"yarn install" should be executed with option "--frozen-lockfile"

diff --git a/build.gradle b/build.gradle
index fe66bf2854270e7ca90a097a93f7896cacdc1303..a967d1a626702ab3bc9d62fba63172eb59503064 100644 (file)
--- a/build.gradle
+++ b/build.gradle
@@ -459,6 +459,12 @@ subprojects {
 def yarnInstallTasks = allprojects.findResults { it -> it.tasks.findByName('yarn') }
 yarnInstallTasks.drop(1).eachWithIndex { it, i -> it.mustRunAfter(yarnInstallTasks[0..i]) }
 
+// by default, Yarn will update lock file if it is not up to date with "package.json"
+// using option "--frozen-lockfile" will disable this behavior and "yarn install" will fail if lock file is out of date
+// all "yarn install" tasks should be executed with this option for reproducibility of builds
+// and to prevent developers from forgetting to update lock file when they update "package.json"
+yarnInstallTasks.each { it -> it.args = ['--frozen-lockfile'] }
+
 
 artifactory {
   clientConfig.setIncludeEnvVars(true)