feat(install): add --frozen-lockfile flag for CI environments

e2e/harmony/install.e2e.ts

@@ -313,6 +313,48 @@ describe('install with --lockfile-only', function () {
   });
 });
 
+describe('install with --frozen-lockfile', function () {
+  this.timeout(0);
+  let helper: Helper;
+  describe('when lockfile is up to date', () => {
+    before(() => {
+      helper = new Helper({ scopesOptions: { remoteScopeWithDot: true } });
+      helper.scopeHelper.setWorkspaceWithRemoteScope();
+      helper.extensions.workspaceJsonc.setPackageManager('teambit.dependencies/pnpm');
+      // First install to create lockfile
+      helper.command.install('is-positive@^1.0.0');
+    });
+    after(() => {
+      helper.scopeHelper.destroy();
+    });
+    it('should succeed when lockfile does not need to be updated', () => {
+      // Running with frozen-lockfile should succeed since lockfile is already up to date
+      const output = helper.command.install(undefined, { 'frozen-lockfile': '' });
+      expect(output).to.include('Successfully installed dependencies');
+    });
+  });
+  describe('when lockfile needs update', () => {
+    before(() => {
+      helper = new Helper({ scopesOptions: { remoteScopeWithDot: true } });
+      helper.scopeHelper.setWorkspaceWithRemoteScope();
+      helper.extensions.workspaceJsonc.setPackageManager('teambit.dependencies/pnpm');
+      // First install to create lockfile
+      helper.command.install('is-positive@^1.0.0');
+      // Add a new dependency to workspace.jsonc without installing
+      const workspaceJsonc = helper.workspaceJsonc.read();
+      workspaceJsonc['teambit.dependencies/dependency-resolver'].policy.dependencies['is-odd'] = '^1.0.0';
+      helper.workspaceJsonc.write(workspaceJsonc);
+    });
+    after(() => {
+      helper.scopeHelper.destroy();
+    });
+    it('should fail when lockfile needs to be updated', () => {
+      // Running with frozen-lockfile should fail since lockfile needs update
+      expect(() => helper.command.install(undefined, { 'frozen-lockfile': '' })).to.throw();
+    });
+  });
+});
+
 describe('comment preservation during install', function () {
   this.timeout(0);
   let helper: Helper;

scopes/dependencies/dependency-resolver/package-manager.ts

@@ -31,6 +31,12 @@ export type PackageManagerInstallOptions = {
 
   lockfileOnly?: boolean;
 
+  /**
+   * When true, installation will fail if the lockfile needs to be updated.
+   * This is useful for CI environments to ensure reproducible builds.
+   */
+  frozenLockfile?: boolean;
+
   /**
    * When false, the package manager will not write the node_modules directory
    */

scopes/dependencies/pnpm/lynx.ts

@@ -219,6 +219,7 @@ export async function install(
     | 'publicHoistPattern'
     | 'hoistPattern'
     | 'lockfileOnly'
+    | 'frozenLockfile'
     | 'nodeVersion'
     | 'enableModulesDir'
     | 'engineStrict'
@@ -291,6 +292,7 @@ export async function install(
     dir: rootDir,
     storeController: storeController.ctrl,
     preferFrozenLockfile: true,
+    frozenLockfile: options.frozenLockfile,
     pruneLockfileImporters: true,
     lockfileOnly: options.lockfileOnly ?? false,
     modulesCacheMaxAge: Infinity, // pnpm should never prune the virtual store. Bit does it on its own.

scopes/dependencies/pnpm/pnpm.package-manager.ts

@@ -177,6 +177,7 @@ export class PnpmPackageManager implements PackageManager {
         engineStrict: installOptions.engineStrict ?? config.engineStrict,
         excludeLinksFromLockfile: installOptions.excludeLinksFromLockfile,
         lockfileOnly: installOptions.lockfileOnly,
+        frozenLockfile: installOptions.frozenLockfile,
         minimumReleaseAge: installOptions.minimumReleaseAge,
         minimumReleaseAgeExclude: installOptions.minimumReleaseAgeExclude,
         neverBuiltDependencies: installOptions.neverBuiltDependencies,

scopes/workspace/install/install.cmd.tsx

@@ -22,6 +22,7 @@ type InstallCmdOptions = {
   noOptional: boolean;
   recurringInstall: boolean;
   lockfileOnly: boolean;
+  frozenLockfile: boolean;
   allowScripts?: string;
   disallowScripts?: string;
 };
@@ -69,6 +70,7 @@ automatically imports components, compiles components, links to node_modules, an
     ],
     ['', 'no-optional [noOptional]', 'do not install optional dependencies (works with pnpm only)'],
     ['', 'lockfile-only', 'dependencies are not written to node_modules. Only the lockfile is updated'],
+    ['', 'frozen-lockfile', 'fail if the lockfile needs to be updated (useful for CI environments)'],
     ['', 'allow-scripts [pkgNames]', 'a comma separated list of package names that are allowed to run installation scripts'],
     ['', 'disallow-scripts [pkgNames]', 'a comma separated list of package names that are NOT allowed to run installation scripts'],
   ] as CommandOptions;
@@ -134,6 +136,7 @@ automatically imports components, compiles components, links to node_modules, an
       updateAll: options.update,
       recurringInstall: options.recurringInstall,
       lockfileOnly: options.lockfileOnly,
+      frozenLockfile: options.frozenLockfile,
       showExternalPackageManagerPrompt: true,
       allowScripts: this._parseAllowScriptsFlags(options.allowScripts, options.disallowScripts),
     };

scopes/workspace/install/install.main.runtime.ts

@@ -102,6 +102,7 @@ export type WorkspaceInstallOptions = {
   recurringInstall?: boolean;
   optimizeReportForNonTerminal?: boolean;
   lockfileOnly?: boolean;
+  frozenLockfile?: boolean;
   writeConfigFiles?: boolean;
   skipPrune?: boolean;
   dependenciesGraph?: DependenciesGraph;
@@ -403,6 +404,7 @@ export class InstallMain {
       updateAll: options?.updateAll,
       optimizeReportForNonTerminal: options?.optimizeReportForNonTerminal,
       lockfileOnly: options?.lockfileOnly,
+      frozenLockfile: options?.frozenLockfile,
     };
     const prevManifests = new Set<string>();
     // TODO: this make duplicate