npm ci can only install packages with an existing package-lock.json or npm-shrinkwrap.json with lockfileVersion >= 1

Question

This is the issue that I am facing when running the command npm ci to install dependencies in my GitHub Action file.

I am working on an expo managed app and using GitHub Actions as a CI for triggering builds whenever I push my code to developmemt branch.

Here's my build script:

name: EAS PIPELINE
on:
  push:
    branches:
      - development
  workflow_dispatch:

jobs:
  build:
    name: Install and build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v1
        with:
          node-version: 14.x

      - name: Setup Expo
        uses: expo/expo-github-action@v6
        with:
          expo-version: 4.x
          token: ${{ secrets.EXPO_TOKEN }}
          expo-cache: true

      - name: Install dependencies
        run: npm ci

      - name: Build on EAS
        run: EAS_BUILD_AUTOCOMMIT=${{1}} npx eas-cli build --platform all --non-interactive

Here's the issue that I am facing Install dependencies step.

Run npm ci
  npm ci
  shell: /usr/bin/bash -e {0}
  env:
    EXPO_TOKEN: ***
npm ERR! cipm can only install packages with an existing package-lock.json or npm-shrinkwrap.json with lockfileVersion >= 1. Run an install with npm@5 or later to generate it, then try again.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/runner/.npm/_logs/2021-10-28T15_16_06_934Z-debug.log
Error: Process completed with exit code 1.

josue.0 · Accepted Answer · 2022-08-27 17:57:17Z

After a lot of research, I was able to figure out that this happens when you are not using npm install for installing dependencies. In my case, I was only using yarn for the dependencies so I was only having yarn.lock file and no package-lock.json file.

One way to resolve this was using npm install to install the dependencies, then you'll have a package-lock.json file and CI won't throw any error.
And the other way if you only want to use yarn, then you need to update that step in your eas-pipeline.yml file for installing the dependencies.

*****************************************************************************************

      - name: Install dependencies
        run: |
          if [ -e yarn.lock ]; then
          yarn install --frozen-lockfile
          elif [ -e package-lock.json ]; then
          npm ci
          else
          npm i
          fi

***************************************************************************************

As I wasn't able to find any solution on StackOverflow and it is our first go-to place to look for any issue. So, I decided to write this answer here.

Here's the original answer: https://github.com/facebook/docusaurus/issues/2846#issuecomment-691706184

Unless you want to write some generic install script that works in multiple scenarios, you probably want to stick with either yarn or npm but not mix the two. If you use npm install locally, use yarn install --frozen-lockfile in CI. — rethab, Commented Nov 16, 2021 at 7:36

Dave Mackey · Accepted Answer · 2023-04-27 19:16:11Z

43

I had a similar error:

`npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.

with a bunch of missing dependency names following this error.

I would run npm ci locally and it would run successfully. However, it would give me the error above when npm ci is run in the CI pipeline and in my case it was because of the version difference of the Node.js installed in the environment that Jenkins pipeline is running in.

My local Node version was 16.x and in Jenkins container it was 12.x.

Upgrading it fixed.

edited Apr 27, 2023 at 19:16

Dave Mackey

4,39221 gold badges79 silver badges140 bronze badges

answered Apr 12, 2022 at 15:57

dugong

4,1834 gold badges12 silver badges28 bronze badges

2

We had the same thing happen. I'm theorizing a new version of npm is being a little stricter on how it checks compatibility. We're using overrides, and some of our developers didn't have a version of npm that respects the overrides in package.json.
– StriplingWarrior
Commented Apr 13, 2022 at 22:08
1

Had the same thing too. Something between npm version 8 and 8.5 seemed to be breaking the build in the same way as you in GitHub Actions. In my case specifying node-version: '17.9.0' which uses npm 8.5.5 to the workflow fixed it. Thank you for the heads up.
– user115014
Commented Jun 16, 2022 at 15:31
1

The same thing happened here, I had 16.3.2, and CI was 16 :shrug:
– ncubica
Commented Aug 8, 2022 at 5:24
Downgrading my node js version to 16.0.0 worked for me
– Rex Omiv
Commented Sep 22, 2022 at 1:44
Similar story for me. I had node 16.14..0 and npm 8.3.1 in my development environment, where I ran npm install. The CI box had node 16.17.1 and npm 8.15.0 installed. So something has changed in npm between 8.3 and 8.15. I upgraded my development environment to be the same version as the CI environment and it built successfully.
– John Jeffery
Commented Oct 9, 2022 at 0:47

| Show 1 more comment

Spencer Mefford · Accepted Answer · 2022-09-27 23:57:09Z

34

This same thing happened to me, and I couldn't figure it out for the longest time. It turns out that I had legacy-peer-deps=true set globally, and I had no idea.

This caused my npm install command to alter the package-lock.json in a way that broke the build on our CI server. I reset package-lock.json with the version from master, removed that npm config, and reinstalled. Everything worked fine after that.

answered Sep 27, 2022 at 23:57

Spencer Mefford

4244 silver badges3 bronze badges

For what it's worth this was the issue that was the cause for me and my team. Removing or disabling the legacy-peer-deps setting made my local like CI. Thanks Spencer
– Zander
Commented Oct 11, 2022 at 8:46
6

Thanks this was my issue. I had legacy-peer-deps=true in my .npmrc file.
– Andrew Winter
Commented Nov 9, 2022 at 4:43
I wasted hours searching for the cause of my error only to find this. You're a life saver! More like a time saver! haha. Thank you!
– Xander Selorm
Commented Nov 17, 2022 at 13:42
Unfortunately I didn't find this before solving on my own. For what it's worth, the same is true for any other npm settings, they have to be identical.
– liakoyras
Commented Jul 4, 2023 at 10:17
Thanks a ton. This was causing the issue for me as well.
– dSebastien
Commented May 14 at 7:03

Add a comment |

core2drew · Accepted Answer · 2023-03-01 02:33:52Z

27

It looks like your package.json and package-lock.json is not synced.

Try to run this npm install --package-lock-only. It will generate package-lock.json that is synced on your package.json

answered Mar 1, 2023 at 2:33

core2drew

3903 silver badges8 bronze badges

Ensuring the package.json and package-lock.json are synced is the simplest solution here so, while it might not work for everyone, this is what I would try first. I deleted my package-lock.json and then did npm install and after that npm ci worked fine.
– Robert Bracco
Commented Jul 28, 2023 at 12:42

Add a comment |

DJ House · Accepted Answer · 2022-01-18 15:16:22Z

13

Old post, but I found this while searching for this same error. In my case I did have a package-lock.json file in my root directory. However, when opening it, I realized that there was a JSON syntax error that slipped in during a previous merge conflict. After running npm i again the file was fixed. The npm ERR! The 'npm ci' command can only install with an existing package-lock.json wasn't a super helpful error in that case.

answered Jan 18, 2022 at 15:16

DJ House

1,3771 gold badge12 silver badges14 bronze badges

1

Agreed, just experienced this. It would be better if npm warned of a detected package-lock.json that is unparseable.
– Nabil Freeman
Commented Jun 26, 2023 at 13:23

Add a comment |

Nathaniel Koehler · Accepted Answer · 2023-04-13 09:53:26Z

I struggled for about 5 hours with AWS Amplify because apparently my package-lock.json and package.json were not synced up; nothing I did with my own code fixed the issue (even deleting the package-lock.json), what ended up working was changing my preBuild settings inside of the App build specification inside the Build Settings tab of the Amplify page.

My yml file ended up looking like this:

version: 1
frontend:
  phases:
    preBuild:
      commands:
        - npm install --package-lock-only
        - npm ci
    build:
      commands:
        - npm run build
  artifacts:
    baseDirectory: build
    files:
      - '**/*'
  cache:
    paths:
      - node_modules/**/*

noteably the only difference from the default is including -npm install --package-lock-only to sync up the files inside AWS. Maybe a bit obvious, but I got stuck on it for a few hours and hope I can help someone out down the line.

Downvote because this defeats the purpose of using npm ci in the first place. This updates your package-lock.json to match your package.json, which is what npm ci is intended to avoid. You may as well just use npm install instead. — robere2, Commented Jan 7 at 18:09

Claudio Teles · Accepted Answer · 2023-10-07 09:27:30Z

5

In my case I was running into this same issue when attempting to deploy it to Firebase. when I ran firebase deploy --only functions it would produce this error and fail to properly deploy the function. I attempted all of the steps here. Deleting package-lock.json then running npm i did not work. Upgrading then downgrading my node version with a node version manager (nvm) did not work.

What finely worked was deleting the package-lock.json file and not running npm install afterwards. When I ran firebase deploy --only functions it successfully deployed.

BE AWARE: Although this solution worked for me, it can lead to other complications further down the line.

answered Oct 7, 2023 at 9:27

Claudio Teles

3024 silver badges12 bronze badges

Nothing else in this list worked for me but this. Thanks. A night before I deployed successfully, then a small change triggered all this issue.
– Ernesto Vallejo García
Commented Nov 17, 2023 at 17:43

Add a comment |

Milton Rincon · Accepted Answer · 2022-05-13 23:24:03Z

3

For the people who has this issue on AWS Amplify. You might have to run npm install and commit the package-lock.json file, then deploy again.

answered May 13, 2022 at 23:24

Milton Rincon

961 silver badge6 bronze badges

Add a comment |

FiringBlanks · Accepted Answer · 2022-08-03 06:49:34Z

3

After battling with this issue for about 2 days, It's finally deploying successfully to Firebase Functions after deleting package-lock.json from both the src and src/functions folders.

answered Aug 3, 2022 at 6:49

FiringBlanks

2,0864 gold badges33 silver badges50 bronze badges

Add a comment |

Eric · Accepted Answer · 2022-07-13 04:57:04Z

2

If you're using pnpm, you install node dependencies via this step:

      - name: Install Node.js dependencies
        run: |
          npm i -g pnpm
          pnpm i

answered Jul 13, 2022 at 4:57

Eric

23.8k24 gold badges163 silver badges214 bronze badges

Add a comment |

just-be-weird · Accepted Answer · 2022-12-05 12:08:22Z

2

This occurred because the package lock file was not generated with npm, despite the fact that the npm ci requires npm to install the packages. And because npm requires package-lock.json, we get this error. To fix this error for GitHub actions, this what I did:

    - run: yarn install --frozen-lockfile
    - run: yarn lint
    - run: yarn test:ci

Commit diff:

answered Dec 5, 2022 at 12:08

just-be-weird

1,29010 silver badges8 bronze badges

Add a comment |

Noble Polygon · Accepted Answer · 2022-12-21 11:48:59Z

1

In my case, I had this error with npm ci while using Yarn. I eventually figured out the version of Node I was using wasn't supported. I did the following:

node -v to confirm my node version (18.0.1)
nvm use 16.13.0
Delete the node_modules directory
Delete yarn.lock
Run yarn
Run yard add + package names

After this, the error no longer occurred and the app deployed correctly.

answered Dec 21, 2022 at 11:48

Noble Polygon

80615 silver badges39 bronze badges

Add a comment |

Jonas Tomanga · Accepted Answer · 2024-01-04 21:22:52Z

1

If you have regenerated your package-lock.json file and you're still getting the same error consider the following:

Ensure you are using the same node versions across environments
Regenerate the package-lock.json file with the same version you're using in your CI or docker. i.e. npm install --package-lock-only
Check your .npmrc, in my case, it was because --legacy-per-deps=true when I was trying to npm audit --fix

answered Jan 4 at 21:22

Jonas Tomanga

1,09911 silver badges21 bronze badges

Add a comment |

Kitson · Accepted Answer · 2024-05-20 16:22:53Z

It took a combination of a few different things for me:

delete node_modules folder and package-lock.json file
run npm cache clean --force
update package.json to include engines which match the CI environment:

  // package.json
  "engines": {
    "node": "18.20.2",
    "npm": "10.5.0"
  },

make sure the correct node version was installed and being used (nvm install 18.20.2 && nvm use 18.20.2)
run npm install
commit and push the changes in the package-lock.json file

CEugene · Accepted Answer · 2022-07-13 10:11:27Z

0

This happens sometimes because of the version difference of the Node.js installed in the environment that the pipeline is running in. To fixe this, I ran: $ firebase init hosting:github then type Y to set up workflow when asked to. finally, add "npm i" as one of the scripts to run before deploying like this: npm i && npm ci && npm run build

answered Jul 13, 2022 at 10:11

CEugene

11 bronze badge

Add a comment |

cristian.nieto.dev · Accepted Answer · 2022-07-17 17:32:08Z

0

I was using npm package manager and migrated to yarn package manager removing package-lock.json file.

I had this configuration in my .circleci/config.yml file

- node/install-packages

changed to

- node/install-packages:
          pkg-manager: yarn

answered Jul 17, 2022 at 17:32

cristian.nieto.dev

1641 silver badge4 bronze badges

Not really a solution for "making npm work"
– sean
Commented Aug 3, 2022 at 12:44
you are right the solution is not to make npm work but I saw a similar error message when I migrated my project from npm to yarn that is why I thought it was important adding this comment here
– cristian.nieto.dev
Commented Aug 18, 2022 at 17:51

Add a comment |

Tobias Ernst · Accepted Answer · 2022-08-10 20:15:13Z

0

In my case the problem were some 'extraneous' packages, concretely local path dependencies. After removing them from package.json the problem was solved.

I got the error message while running npm install instead of npm ci.

answered Aug 10, 2022 at 20:15

Tobias Ernst

4,5341 gold badge35 silver badges31 bronze badges

Add a comment |

Adil Akothiat · Accepted Answer · 2022-10-01 11:41:45Z

0

On package.json I change this :

"overrides": {
    "trim-newlines": "^3.0.1"
 },

to : `

"overrides": {
    "trim-newlines": "^1.0.0"
  }

`

That Work for me successfully.

answered Oct 1, 2022 at 11:41

Adil Akothiat

716 bronze badges

Add a comment |

Thiago Silva · Accepted Answer · 2023-12-05 23:52:05Z

0

My problem was: I have changing some dependencies in package.json, so package.json didnt matches packages.lock.json. This was the error.

answered Dec 5, 2023 at 23:52

Thiago Silva

7788 silver badges20 bronze badges

Add a comment |

loki · Accepted Answer · 2022-05-27 07:39:14Z

-1

deleting deploy.json helped me, since the token is updated when overwritten

rm ~/.config/configstore/@vkontakte/vk-miniapps-deploy.json

but I have other services

answered May 27, 2022 at 7:39

loki

1,0151 gold badge7 silver badges8 bronze badges

Add a comment |

fizban · Accepted Answer · 2022-11-22 01:32:46Z

-1

I had a similar problem deploying to heroku. I simply deleted the existing package-lock.json file and then ran

    npm install

Merging the new lock file fixed the deploy.

answered Nov 22, 2022 at 1:32

fizban

616 bronze badges

Add a comment |

Collectives™ on Stack Overflow

npm ci can only install packages with an existing package-lock.json or npm-shrinkwrap.json with lockfileVersion >= 1

21 Answers 21

Not the answer you're looking for? Browse other questions tagged
npm
continuous-integration
expo
github-actions
or ask your own question.

Linked

Hot Network Questions

Collectives™ on Stack Overflow

21 Answers 21

Not the answer you're looking for? Browse other questions tagged npmcontinuous-integrationexpogithub-actions or ask your own question.

Linked

Related

Not the answer you're looking for? Browse other questions tagged
npm
continuous-integration
expo
github-actions
or ask your own question.