From 3536c188e5374b70adc48b17044a63389907c517 Mon Sep 17 00:00:00 2001
From: David Taylor <david@taylorhq.com>
Date: Wed, 13 Jul 2022 14:04:27 +0100
Subject: [PATCH] DEV: Use yarn `--frozen-lockfile` in production (#637)

This ensures that a `yarn install` will never modify the lockfile. We always want to use the lockfile from source control.
---
 image/base/release.Dockerfile | 2 +-
 templates/web.template.yml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/image/base/release.Dockerfile b/image/base/release.Dockerfile
index dd4c3a5..9450259 100644
--- a/image/base/release.Dockerfile
+++ b/image/base/release.Dockerfile
@@ -8,7 +8,7 @@ RUN cd /var/www/discourse &&\
     sudo -u discourse bundle config --local path ./vendor/bundle &&\
     sudo -u discourse bundle config --local without test development &&\
     sudo -u discourse bundle install --jobs 4 &&\
-    sudo -u discourse yarn install --production &&\
+    sudo -u discourse yarn install --production --frozen-lockfile &&\
     sudo -u discourse yarn cache clean &&\
     bundle exec rake maxminddb:get &&\
     find /var/www/discourse/vendor/bundle -name tmp -type d -exec rm -rf {} +
diff --git a/templates/web.template.yml b/templates/web.template.yml
index 8889160..ee3021c 100644
--- a/templates/web.template.yml
+++ b/templates/web.template.yml
@@ -162,7 +162,7 @@ run:
   - exec:
       cd: $home
       cmd:
-        - "[ ! -d 'node_modules' ] || su discourse -c 'yarn install --production && yarn cache clean'"
+        - "[ ! -d 'node_modules' ] || su discourse -c 'yarn install --production --frozen-lockfile && yarn cache clean'"
 
   - exec:
       cd: $home
-- 
2.25.1