Framework: Handle shrinkwrap merge conflicts with merge driver

[blowery]

This stops treating npm-shrinkwrap.json as a binary file and instead treats it as a text file with a custom merge driver. See https://www.npmjs.com/package/npm-merge-driver and https://docs.npmjs.com/files/package-locks#resolving-lockfile-conflicts for more details.

To test, find a PR with a merge conflict in npm-shrinkwrap and rebase it locally on top of this PR. The shrinkwrap conflict should be handled automatically.

Currently this is what i used:

git fetch
git checkout update/npm-shrinkwrap-merge-drive
npm ci
git checkout renovate/lunr-0.x
git rebase update/npm-shrinkwrap-merge-drive
# watch npm-merge-driver get used

output should look like

npm-merge-driver: merging npm-shrinkwrap.json

> undefined postshrinkwrap /Users/blowery/src/a8c/wp-calypso
> node -e "fs.utimesSync( './node_modules', new Date(), new Date() );"

npm WARN redux-form@7.0.2 requires a peer of redux@^3.0.0 but none is installed. You must install peer dependencies yourself.

updated 1 package and audited 55774 packages in 13.265s
found 49 vulnerabilities (16 low, 30 moderate, 3 high)
  run `npm audit fix` to fix them, or `npm audit` for details
npm-merge-driver: npm-shrinkwrap.json successfully merged.

[matticbot]

Test live: https://calypso.live/?branch=update/npm-shrinkwrap-merge-drive

[dmsnell]

https://www.npmjs.com/package/npm-merge-driver

figures. they show "Attempting to auto-merge" but don't mention what happens when a merge fails. Do you know @blowery?

https://docs.npmjs.com/files/package-locks#resolving-lockfile-conflicts

(updated your link by the way because it had an erroneous \ in it)

this seems to suggest that a real conflict is impossible? should we ever get a merge conflict for real after this?

[blowery]

this seems to suggest that a real conflict is impossible? should we ever get a merge conflict for real after this?

Correct, the way this handles the "merge" is to run npm install --package-lock-only which generates a fresh lockfile. It's not merging in the typical sense, it's overwriting.

[blowery]

they show "Attempting to auto-merge" but don't mention what happens when a merge fails.

It throws an error. It's unclear to me if it may still write out the lockfile.

https://github.com/npm/npm-merge-driver/blob/latest/index.js#L208