Yarn: run with --frozen-lockfile

[simison]

I haven't dug very much into this but I realized there was no --frozen-lockfile in package.json or in Travis CI config. 🤔

That's like running npm ci vs npm install. I haven't checked but it might also be faster.

That would ensure that package.json and yarn.lock are never out of date with each other. It's not like it happens often, but it has happened.

Note that if later on project updates to Yarn v2, this will need to be changed to --immutable:

If the --immutable option is set, Yarn will abort with an error exit code if anything in the install artifacts (yarn.lock, .pnp.js, ...) was to be modified. For backward compatibility we offer an alias under the name of --frozen-lockfile, but it will be removed in a later release.

(via)

Testing instructions

I haven't actually tested this yet since I basically wanted to hear your thoughts first. I think it would go something along the lines of:

• Run yarn build, confirm it pass
• Update a dependency version in package.json and then run yarn build - it should stall

[matticbot]

Caution: This PR has changes that must be merged to WordPress.com
Hello simison! These changes need to be synced to WordPress.com - If you 're an a11n, please commandeer, review, and approve D38709-code before merging this PR. Thank you!

[jetpackbot]

	Warnings
⚠️	"Testing instructions" are missing for this PR. Please add some
⚠️	"Proposed changelog entry" is missing for this PR. Please include any meaningful changes

This is an automated check which relies on PULL_REQUEST_TEMPLATE. We encourage you to follow that template as it helps Jetpack maintainers do their job. If you think 'Testing instructions' or 'Proposed changelog entry' are not needed for your PR - please explain why you think so. Thanks for cooperation 🤖

Generated by 🚫 dangerJS against 723c7a5

[kraftbj]

I really like this idea. I haven't timed it, but I confirmed it does fail out of the build after manually bumping a package version.

From a bug standpoint, it is good to have a human-readable package.json and have some assurance it is what is being built. From a security standpoint, it would help us ensure that we aren't building outdated insecure code unintentionally.

[kraftbj]

Works as I'd expect. Leaving it as "Needs Review" for second Crew opinion on the concept.

[kraftbj]

r202762-wpcom