build: Install dependencies in CI with frozen lockfile

[lforst]

Because we keep running into situations where our builds fail out of the blue (#5327 (comment), #5296 (comment)), I propose we install our dependencies in CI with --frozen-lockfile which simply installs packages exactly as described in yarn.lock. Additionally, we want to pin as many dependencies in our CI as possible, just so we can have reproducible builds.

This PR:

• adds a --frozen-lockfile flag to yarn install in our CI
• Pins a ts-node dependency version in CI

[Lms24]

I think I missed parts around the discussion about this in Daily. Happy to ✅ this but are there potential drawbacks other than us potentially then depending on a bug in the specific version we pinned?

[lforst]

I think I missed parts around the discussion about this in Daily. Happy to ✅ this but are there potential drawbacks other than us potentially then depending on a bug in the specific version we pinned?

Yeah, let's definitely discuss this with the rest of the team!

The upside this change has, is that we will not have broken things out of nowhere. Imagine rollup has a bug in a new patch. We didn't notice locally because we don't run yarn install in between our local builds, but CI will produce corrupted builds because it uses the new patch - the worst-case scenario being during a release build.

With this change we will be able to test things, each time we update our yarn.lock. We might still depend on bugs, but at the very least there's no rug being pulled beneath our feet when the bug is suddenly fixed in a patch.

[Lms24]

Thanks for explaining. Makes sense to me!

[AbhiPrasad]

This won't help with ember, as it has a separate install process for it's integration tests, but overall is a good change that will prevent stale yarn.lock!

[lforst]

Merging this. If this messes something up we can revisit.