build: use version controlled lockfile of package dependencies for development

.github/workflows/ci-build.yml

@@ -34,7 +34,7 @@ jobs:
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install --verbose
+      - run: npm ci --verbose
       - run: npm test
       - name: Upload coverage to Codecov
         if: matrix.node-version == '22.x'

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
           node-version: 24
 
       - name: Install dependencies
-        run: npm install --verbose
+        run: npm ci --verbose
 
       - name: Create or update release PR
         id: changesets
@@ -63,7 +63,7 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
-        run: npm install --verbose
+        run: npm ci --verbose
 
       - name: Publish to npm and create GitHub releases
         uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0

.gitignore

@@ -1,6 +1,5 @@
 # node / npm stuff
 /node_modules
-/package-lock.json
 
 # build products
 /dist