Use additional npm / Yarn options to speed up installation

The node_modules installation should be as fast and deterministic as possible,
as it's taking place internally within a Python package build. Routine
developer-facing information should be omitted, as this is expected to be
handled as part of the direct Javascript development process.

See:
https://docs.npmjs.com/cli/v7/commands/npm-install#configuration
https://yarnpkg.com/cli/install#options

hatch_jupyter_builder/utils.py

@@ -94,25 +94,27 @@ def npm_builder(
     if isinstance(npm, str):
         npm = [npm]
 
+    is_yarn = (abs_path / "yarn.lock").exists()
+
     # Find a suitable default for the npm command.
     if npm is None:
-        is_yarn = (abs_path / "yarn.lock").exists()
         if is_yarn and not which("yarn"):
             log.warning("yarn not found, ignoring yarn.lock file")
             is_yarn = False
-
         npm = ["yarn"] if is_yarn else ["npm"]
 
     npm_cmd = normalize_cmd(npm)
 
+    install_cmd = ["install", "--immutable"] if is_yarn else ["install", "--no-audit", "--no-fund"]
+
     if build_dir and source_dir and not force:
         should_build = is_stale(build_dir, source_dir)
     else:
         should_build = True
 
     if should_build:
         log.info("Installing build dependencies with npm.  This may take a while...")
-        run([*npm_cmd, "install"], cwd=str(abs_path))
+        run([*npm_cmd, *install_cmd], cwd=str(abs_path))
         if build_cmd:
             run([*npm_cmd, "run", build_cmd], cwd=str(abs_path))
     else:

tests/test_npm_builder.py

@@ -21,7 +21,7 @@ def test_npm_builder(mocker, repo):
     npm_builder("wheel", "standard", path=repo)
     run.assert_has_calls(
         [
-            call(["foo", "install"], cwd=str(repo)),
+            call(["foo", "install", "--no-audit", "--no-fund"], cwd=str(repo)),
             call(["foo", "run", "build"], cwd=str(repo)),
         ]
     )
@@ -49,7 +49,7 @@ def test_npm_builder_yarn(mocker, repo):
     npm_builder("wheel", "standard", path=repo)
     run.assert_has_calls(
         [
-            call(["foo", "install"], cwd=str(repo)),
+            call(["foo", "install", "--immutable"], cwd=str(repo)),
             call(["foo", "run", "build"], cwd=str(repo)),
         ]
     )
@@ -63,7 +63,7 @@ def test_npm_builder_missing_yarn(mocker, repo):
     npm_builder("wheel", "standard", path=repo)
     run.assert_has_calls(
         [
-            call(["foo", "install"], cwd=str(repo)),
+            call(["foo", "install", "--no-audit", "--no-fund"], cwd=str(repo)),
             call(["foo", "run", "build"], cwd=str(repo)),
         ]
     )
@@ -76,7 +76,7 @@ def test_npm_builder_path(mocker, tmp_path):
     npm_builder("wheel", "standard", path=tmp_path)
     run.assert_has_calls(
         [
-            call(["foo", "install"], cwd=str(tmp_path)),
+            call(["foo", "install", "--no-audit", "--no-fund"], cwd=str(tmp_path)),
             call(["foo", "run", "build"], cwd=str(tmp_path)),
         ]
     )
@@ -89,7 +89,7 @@ def test_npm_builder_editable(mocker, repo):
     npm_builder("wheel", "editable", path=repo, editable_build_cmd="foo")
     run.assert_has_calls(
         [
-            call(["foo", "install"], cwd=str(repo)),
+            call(["foo", "install", "--no-audit", "--no-fund"], cwd=str(repo)),
             call(["foo", "run", "foo"], cwd=str(repo)),
         ]
     )
@@ -102,7 +102,7 @@ def test_npm_builder_npm_str(mocker, repo):
     npm_builder("wheel", "standard", path=repo, npm="npm")
     run.assert_has_calls(
         [
-            call(["npm", "install"], cwd=str(repo)),
+            call(["npm", "install", "--no-audit", "--no-fund"], cwd=str(repo)),
             call(["npm", "run", "build"], cwd=str(repo)),
         ]
     )
@@ -113,7 +113,7 @@ def test_npm_builder_npm_build_command_none(mocker, repo):
     run = mocker.patch("hatch_jupyter_builder.utils.run")
     which.return_value = "npm"
     npm_builder("wheel", "standard", path=repo, build_cmd=None)
-    run.assert_has_calls([call(["npm", "install"], cwd=str(repo))])
+    run.assert_has_calls([call(["npm", "install", "--no-audit", "--no-fund"], cwd=str(repo))])
 
 
 def test_npm_builder_not_stale(mocker, repo):