build: use npm ci for clean, reproducible installs

[SunsetDrifter]

Why

Now that the lockfile is tracked (#838), switch installs to npm ci for clean, deterministic, lockfile-pinned installs. Third of the docs build/deploy speed series.

What

• pr-build.yml: npm install → npm ci, and enable setup-node's cache: 'npm' (caches ~/.npm keyed on the lockfile).
• docker/Dockerfile: npm install --production → npm ci --omit=dev.

Impact

• Deterministic installs from the lockfile (no more re-resolving ^ ranges).
• Faster, cache-assisted installs on PR CI.
• CI now fails fast on an out-of-sync lockfile — the intended safety net (documented in CLAUDE.md via build: track package-lock.json for reproducible installs #838).

Testing

Ran both install paths in an isolated dir (did not touch the repo's node_modules):

• npm ci --omit=dev (Docker path): exit 0; next 16.1.6, react, shiki present; eslint/prettier correctly omitted.
• full npm ci (pr-build path): exit 0; devDeps present.

Depends on

• build: track package-lock.json for reproducible installs #838 (lockfile tracked) — merged. ✅

Test plan

• npm ci in sync with committed lockfile (both --omit=dev and full)
• pr-build CI green

Summary by CodeRabbit

• Chores
  • Updated build and container dependency installation to use cleaner, lockfile-based installs.
  • Enabled dependency caching in the build workflow to help speed up repeated runs.
  • Improved install consistency by omitting development-only packages in production image builds.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR build workflow now caches npm dependencies via actions/setup-node@v4 and installs dependencies using npm ci instead of npm install. Similarly, the Dockerfile replaces npm install --production with npm ci --omit=dev, updating its comment accordingly.

Changes

Lockfile-based npm installs

Layer / File(s)	Summary
CI workflow npm caching and install .github/workflows/pr-build.yml	Adds cache: 'npm' to actions/setup-node@v4 and switches the install step from npm install to npm ci.
Dockerfile clean install docker/Dockerfile	Replaces npm install --production with npm ci --omit=dev and updates the accompanying comment.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Poem

A rabbit hops through logs and locks,
Swapping installs for tidy blocks,
npm ci, clean and neat,
Caching carrots for a quicker feat,
Hop, hop, ship! 🐇📦

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: switching build installs to npm ci for reproducible installs.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/npm-ci

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}