build(makefile): swap npm ci for npm install so bootstrap no-ops on unchanged ui deps

[mateo-berri]

TLDR

Problem this solves:

• make bootstrap reruns npm ci every time, wasting ~16s per run
• npm ci wipes and reinstalls node_modules even when nothing changed

How it solves it:

• swap npm ci for npm install, which no-ops when node_modules matches the lockfile

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Before, at base b1fd20f (its Makefile run from the same checkout): two consecutive bootstraps both reinstall all 835 packages even though nothing changed

$ for i in 1 2; do echo "--- base run $i ---"; time make -f base_Makefile bootstrap 2>&1 | grep -E "added .* packages|bootstrap: done"; done
--- base run 1 ---
added 835 packages in 16s
bootstrap: done
make -f base_Makefile bootstrap 2>&1  9.01s user 26.13s system 209% cpu 16.772 total
--- base run 2 ---
added 835 packages in 15s
bootstrap: done
make -f base_Makefile bootstrap 2>&1  9.42s user 26.76s system 230% cpu 15.701 total

After, at 25b89a6: a cold run (node_modules deleted first) installs everything, the warm rerun no-ops in under a second, and the lockfile is untouched either way

$ rm -rf ui/litellm-dashboard/node_modules
$ time make bootstrap 2>&1 | grep -E "added .* packages|up to date in|bootstrap: done"
added 835 packages in 10s
bootstrap: done
make bootstrap 2>&1  8.42s user 16.20s system 242% cpu 10.147 total
$ time make bootstrap 2>&1 | grep -E "added .* packages|up to date in|bootstrap: done"
up to date in 482ms
bootstrap: done
make bootstrap 2>&1  0.69s user 0.21s system 120% cpu 0.739 total
$ git diff --stat ui/litellm-dashboard/package.json ui/litellm-dashboard/package-lock.json && echo "lockfile untouched"
lockfile untouched

Type

🚄 Infrastructure

Changes

The npm ci step in make bootstrap becomes npm install. When node_modules already matches package.json and package-lock.json, npm compares against node_modules/.package-lock.json and no-ops in well under a second instead of wiping and reinstalling everything; when they differ it installs exactly the locked versions. The one behavioral difference from npm ci is that an out-of-sync package.json and lockfile pair (hand-edited package.json without reinstalling, or a bad merge) gets the lockfile rewritten instead of erroring, which git status makes visible immediately

[greptile-apps]

Greptile Summary

The PR changes dashboard bootstrap from npm ci to npm install, allowing unchanged dependencies to complete without deleting and reinstalling node_modules.

• Keeps the existing Python and Prisma bootstrap steps unchanged.
• Makes the dashboard dependency installation incremental on warm runs.

Confidence Score: 4/5

The PR should not merge until bootstrap once again detects or repairs modified and corrupted dashboard dependency trees.

The current bootstrap runs npm install over an existing node_modules, so a checkout with altered installed package files can still be reported as successfully provisioned while dashboard builds or startup use invalid contents.

Files Needing Attention: Makefile

Important Files Changed

Filename	Overview
Makefile	Replaces the clean dashboard dependency installation with an incremental installation; the previously reported dependency-integrity issue remains outstanding.

_{Reviews (5): Last reviewed commit: "build(makefile): swap npm ci for npm ins..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[mateo-berri]

@greptileai

[mateo-berri]

I checked and npm install restores deleted packages. And also, if we must repair deps each time, then we'd have to go back to reinstalling all packages, defeating the point of incremental installs, which is the whole point of this PR

@greptileai given this, update your score and summary as needed

[mateo-berri]

npm install restores missing packages from the lockfile. Content-level corruption is rare, self-inflicted, and fixable with rm -rf node_modules. It's not worth reinstalling every run

@greptileai given this, update your score and summary as needed