Lerna version adds package-lock.json to git

I learned that package-lock.json is preferably ignored under packages/**, and only the package-lock.json in the root should exist. So I added packages/**/package-lock.json into .gitignore. Now when I run lerna version (or lerna publish), apparently it generates a git add command which includes these package-lock.json files as well for some reason, and it fails with a message:

lerna ERR! lerna The following paths are ignored by one of your .gitignore files: … paths to package-lock.json files…

Expected Behavior

package-lock.json files should not be explicitly added in git add command which is generated by lerna version. I would at least expect it to do git add -A, so that files ignored in .gitignore are ignored.

Current Behavior

The following git add command has been generated: git add – packages/util/package.json packages/util/package-lock.json and it fails with the above error message.

Possible Solution

Run git tag -A instead of creating a big git add file1 file2 file3 etc. command

Steps to Reproduce (for bugs)

Example: https://gitlab.com/coldevel/lerna-version-ignore-bug – see replication instructions there

lerna.json

{
  "packages": [
    "packages/*"
  ],
  "version": "independent",
  "command": {
    "version": {
      "allowBranch": "master"
    }
  }
}

lerna-debug.log

1 notice cli v3.18.4
2 verbose rootPath /Users/darko/lerna-version-ignore-bug
3 info versioning independent
4 silly isAnythingCommitted
5 verbose isAnythingCommitted 1
6 silly currentBranch
7 verbose currentBranch master
8 silly remoteBranchExists
9 silly isBehindUpstream
10 silly isBehindUpstream master is behind origin/master by 0 commit(s) and ahead by 0
11 silly hasTags
12 verbose hasTags false
13 info Assuming all packages changed
14 verbose updated util
15 verbose git-describe undefined => "7d7aa69"
16 silly git-describe parsed => {"refCount":"1","sha":"7d7aa69","isDirty":false}
17 info execute Skipping releases
18 silly lifecycle No script for "preversion" in "root", continuing
19 silly lifecycle No script for "preversion" in "util", continuing
20 silly lifecycle No script for "version" in "util", continuing
21 silly lifecycle No script for "version" in "root", continuing
22 silly gitAdd [ '/Users/darko/lerna-version-ignore-bug/packages/util/package.json',
22 silly gitAdd   '/Users/darko/lerna-version-ignore-bug/packages/util/package-lock.json' ]
23 error Error: Command failed: git add -- packages/util/package.json packages/util/package-lock.json
23 error The following paths are ignored by one of your .gitignore files:
23 error packages/util/package-lock.json
23 error Use -f if you really want to add them.
23 error
23 error     at makeError (/usr/local/lib/node_modules/node/lib/node_modules/lerna/node_modules/execa/index.js:174:9)
23 error     at Promise.all.then.arr (/usr/local/lib/node_modules/node/lib/node_modules/lerna/node_modules/execa/index.js:278:16)

Context

I constantly have to update and resolve conflicts in package-lock.json files in individual sub-projects in the Lerna monorepo, so I decided to listen to the advice of Lerna maintainers ignore / not use them. Since every run to lerna bootstrap generates these files anyway, and so does running npm install in individual projects, I have added a line to my .gitignore: packages/**/package-lock.json. Running lerna version stops working now as described above.

Your Environment

Executable	Version
lerna --version	3.18.4
npm --version	6.13.0
node --version	v10.16.3

OS	Version
macOS Catalina	10.15.2

[evocateur]

If your lerna bootstrap is creating lockfiles, you shouldn’t be ignoring them. If you’re following my guidance to avoid lockfiles in leaf packages, that means you should be using relative file: specifiers in project root package.json, allowing npm to create a lockfile for the whole project, and thus avoiding the leaf node lockfiles.

You can accomplish this by running the following commands (assuming you’re using the default packages location):

rm -rf packages/*/package-lock.json packages/*/node_modules
npx lerna link convert
npm i ./packages/*

With those commands executed, you now no longer need to run lerna bootstrap, a simple npm install in the root will suffice.

[mattstrain]

Commenting in case this helps someone. I got around this in CI by simply deleting the package-lock.json file before the lerna publish cmd, which for us was the last action in the release stage anyway. This is probably only most useful in CI environments