I don't know why they copied NPM's backwards `npm install/ci` thing. Most people think that `install` does use the lock file.