Use lockfile instead of package.json dependencies?

[devinrhode2]

A bit more precise, would be to hash lockfile instead of package.json dependencies.

[mtHuberty]

Would be cool to be able to configure whether it runs npm install or npm ci for example.

Edit: This functionality seems to exist but isn't documented