prior state of node_modules (this should even work if the registry is updated retroactively, which sometimes happens to fix high priority security issues).
Nowadays, the only benefit of deleting node_modules would be to guard against software other than npm tampering with its contents - but nobody should do that (and if somebody has hacked your build server, you probably have bigger problems ...)
0 comment threads