ppkarwasz opened a new pull request, #506: URL: https://github.com/apache/logging-parent/pull/506
This is a second attempt at #367, which locked the Antora dependencies with `npm-shrinkwrap.json`, but had to be rolled back in #409: it installed the dependencies differently in `logging-parent` (`npm install .`) than in the other repositories (`npm install github:apache/logging-parent#rel/x.y.z`). Now that the `gha/v0` branch exists solely for version pinning, the canonical `package.json` and `package-lock.json` can live here instead: - Website deployments pass the new `npm-dependencies-ref` input to `deploy-site-reusable`, which downloads both files (from this branch, or from any Git repository via `npm-dependencies-repository`) before building the website, so all deployed websites use the exact same dependency tree. Release website staging omits the input and uses the `package.json` committed in each repository. - Dependabot updates the NPM dependencies on this branch only (see the companion PR against `main` for the `dependabot.yaml` change). - The Node.js cache is keyed on the hash of both files. - Unlike #367, the lock file keeps its standard name: npm 12 removed all support for `npm-shrinkwrap.json` (npm/cli#9262), and a shrinkwrap was never honored for Git dependencies anyway (npm/cli#4583). Making website builds from released source archives reproducible will be addressed separately. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
