Reproducible npm build

.gitattributes

@@ -0,0 +1 @@
+package-lock.json linguist-generated=true

.github/dependabot.yml

@@ -11,3 +11,9 @@ updates:
     directory: /
     schedule:
       interval: daily
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: daily
+    versioning-strategy: lockfile-only

.gitignore

@@ -1 +1,2 @@
 .envrc
+node_modules/

.pre-commit-config.yaml

@@ -21,6 +21,7 @@ repos:
       - id: pretty-format-json
         args:
           - --autofix
+        exclude: package-lock.json
       - id: trailing-whitespace
         exclude: examples/ignore/example-ignore.md
 
@@ -37,4 +38,12 @@ repos:
     hooks:
       - id: actionlint-docker
 
+  - repo: local
+    hooks:
+      - id: package-lock
+        name: package.json and package-lock.json are in step
+        entry: npm ci --omit=dev --silent
+        language: system
+        pass_filenames: false
+
 minimum_pre_commit_version: !!str 4.2

Dockerfile

@@ -1,6 +1,7 @@
 FROM node:lts-alpine@sha256:41e4389f3d988d2ed55392df4db1420ad048ae53324a8e2b7c6d19508288107e
 
-RUN npm install --global --omit=dev --update-notifier=false markdownlint-cli@0.43.0
+COPY package.json package-lock.json /
+RUN npm ci --omit=dev
 
 COPY entrypoint.sh /entrypoint.sh
 COPY markdownlint-problem-matcher.json /markdownlint-problem-matcher.json

README.md

@@ -12,7 +12,7 @@ Basic usage with all options enabled:
 
 ```yaml
 - name: markdownlint-cli
-  uses: nosborn/github-action-markdown-cli@v3.3.0
+  uses: nosborn/github-action-markdown-cli@v3.4.0
   with:
     files: .
     config_file: .markdownlint.yaml

entrypoint.sh

@@ -13,7 +13,7 @@ cp /markdownlint-problem-matcher.json "${PROBLEM_MATCHER:?}" || exit
 echo "::add-matcher::${PROBLEM_MATCHER:?}"
 
 # shellcheck disable=SC2086
-${MARKDOWNLINT} ${INPUT_FILES:?}
+npx ${MARKDOWNLINT} ${INPUT_FILES:?}
 readonly RC=$?
 
 echo '::remove-matcher owner=markdownlint::'