Is there a way of making "npm ci" install devDependencies, or "npm install" not update package-lock.json?

npm ci does install both dependecies and dev dependencies. But if you use npm ci --production or if your NODE_ENV is set to production, then it avoids installing dev dependencies. Please check docs here.

With the --production flag (or when the NODE_ENV environment variable is set to production), npm will not install modules listed in devDependencies.

NOTE: The --production flag has no particular meaning when adding a dependency to a project.

Override NODE_ENV variable

When your NODE_ENV environment variable is set to production, using npm ci will not install devDependencies. But if you still want to install devDependencies

npm ci --also=dev

will do the trick ;)