[feature] prevent lerna from making lock files

Expected Behavior

I expect lerna not to make package-lock.json files by default (see https://github.com/lerna/lerna/issues/2515), as these are not published with packages.

At the very least, I expect Lerna to at least read the .npmrc of my packages and see that they have package-lock=false.

Current Behavior

Even with .npmrc specifying package-lock=false, Lerna still creates package-lock files.

To work around the problem, I also list package-lock.json in my .gitignore files.

Possible Solution

Lerna could avoid creating package-locks by default, provide a CLI option for it, and also read the package-lock value in .npmrc files of each project (or similar for config files of other package managers). The CLI option would override any value from .npmrc files (or similar for other package managers).

Lerna version: 3.20.2

[trusktr]

I discovered from the error output in https://github.com/lerna/lerna/issues/2517 that lerna version tries to add lock files using git add. That’s also undesirable.

I took a look at bootstrap options, but I didn’t see anything about not making lock files. But now that I realize lerna version is also trying to commit them, maybe there’s an overall configuration option that I missed?

[matthias-ccri]

Adding package-lock.json to .gitignore is worse, because

1. You still have a package-lock.json. Adding it to gitignore doesn’t actually remove it.
2. Now developers will have different package-lock.json files. Therefore you get “works on my machine” situations from differing npm installs.
3. If something breaks, there’s no diff to see what changed. No easy way to roll back to a “known good” version. Harder debugging.