From the npm 5 doc:
The --no-package-lock argument will prevent npm from creating a package-lock.json file.
Does an npm install with --no-package-lock follows the package-lock.json (if already exists) deterministic install / nested locked versions ? Or does it completly ignore it ?
For deterministic install you must have an package-lock.json and use npm ci. See https://docs.npmjs.com/cli/v7/commands/npm-ci
This command is similar to npm install, except it's meant to be used in automated environments such as test platforms, continuous integration, and deployment -- or any situation where you want to make sure you're doing a clean install of your dependencies.
