Hack npm shrinkwrap to be ordered and more stable

custom-shrinkwrap.sh

#!/usr/bin/env bash
set -eu -o pipefail

npm_registry="https://internal-npm-registry..."

# Check environment, different npm versions package shrinkwrap differently.
node -v | grep --silent '5.8.0' \
  || { echo 'Failed. Expected version node v5.8.0 was not found.'; exit 1;}
npm -v | grep --silent '3.7.3'  \
  || { echo 'Failed. Expected version npm 3.7.3 was not found.'; exit 1; }

npm config get registry | grep --silent $npm_registry \
  || echo "Failed. Expected npm registry to be $npm_registry";

# Shrinkwrap
npm prune
npm shrinkwrap --dev # include devDependencies, crucial for front-end projects that use node for tooling
node ./order-shrinkwrap.js

order-shrinkwrap.js

#!/usr/bin/env node
'use strict';

var fs = require('fs');
var stringify = require('json-stable-stringify');
var url = require('url');
var INTERNAL_REGISTRY_HOST = 'internal-registry';

// Normalize all 'resolved' keys in npm-shrinkwrap to the internal npm registry, and use https always.
function normalizeResolved(input) {
  var inputUrlObject = url.parse(input);
  inputUrlObject.protocol = inputUrlObject.protocol === 'http:' ? 'https:' : inputUrlObject.protocol;
  if (inputUrlObject.host === 'registry.npmjs.org') {
    inputUrlObject.host = INTERNAL_REGISTRY;
    inputUrlObject.pathname = '/api/npm/js-virtual/registry.npmjs.org' + inputUrlObject.pathname;
  }
  return url.format(inputUrlObject);
};

var shrinkwrap = fs.readFileSync('npm-shrinkwrap.json', 'utf-8');

// Normal JSON stringify does not guarantee order, so use json-stable-stringify to order it.
var orderedShrinkwrap = stringify(JSON.parse(shrinkwrap,
  function (key, value) {
    return key === 'resolved' ? normalizeResolved(value) : value;
  }), { space: 2 });

fs.writeFileSync('npm-shrinkwrap.json', orderedShrinkwrap);