Production and CI

Commit flog.lock alongside the manifests. CI should consume the reviewed graph, not resolve a different one on every build.

Install and build#

With Flog and the project's required runtime installed:

flog install
flog run test
flog run build

The script commands require matching entries in package.json. For source workspace builds with dependency ordering, use flog build instead of the last command; see workspace builds.

Plain flog install is already strict about the lock. A missing or stale lock, or a target absent from the lock, fails rather than silently updating it.

Separate build and runtime dependencies#

Builds commonly need development dependencies. Use a full install in the build stage. A separate runtime stage can install only production dependencies:

flog install --prod

Do not use a production-only install as the input to a build that needs dev tools. Copy the appropriate built output into your runtime image as well.

Control scripts and network access#

Review installation and lifecycle controls before enabling dependency scripts. --ignore-scripts suppresses them; --offline requires the necessary artifacts to already be cached.

For cross-platform CI, deliberately record the necessary targets with flog lock. See lockfiles and resolution.