title: Using "npm ci" instead of "npm install" for deterministic project setup
body: <p>Given a project where the <code>package-lock.json</code> is managed in source control with the goal that all developers on the team get exactly the same dependencies.</p>
  
  <p>From the documentation of npm I think developers should use <code>npm ci</code> to set up their development environment and probably also later when dependencies are updated.</p>
  
  <p>However the instructions I see in typical npm projects is still to use <code>npm install</code>.</p>
  
  <p>Is there a reason developers should use <code>npm install</code> instead of <code>npm ci</code>? Does <code>npm ci</code> have disadvantages in this scenario?</p>
  
  <p>I understand that <code>npm ci</code> does delete the whole <code>node_modules</code> and therefore potentially re-download some dependencies that were already present.</p>
  
  <p>But with <code>npm install</code> I had regularly the case that an <code>npm install</code> is actually changing the <code>package-lock.json</code> (see links below), which is definitely not what is expected in a traditional project setup, where the main goal is that all developers get the same environment.<br>
  Therefore I would like to recommend to use <code>npm ci</code>.</p>
  
  <p>Examples of "unexpected" behavior of <code>npm install</code>:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/45022048/why-does-npm-install-rewrite-package-lock-json">Why does &quot;npm install&quot; rewrite package-lock.json?</a></li>
  <li><a href="https://github.com/npm/npm/issues/17722" rel="noreferrer">https://github.com/npm/npm/issues/17722</a></li>
  <li><a href="https://npm.community/t/package-lock-json-keeps-changing-between-platforms-and-runs/1129/3" rel="noreferrer">https://npm.community/t/package-lock-json-keeps-changing-between-platforms-and-runs/1129/3</a></li>
  <li><a href="https://github.com/npm/npm/issues/20434" rel="noreferrer">https://github.com/npm/npm/issues/20434</a></li>
  <li><a href="https://npm.community/t/package-lock-json-changes-from-one-npm-install-to-the-next/1454" rel="noreferrer">https://npm.community/t/package-lock-json-changes-from-one-npm-install-to-the-next/1454</a></li>
  </ul>