Use npm ci for Reproducible Builds

Description

Detects Dockerfiles using `npm install` instead of `npm ci` for production builds.

What Shoulder detects

Dockerfile uses 'npm install' - consider 'npm ci' for reproducible builds.

How to fix

Use `npm ci` instead of `npm install` for reproducible builds.

```dockerfile
RUN npm ci
```

Learn more: https://shoulder.dev/learn/docker/cwe-1104/npm-ci

Applies to

Languages

🐳 Dockerfile

Frameworks

docker nodejs

References

Documentation ↗ Learn about CWE-1104

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=docker-nodejs-npm-ci .