fix: Pin build dependencies

Author: eps1lon

.github/workflows/validate.yml

@@ -40,7 +40,7 @@ jobs:
       - name: 📥 Download deps
         uses: bahmutov/npm-install@v1
         with:
-          useLockFile: false
+          useLockFile: true
 
       # TODO: Can be removed if https://github.com/kentcdodds/kcd-scripts/pull/146 is released
       - name: Verify format (`npm run format` committed?)
@@ -76,7 +76,7 @@ jobs:
       - name: 📥 Download deps
         uses: bahmutov/npm-install@v1
         with:
-          useLockFile: false
+          useLockFile: true
 
       - name: 🏗 Run build script
         run: npm run build

.gitignore

@@ -3,7 +3,6 @@ coverage
 dist
 .DS_Store
 
-# these cause more harm than good
-# when working with contributors
-package-lock.json
-yarn.lock
+# Reproducible builds are important. 
+# Check the git-blame before adding this line back
+# package-lock.json

.npmrc

@@ -1,2 +1 @@
 registry=https://registry.npmjs.org/
-package-lock=false