From b06a897b5b38e05bbb05dacc1042ccfeb7b097f1 Mon Sep 17 00:00:00 2001
From: Paul Gschwendtner <paulgschwendtner@gmail.com>
Date: Wed, 10 Oct 2018 20:26:05 +0200
Subject: [PATCH] build: ensure dependencies are properly locked (#13482)

* Since we lock our dependencies in the `yarn.lock` file, we need to enforce that the lock file is in sync with the `package.json` file (similar as in angular/angular)
* Since we cache the dependenices & the yarn cache within Travis, it can happen that the node modules are stale (there is no checksum mechanism in Travis). In that case we need to purge the node modules and re-install.
---
 .travis.yml                  |  2 +-
 scripts/ci/travis-install.sh | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100755 scripts/ci/travis-install.sh

diff --git a/.travis.yml b/.travis.yml
index 814ddbe272e..abc838fba9d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -56,7 +56,7 @@ before_install:
   - if [[ "$TRAVIS_EVENT_TYPE" == "cron" ]]; then ./scripts/install-angular-snapshot.sh --only-save; fi
 
 install:
-  - yarn install --frozen-lockfile --non-interactive
+  - ./scripts/ci/travis-install.sh
 
 before_script:
   - mkdir -p $LOGS_DIR
diff --git a/scripts/ci/travis-install.sh b/scripts/ci/travis-install.sh
new file mode 100755
index 00000000000..7b0fb4878a7
--- /dev/null
+++ b/scripts/ci/travis-install.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# Script that installs the project node module dependencies within Travis. The script also ensures that the cached
+# node modules are in sync with the lock file and also checks that if the lock file is in sync with the
+# project `package.json` file.
+
+# Go to the project root directory
+cd $(dirname $0)/../..
+
+# Yarn's integrity check command throws in the following scenarios:
+#   1) Cached node modules are not in sync with lock file
+#   2) Lock file is not in sync with `package.json`
+
+# In case the integrity check passes, we just use the cached/locked node modules. If it fails, we want to purge the
+# node modules and run Yarn with `--frozen-lockfile`. Running with a frozen lockfile ensures that outdated/cached node
+# modules will be refreshed to **match** the actual lock file. Otherwise, if the `package.json` does not match with
+# the lock file, Yarn automatically throws an error due to the `--frozen-lockfile` option.
+if ! (yarn check --integrity &> /dev/null); then
+  echo "Cached node modules are not in sync. Purging and refreshing..."
+  rm -rf ./node_modules/
+  yarn install --frozen-lockfile --non-interactive
+else
+  echo "Cached node modules have been checked and are in sync with the lock file."
+fi
\ No newline at end of file