Only test locked dependencies in CI/deployment (#180)

* Only install locked deps in CI/deployment

* Use yarn install with frozen lockfile

Author: ml-evs

.docker/app_dockerfile

@@ -11,7 +11,7 @@ RUN npm install -g serve
 COPY webapp/package.json webapp/yarn.lock ./
 
 # Using a custom node_modules location to avoid mounting it outside of docker
-RUN --mount=type=cache,target=/root/.cache/yarn yarn install --modules-folder /node_modules
+RUN --mount=type=cache,target=/root/.cache/yarn yarn install --frozen-lockfile --modules-folder /node_modules
 
 FROM base as development
 ENV PATH $PATH:/node_modules/.bin

.docker/server_dockerfile

@@ -12,15 +12,14 @@ COPY pydatalab/Pipfile pydatalab/Pipfile.lock ./
 
 # Create development image using flask's dev server with hot-reload
 FROM base as development
-RUN --mount=type=cache,target=/root/.cache/pip pipenv install
-RUN --mount=type=cache,target=/root/.cache/pip pipenv install --dev
+RUN --mount=type=cache,target=/root/.cache/pip pipenv sync
 ENV FLASK_APP "pydatalab.main:create_app()"
 ENV FLASK_ENV "development"
 CMD ["pipenv", "run", "flask", "run", "--port", "5001", "--host", "0.0.0.0"]
 
 # Create production image using gunicorn and minimal dependencies
 FROM base as production
-RUN --mount=type=cache,target=/root/.cache/pip pipenv install
+RUN --mount=type=cache,target=/root/.cache/pip pipenv sync
 RUN [ "pipenv", "run", "pip", "install", "gunicorn" ]
 COPY ./pydatalab/ ./
 

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install -U setuptools
           pip install pipenv
-          pipenv install --dev
+          pipenv sync --dev
           pipenv run pip install -e .
           pipenv graph
 
@@ -97,7 +97,7 @@ jobs:
 
       - name: Install web app
         working-directory: ./webapp
-        run: yarn install
+        run: yarn install --frozen-lockfile
 
       - name: Unit and Component test web app
         working-directory: ./webapp