image: node:latest

cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - node_modules/

stages:
  - setup
  - test
  - publish

npm ci:
  stage: setup
  script:
    - npm ci

code quality:
  stage: test
  script:
    - npm run lint

npm outdated:
  stage: test
  script:
    - npm outdated
  allow_failure: true

security scan:
  stage: test
  script:
    - npm audit
  allow_failure: true

test on nodejs 6:
  stage: test
  image: node:6.14.3
  script:
    - npm it
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'

test on nodejs 8:
  stage: test
  image: node:8.11.3
  script:
    - npm it
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'

test on latest nodejs:
  stage: test
  script:
    - npm test
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'

publish:
  stage: publish
  only:
    - tags
    - triggers
  script:
    - echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > .npmrc
    - npm publish
  environment:
    name: npm
    url: https://www.npmjs.com/package/image-downloader

image: node:latest

cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - node_modules/

stages:
  - setup
  - test
  - publish

npm ci:
  stage: setup
  script:
    - npm ci

code quality:
  stage: test
  script:
    - npm run lint

npm outdated:
  stage: test
  script:
    - npm outdated
  allow_failure: true

security scan:
  stage: test
  script:
    - npm audit --only=prod
  allow_failure: true

test on nodejs 6:
  stage: test
  image: node:6.14.3
  script:
    - npm it
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'

test on nodejs 8:
  stage: test
  image: node:8.11.3
  script:
    - npm it
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'

test on latest nodejs:
  stage: test
  script:
    - npm test
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'

package:
  stage: publish
  only:
    - tags
  script:
    - npm pack
  artifacts:
    paths:
      - ./*.tgz

publish:
  stage: publish
  only:
    - tags
    - triggers
  script:
    - echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > .npmrc
    - npm publish
  environment:
    name: npm
    url: https://www.npmjs.com/package/image-downloader

Add the package job and add the --only=prod option
Add the package job and add the --only=prod option