Reproducible npm build

Author: nosborn

.github/dependabot.yml

@@ -11,3 +11,8 @@ updates:
     directory: /
     schedule:
       interval: daily
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: daily

.gitignore

@@ -1 +1,2 @@
 .envrc
+node_modules/

.pre-commit-config.yaml

@@ -21,6 +21,7 @@ repos:
       - id: pretty-format-json
         args:
           - --autofix
+        exclude: package-lock.json
       - id: trailing-whitespace
         exclude: examples/ignore/example-ignore.md
 
@@ -37,4 +38,12 @@ repos:
     hooks:
       - id: actionlint-docker
 
+  - repo: local
+    hooks:
+      - id: package-lock
+        name: package.json and package-lock.json are in step
+        entry: npm ci --omit=dev --silent
+        language: system
+        pass_filenames: false
+
 minimum_pre_commit_version: !!str 4.2

Dockerfile

@@ -1,7 +1,9 @@
 FROM node:lts-alpine@sha256:41e4389f3d988d2ed55392df4db1420ad048ae53324a8e2b7c6d19508288107e
 
-RUN npm install --global --omit=dev --update-notifier=false markdownlint-cli@0.43.0
+COPY package.json package-lock.json /
+RUN npm ci --omit=dev
 
-COPY entrypoint.sh /entrypoint.sh
 COPY markdownlint-problem-matcher.json /markdownlint-problem-matcher.json
+
+COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]

entrypoint.sh

@@ -13,7 +13,7 @@ cp /markdownlint-problem-matcher.json "${PROBLEM_MATCHER:?}" || exit
 echo "::add-matcher::${PROBLEM_MATCHER:?}"
 
 # shellcheck disable=SC2086
-${MARKDOWNLINT} ${INPUT_FILES:?}
+npx ${MARKDOWNLINT} ${INPUT_FILES:?}
 readonly RC=$?
 
 echo '::remove-matcher owner=markdownlint::'