How to avoid changes in package-lock.json when using local and BAS development in parallel?

[SebastianEsch]

Hello BAS Team,

we've developed a CAP application in our local VS Code environment. Now we're handing over the applicaiton to the customer and they must use BAS as no local IDE installation is allowed. During the setup of the project in BAS I've noticed the following issue:

When running "npm install" in BAS the original content of package-lock.json e.g.:

    "@sap/cds-odata-v2-adapter-proxy": {
      "version": "1.8.2",
      "resolved": "https://registry.npmjs.org/@sap/cds-odata-v2-adapter-proxy/-/cds-odata-v2-adapter-proxy-1.8.2.tgz",
      "integrity": "sha512-fN36iWJSPIOvxnPgbKmbD4FHvXV2QxUR3cVzWLNHmVY9/C1ky1oODfsYN4fkIuxj4nuIfjYdKIsaLjnv50fRmw==",

is replaced with:

    "@sap/cds-odata-v2-adapter-proxy": {
      "version": "1.8.2",
      "resolved": "http://nginx-redirector.repo-cache.svc.cluster.local/repository/appstudio-npm-group/@sap/cds-odata-v2-adapter-proxy/-/cds-odata-v2-adapter-proxy-1.8.2.tgz",
      "integrity": "sha512-fN36iWJSPIOvxnPgbKmbD4FHvXV2QxUR3cVzWLNHmVY9/C1ky1oODfsYN4fkIuxj4nuIfjYdKIsaLjnv50fRmw==",

as you can see the version and integrity fields are exactly the same. But the resolved field does change and this results in a change that either needs to be commited to the Git repository or discarded. My temporary solution for the moment is to use:

npm ci

I understand that the registry is configured to a different location:

registry = "http://nginx-redirector.repo-cache.svc.cluster.local/repository/appstudio-npm-group/"<br>

to improve performance and avoid not necessary traffic. But maybe there is a way to keep the original resolved value?

Best Regards
Gregor

[SebastianEsch]

I noticed this too. This is quite annoying if you have mixed setups with BAS and VS Code developers.

The BAS internal resolved URL also breaks in CI/CD pipelines. From my point of view, a NPM cache should be transparent and not change your development artefacts.

Kind regards,

Sebastian

[michelle-van-lieshout]

I developed in VS before too and then wanted to change to the BAS environment to add some Fiori elements -elements. From BAS I need to deploy to a cloud foundry environment.

This change, that BAS makes in comparison to Visual Studio Code, also results in errors trying to deploy to a CF environment. Deploying to CF now is not possible from the BAS environment. I tried removing the "ignore: "*node_modules*"" from the build parameters in the mta.yaml but this didn't solve the problem. I keep getting the error: Unable to build dependencies: exit status 1

This error is due to the network requests to the local cache failing:

network request to http://nginx-redirector.repo-cache.svc.cluster.local/repository/appstudio-npm-group/yallist/-/yallis... failed, reason: getaddrinfo ENOTFOUND nginx-redirector.repo-cache.svc.cluster.local (STDOUT, STG)#

A solution to this problem would therefore be very helpful to me too! Keep me updated 🙂

[gregorw]

michelle-van-lieshout in which step does your error occur? During mbt build in BAS or during the MTA deployment?

[michelle-van-lieshout]

gregorw it occurs during the MTA deployment. I solved it for now by pulling everything from git in VS, then running all npm installs and copying everything within the package-lock.json to BAS (so you get the registry.xxxx link instead of the nginx-redirectorxxxxx links within the package-lock.json files).

[gregorw]

Can you please file an incident via SAP Support so we get pressure also via an official support channel.

[michelle-van-lieshout]

I have filed an incident as well 😉

[michelle-van-lieshout]

gregorw: The incident: 896313 / 2021

[MarcusSchlzel]

I agree with Gregor and the others that the best practice is to commit the package-lock and use "npm ci" to get a reproducable installation (btw not consistently used by SAP generators and buildpacks). I think it is a good option for beginners or BAS only users, but it should be possible to override this artifact repository somehow (with .npmrc it is currently not possible).

But it looks like they are currently doing it only for npm. Yarn is accessing the public repo directly. And i think that yarn is also installed in the default CF buildpack.

So my solution, for the time being, would be to switch to yarn.

[former_member6792]

Hi Marcus, I agree with you (with .npmrc ) it is not overriding. Even with manual overriding in package-lock.json it is having the same error on cf push. Still there is no solution from SAP End