node script that returns non-zero exit code if dependencies are updated but not the lock file

enforce-package-lock

#!/usr/bin/env node
const cp = require('child_process');
const pkg = require('../package.json');

const filesToParse = JSON.parse(process.env.files);

const checkPackageJSON = () => {
  const s = cp.execSync('git diff HEAD~1 HEAD package.json').toString();
  const changedLines = s
    .match(/[+]( ){2,4}.*/g)
    .map((line) => line.replace(/[+ "]/g, '').split(':').shift());

  // find the keys associated with the line with the +
  // find that key in the package.json file
  // see if it is in devDependencies or dependencies
  // if so... we care
  // if not... we don't.
  return changedLines.reduce((acc, key) => {
    return acc || !!pkg.devDependencies[key] || !!pkg.dependencies[key];
  }, false);
};

if (
  filesToParse.includes('package.json') &&
  !filesToParse.includes('package-lock.json') &&
  checkPackageJSON()
) {
  console.log(`************************************************
It appears you changed the package.json file but
did not npm install afterwards. Please do so and
commit the lock file
************************************************`);
  process.exit(1);
}