Should you commit a lock file?
Why it matters
For an application, yes: the lock file makes the build you tested the build you ship. For an npm or Python library it is never shipped to users, so DevOps Check does not require one there.
How to fix it
What to do: Pin exact versions of all dependencies.
Commit the lock file to git — do NOT add it to
# Python — pip freeze:
pip freeze > requirements.txt
# Python — pip-tools (recommended):
pip install pip-tools
pip-compile --generate-hashes requirements.in
# Node.js:
npm install # creates package-lock.json
# or
yarn install # creates yarn.lock
Commit the lock file to git — do NOT add it to
.gitignore.Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.