ci install of dependencies from fixed package-lock.json versions

Author: manwaring

.circleci/config.yml

@@ -1,11 +1,3 @@
-# Note: YAML anchors allow an object to be re-used, reducing duplication. The ampersand
-# declares an alias for an object, then later the `<<: *alias` syntax dereferences it.
-#
-# See http://blog.daemonl.com/2016/02/yaml.html and
-# https://medium.com/@kinghuang/docker-compose-anchors-aliases-extensions-a1e4105d70bd
-# for more information about how to use anchors.
-#
-# To validate changes use an online parser, eg. http://yaml-online-parser.appspot.com/
 anchors:
   container-config: &container-config
     docker:
@@ -15,7 +7,7 @@ anchors:
 
   load-cache: &load-cache
     restore_cache:
-      key: dependency-cache-{{ checksum "package.json" }}
+      key: dependency-cache-{{ checksum "package-lock.json" }}
 
 ## Circle CI configuration, see https://circleci.com/docs/2.0/configuration-reference/
 version: 2
@@ -27,9 +19,9 @@ jobs:
       - *load-cache
       - run:
           name: Install dependencies
-          command: npm i
+          command: npm ci
       - save_cache:
-          key: dependency-cache-{{ checksum "package.json" }}
+          key: dependency-cache-{{ checksum "package-lock.json" }}
           paths:
             - node_modules