📌 Use the pinned version of the npm packages

Although we tried to override the `package-lock.json`, it is overridden, in
turn by npm when we run npm install after changing `package.json`

And because we have a `package.serve.json` and a `configure_xml_and_js` script,
we change the `package.json` every time we clone, so the `package-lock.json`
never stick.
#1198 (comment)

The fix is to re-copy just the lock file after the first `npm install` and then
run `npm install` again, essentially duplicating the flow in
#1198 (comment)

setup/setup_native.sh

@@ -93,6 +93,14 @@ cp setup/google-services.fake.for_ci.json google-services.json
 echo "Setting up all npm packages"
 npm install
 
+# We need to re-copy and re-run to avoid package-lock.json being overwritten
+# https://github.com/e-mission/e-mission-phone/pull/1198#issuecomment-2661629587
+echo "Copy over the package-lock.json but not the other files"
+cp package-lock.cordovabuild.json package-lock.json
+
+echo "Re-run npm install to install the locked packages"
+npm install
+
 # By default, node doesn't fail if any of the steps fail. This makes it hard to
 # use in a CI environment, and leads to people reporting the node error rather
 # than the underlying error. One solution is to pass in a command line argument to node

setup/setup_serve.sh

@@ -10,6 +10,14 @@ echo "Configuring the repo for UI development"
 echo "Setting up all npm packages"
 npm install
 
+# We need to re-copy and re-run to avoid package-lock.json being overwritten
+# https://github.com/e-mission/e-mission-phone/pull/1198#issuecomment-2661629587
+echo "Re-copy over the package-lock.json and not the other files"
+cp package-lock.serve.json package-lock.json
+
+echo "Re-run npm install to install the locked packages"
+npm install
+
 echo "Pulling the plugin-specific UIs"
 npm run setup-serve