Lock down yarn & JS dep versions to ensure reproducibility

Author: fbacall

.github/workflows/deployment-checks.yml

@@ -48,9 +48,14 @@ jobs:
           cp config/secrets.github.yml config/secrets.yml
           cp config/ingestion.example.yml config/ingestion.yml
           bundle exec rake db:setup
-      - run: yarn install
-        name: Install JS dependencies
-      - run: bundle exec rake assets:precompile
-        name: Run asset compilation
-      - run: bundle exec whenever --update-crontab --set environment="$ENV"
-        name: Run whenever update
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'yarn'
+      - name: Install JS dependencies
+        run: yarn install --frozen-lockfile --non-interactive
+      - name: Run asset compilation
+        run: bundle exec rake assets:precompile
+      - name: Run whenever update
+        run: bundle exec whenever --update-crontab --set environment="$ENV"

.github/workflows/test.yml

@@ -53,7 +53,12 @@ jobs:
           cp config/secrets.github.yml config/secrets.yml
           cp config/ingestion.example.yml config/ingestion.yml
           bundle exec rake db:test:prepare
-      - run: yarn install
-        name: Install JS dependencies
-      - run: bundle exec rails test
-        name: Run tests
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'yarn'
+      - name: Install JS dependencies
+        run: yarn install --frozen-lockfile --non-interactive
+      - name: Run tests
+        run: bundle exec rails test

Dockerfile

@@ -12,7 +12,7 @@ RUN apt-get update \
     && apt-get clean
 
 # install yarn to manage JS dependencies
-RUN npm install --global yarn
+RUN npm install --global yarn@1.22.22
 
 # install supercronic - a cron alternative
 ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.1.12/supercronic-linux-amd64 \
@@ -47,7 +47,7 @@ RUN bundle check || bundle install
 COPY package.json yarn.lock ./
 
 # install js dependencies
-RUN yarn install
+RUN yarn install --frozen-lockfile --non-interactive
 
 # copy code
 COPY . .

docs/install.md

@@ -74,11 +74,11 @@ TeSS uses yarn to manage JS dependencies.
 
 Install it using npm:
 
-    npm install --global yarn
+    npm install --global yarn@1.22.22
 
 and install JS dependencies using (from the app's root directory):
 
-    yarn install
+    yarn install --frozen-lockfile
 
 ## PostgreSQL
 

docs/production.md

@@ -188,11 +188,11 @@ _Note: Ensure you have started Solr before running this command!_
 
 Install yarn globally via npm:
 
-    npm install --global yarn
+    npm install --global yarn@1.22.22
 
 Install JS dependencies:
 
-    yarn install
+    yarn install --frozen-lockfile --non-interactive
 
 ## Compile assets