Is there a way of making "npm ci" install devDependencies, or "npm install" not update package-lock.json?

I'm trying to put together documentation for new developers installing our codebase on their local development environments. I'd like to give them command(s) that:

• Installs both devDependencies and dependencies based on the versions in package-lock.json
• Doesn't update package-lock.json

"npm ci" does almost exactly what I want, but doesn't seem to install devDependencies. "npm install" does install devDependencies, but it sometimes modifies package-lock.json.

I could imagine something janky like "npm install && git checkout package-lock.json", but I feel like there must be a more idiomatic way of saying "give me a clean install of this project's dependencies for development?"

npm ci does install both dependecies and dev dependencies. But if you use npm ci --production or if your NODE_ENV is set to production, then it avoids installing dev dependencies. Please check docs here.

With the --production flag (or when the NODE_ENV environment variable is set to production), npm will not install modules listed in devDependencies.

NOTE: The --production flag has no particular meaning when adding a dependency to a project.