Repository: dbt-labs/dbt-core

Issue:
[CT-3514] [Feature] Use formatting for `package-lock.yml` that passes `yamlint` linting checks
### Is this a new bug in dbt-core?

- [X] I believe this is a new bug in dbt-core
- [X] I have searched the existing issues, and I could not find an existing issue for this bug

### Current Behavior

`package-lock.yml` does not have a document separator and does not have correct indentation.

Run `ymllint --strict` on a newly created `package-lock.yml`.

```bash
> dbt deps
> cat package-lock.yml
packages:
- package: dbt-labs/audit_helper
  version: 0.9.0
- package: dbt-labs/codegen
  version: 0.12.1
- package: dbt-labs/dbt_utils
  version: 1.1.1
sha1_hash: 3cf6af6c0a4ee17cf53205ae383d515915b55f5f
> docker run --rm -v $(pwd):/data cytopia/yamllint:latest --strict /data/package-lock.yml
/data/package-lock.yml
  1:1       warning  missing document start "---"  (document-start)
  2:1       error    wrong indentation: expected at least 1  (indentation)

> echo $?
1
```

### Expected Behavior

That it be generated correctly formatted. For example here, when manually fixed it passes.

```bash
> cat package-lock.yml
---

packages:
  - package: dbt-labs/audit_helper
    version: 0.9.0
  - package: dbt-labs/codegen
    version: 0.12.1
  - package: dbt-labs/dbt_utils
    version: 1.1.1
sha1_hash: 3cf6af6c0a4ee17cf53205ae383d515915b55f5f
> docker run --rm -v $(pwd):/data cytopia/yamllint:latest --strict /data/package-lock.yml
> echo $?
0
```

### Steps To Reproduce

As above.

### Relevant log output

```shell
N/A
```


### Environment

```markdown
- OS: Linux
- Python: 3.11
- dbt: 1.7.4
```


### Which database adapter are you using with dbt?

snowflake

### Additional Context

_No response_


Discussion:
Thanks for noticing this and reaching out about it with a nice write-up @nevdelap ! 🤩 

This seems to only affect linting rather than the actual behavior of dbt, so I'm going to re-categorize this as a feature request.

I don't see a need for us to add the `---` part since we haven't typically included it in our style guide for other YAML documents like `dbt_project.yml`, etc. Do you see value in us adding the document start for `package-lock.yml`?

The workaround we'd recommend is to use the various [configuration options for `yamllint`](https://yamllint.readthedocs.io/en/stable/configuration.html) to either ignore `package-lock.yml` entirely or to relax the strictness.

In the meantime, I'm going to label it as a `good_first_issue` for a community member to tackle the indentation portion.

### Acceptance criteria
- after running `dbt deps`, `package-lock.yml` contains an indention level of 2 spaces and looks similar to below
- `yamllint --strict package-lock.yml --no-warnings` has an exit code of 0
  - use `echo $?` to see the exit code

  `package-lock.yml`
  
  ```yaml
  packages:
    - package: dbt-labs/audit_helper
      version: 0.9.0
  sha1_hash: 3cf6af6c0a4ee17cf53205ae383d515915b55f5f
  ```

Resolving patch:
diff --git a/core/dbt/task/deps.py b/core/dbt/task/deps.py
--- a/core/dbt/task/deps.py
+++ b/core/dbt/task/deps.py
@@ -201,7 +201,7 @@ def lock(self) -> None:
         )
 
         with open(lock_filepath, "w") as lock_obj:
-            yaml.safe_dump(packages_installed, lock_obj)
+            yaml.dump(packages_installed, lock_obj, Dumper=dbtPackageDumper)
 
         fire_event(DepsLockUpdating(lock_filepath=lock_filepath))
 


Test patch:
diff --git a/tests/functional/dependencies/test_dependency_options.py b/tests/functional/dependencies/test_dependency_options.py
--- a/tests/functional/dependencies/test_dependency_options.py
+++ b/tests/functional/dependencies/test_dependency_options.py
@@ -35,10 +35,10 @@ def test_deps_lock(self, clean_start):
         assert (
             contents
             == """packages:
-- package: fivetran/fivetran_utils
-  version: 0.4.7
-- package: dbt-labs/dbt_utils
-  version: 1.1.1
+  - package: fivetran/fivetran_utils
+    version: 0.4.7
+  - package: dbt-labs/dbt_utils
+    version: 1.1.1
 sha1_hash: 71304bca2138cf8004070b3573a1e17183c0c1a8
 """
         )
@@ -52,10 +52,10 @@ def test_deps_default(self, clean_start):
         assert (
             contents
             == """packages:
-- package: fivetran/fivetran_utils
-  version: 0.4.7
-- package: dbt-labs/dbt_utils
-  version: 1.1.1
+  - package: fivetran/fivetran_utils
+    version: 0.4.7
+  - package: dbt-labs/dbt_utils
+    version: 1.1.1
 sha1_hash: 71304bca2138cf8004070b3573a1e17183c0c1a8
 """
         )
diff --git a/tests/functional/dependencies/test_simple_dependency.py b/tests/functional/dependencies/test_simple_dependency.py
--- a/tests/functional/dependencies/test_simple_dependency.py
+++ b/tests/functional/dependencies/test_simple_dependency.py
@@ -241,12 +241,12 @@ def test_git_with_multiple_subdir(self, project):
         run_dbt(["deps"])
         assert os.path.exists("package-lock.yml")
         expected = """packages:
-- git: https://github.com/dbt-labs/dbt-multipe-packages.git
-  revision: 53782f3ede8fdf307ee1d8e418aa65733a4b72fa
-  subdirectory: dbt-utils-main
-- git: https://github.com/dbt-labs/dbt-multipe-packages.git
-  revision: 53782f3ede8fdf307ee1d8e418aa65733a4b72fa
-  subdirectory: dbt-date-main
+  - git: https://github.com/dbt-labs/dbt-multipe-packages.git
+    revision: 53782f3ede8fdf307ee1d8e418aa65733a4b72fa
+    subdirectory: dbt-utils-main
+  - git: https://github.com/dbt-labs/dbt-multipe-packages.git
+    revision: 53782f3ede8fdf307ee1d8e418aa65733a4b72fa
+    subdirectory: dbt-date-main
 sha1_hash: b9c8042f29446c55a33f9f211737f445a640c7a1
 """
         with open("package-lock.yml") as fp: