How to enforce package-lock.json

For anyone else hitting this issue, and wanting to be sure that a full npm installation is performed, here’s a custom plugin that you can add to your pipeline (Create Build Plugins | Netlify Docs) that seems to do the trick:

const exec = require("child_process").exec;

module.exports = {
  onPreBuild: async () => {
    await execPromise("npm install");
  },
};

function execPromise(cmd) {
  return new Promise((resolve, reject) => {
    const execProcess = exec(cmd, (error, stdout, stderr) => {
      if (error) {
        // eslint-disable-next-line no-console
        console.warn(error);
        reject(error);
      }
      resolve(stdout ? stdout : stderr);
    });
    execProcess.stdout.pipe(process.stdout);
    execProcess.stderr.pipe(process.stderr);
  });
}