fix: force CI to freeze yarn lockfile

[amcgee]

Running yarn install does not respect the local lock-file, since it can overwrite it if there's a version mismatch somewhere. Running yarn install --frozen-lockfile. This is a bit of a misconfiguration of yarn's defaults, in my opinion, but we should at least do the right thing in CI

[amcgee]

In our repos we might want to set this to the default in .yarnrc too, as mui has

[varl]

In our repos we might want to set this to the default in .yarnrc too, as mui has

Good point. We could add that to a preset in d2-style as well.

[k0pernikus]

@varl @amcgee I don't recommend using the setting in .yarnrc. Rather use it as a flag via yarn install --frozen-lockfile.

If your package.json and yarn.lock become out of sync, there's no command available to sync them again when you have it in the .yarnrc file. (You'd think yarn install --force would do that, but that's not the case.) You'd have to edit the .yarnrc temporarly, run yarn install, and reenable the setting in the .yarnrc. It's a messy process and can cause quite a few headaches. (I've been there.)

See this issue: yarnpkg/yarn#4570

[amcgee]

Thanks @k0pernikus for the heads-up! We're still using --frozen-lockfile here as well.

[varl]

Thanks @k0pernikus, indeed I would expect that --force to override .yarnrc. There is benefit to being explicit about what flags are passed to the commands as well, so we are keeping --frozen-lockfile here. 👍