Use the project’s package manager and supported Node/npm versions. Confirm the lock file belongs to the same package metadata and that private package credentials are available only where needed.

1. Commit the reviewed package-lock.json or supported npm shrinkwrap file with package.json. Keep meaningful project-level installation settings consistent.

2. Run npm ci in a clean build directory. It removes an existing node_modules directory, so do not run it casually inside an active release serving traffic.

3. Install build-time development dependencies when the build needs them. Run the application’s declared build script and retain its output.

4. Prepare the runtime dependency set according to the project deployment model. Omitting development dependencies before compilation can break a build that needs TypeScript or other tools.

5. Deploy the tested output, runtime dependencies and lock metadata as one release. Keep registry tokens out of the final public artifact.

In a clean build directory for the reviewed commit, install the locked dependency tree and compile the application using its declared script. These commands belong in the build workflow, not in an active directory currently serving customer requests.

npm ci
npm run build
git diff --exit-code -- package.json package-lock.json

Stop if installation or compilation fails. npm ci removes an existing node_modules directory and requires compatible package metadata and lock data. Keep build dependencies available until compilation is complete, then prepare the project’s intended runtime package. The final read-only Git comparison reveals unintended dependency-file changes.

Expected result: The release builds with its reviewed versions and leaves the tracked dependency files unchanged. A clean startup from the packaged output confirms that required runtime modules and copied assets were included, without borrowing an untracked dependency from an earlier deployment.

Confirm the build completes without modifying dependency metadata and that the production startup command finds every required runtime package.

A lock mismatch should be fixed in development and reviewed. Replacing npm ci with a broad install on production can introduce an untested dependency change.

• Separating development and production dependency groups
• Selecting a supported Node.js runtime for an existing app
• Building a deployment artifact in CI
• Handling Node process restarts and graceful shutdown

• npm ci
• npm lock files