Fix --frozen-lockfile not preventing lockfile changes

__tests__/commands/install/lockfiles.js

@@ -71,6 +71,25 @@ test.concurrent("throws an error if existing lockfile isn't satisfied with --fro
   expect(thrown).toEqual(true);
 });
 
+test.concurrent('throws an error if lockfile is changed by install with --frozen-lockfile', async (): Promise<
+  void,
+> => {
+  const reporter = new reporters.ConsoleReporter({});
+
+  let thrown = false;
+  try {
+    await runInstall(
+      {frozenLockfile: true},
+      'install-throws-error-if-lockfile-rearranged-and-frozen-lockfile',
+      () => {}
+    );
+  } catch (err) {
+    thrown = true;
+    expect(err.message).toContain(reporter.lang('frozenLockfileError'));
+  }
+  expect(thrown).toEqual(true);
+});
+
 test.concurrent('install transitive optional dependency from lockfile', (): Promise<void> => {
   return runInstall({}, 'install-optional-dep-from-lockfile', (config, reporter, install) => {
     expect(install && install.resolver && install.resolver.patterns['fsevents@^1.0.0']).toBeTruthy();

__tests__/fixtures/install/install-throws-error-if-lockfile-rearranged-and-frozen-lockfile/package.json

@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "minimatch": "^3.0.3"
+  }
+}

__tests__/fixtures/install/install-throws-error-if-lockfile-rearranged-and-frozen-lockfile/yarn.lock

@@ -0,0 +1,22 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+brace-expansion@^1.0.0, brace-expansion@^1.1.7:
+  version "1.1.7"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.7.tgz#3effc3c50e000531fb720eaff80f0ae8ef23cf59"
+  dependencies:
+    balanced-match "^0.4.1"
+    concat-map "0.0.1"
+
+
+"minimatch@2 || 3", minimatch@^3.0.0, minimatch@^3.0.2, minimatch@^3.0.3:
+  version "3.0.4"
+  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.0.4.tgz#5166e286457f03306064be5497e8dbb0c3d32083"
+  dependencies:
+    brace-expansion "^1.1.7"
+
+minimatch@3.0.3:
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.0.3.tgz#2a4e4090b96b2db06a9d7df01055a62a77c9b774"
+  dependencies:
+    brace-expansion "^1.0.0"

src/cli/commands/install.js

@@ -337,7 +337,7 @@ export class Install {
       return false;
     }
     const match = await this.integrityChecker.check(patterns, lockfileCache, this.flags);
-    if (this.flags.frozenLockfile && match.missingPatterns.length > 0) {
+    if (this.flags.frozenLockfile && (match.missingPatterns.length > 0 || match.integrityError)) {
       throw new MessageError(this.reporter.lang('frozenLockfileError'));
     }