[PR] Centralize NPM dependencies for website builds [logging-parent]

["ppkarwasz (via GitHub)" <gi...@apache.org>]

ppkarwasz opened a new pull request, #506:
URL: https://github.com/apache/logging-parent/pull/506

   This is a second attempt at #367, which locked the Antora dependencies with `npm-shrinkwrap.json`, but had to be rolled back in #409: it installed the dependencies differently in `logging-parent` (`npm install .`) than in the other repositories (`npm install github:apache/logging-parent#rel/x.y.z`).
   
   Now that the `gha/v0` branch exists solely for version pinning, the canonical `package.json` and `package-lock.json` can live here instead:
   
   - Website deployments pass the new `npm-dependencies-ref` input to `deploy-site-reusable`, which downloads both files (from this branch, or from any Git repository via `npm-dependencies-repository`) before building the website, so all deployed websites use the exact same dependency tree. Release website staging omits the input and uses the `package.json` committed in each repository.
   - Dependabot updates the NPM dependencies on this branch only (see the companion PR against `main` for the `dependabot.yaml` change).
   - The Node.js cache is keyed on the hash of both files.
   - Unlike #367, the lock file keeps its standard name: npm 12 removed all support for `npm-shrinkwrap.json` (npm/cli#9262), and a shrinkwrap was never honored for Git dependencies anyway (npm/cli#4583).
   
   Making website builds from released source archives reproducible will be addressed separately.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Centralize NPM dependencies for website builds [logging-parent]

["ramanathan1504 (via GitHub)" <gi...@apache.org>]

ramanathan1504 merged PR #506:
URL: https://github.com/apache/logging-parent/pull/506


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org