This error occurs when running npm ci without a package-lock.json file. Generate the lockfile with npm install and commit it to version control.
Fixes npm ERR! code ECILOCKFILE npm ERR! The package-lock.json file must be present for `npm ci`
npm installnpm installnpm ERR! code ECILOCKFILEnpm ERR! The package-lock.json file must be present for `npm ci`
npm installOn this page
npm ci (clean install) is designed for continuous integration environments where reproducible builds are essential. It requires package-lock.json to exist because it installs exactly the versions specified in the lockfile. Without a lockfile, npm ci cannot guarantee reproducible builds - different runs might install different versions of transitive dependencies, potentially causing subtle bugs. This error usually means package-lock.json is either missing from the repository or excluded by .gitignore.
Create package-lock.json:
npm installThis generates package-lock.json based on your package.json.
Ensure package-lock.json is NOT in .gitignore:
grep "package-lock" .gitignoreIf found, remove the line. The lockfile SHOULD be committed.
# Remove from .gitignore if present
sed -i '/package-lock/d' .gitignoreAdd and commit:
git add package-lock.json
git commit -m "Add package-lock.json for reproducible builds"
git pushYour CI pipeline should now work:
# Example GitHub Actions
- name: Install dependencies
run: npm cinpm ci will use the committed lockfile for reproducible installs.
Why commit package-lock.json?
1. Reproducibility: Everyone gets identical dependency trees
2. Security: Lockfile captures audited versions
3. Speed: npm ci is faster than npm install
4. Debugging: You can see exactly what changed between commits
For libraries (packages you publish to npm), some teams prefer not to commit lockfiles since consumers use their own resolution. But for applications, always commit it.
If you're using yarn instead of npm, commit yarn.lock:
git add yarn.lockIf you're using pnpm, commit pnpm-lock.yaml:
git add pnpm-lock.yamlFor monorepos, ensure the lockfile is at the root and covers all workspaces.