From 8877c7204b5696242f14a8bc7491b270d46b77e3 Mon Sep 17 00:00:00 2001
From: Roger Chappel <miscanalysis@gmail.com>
Date: Tue, 6 Oct 2026 00:48:19 +1000
Subject: [PATCH] ci: require lockfile for dependency installs

---
 .github/workflows/ci.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b0d093..f4b3a89 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,12 +57,13 @@ jobs:
             exit 0
           fi
 
-          if [ -f package-lock.json ]; then
-            npm ci
-          else
-            npm install
+          if [ ! -f package-lock.json ]; then
+            echo "package-lock.json is required for reproducible CI installs."
+            exit 1
           fi
 
+          npm ci
+
           npm run lint --if-present
           npm test --if-present
           npm run check --if-present