chore: migrate to pnpm and enable minimum release age

Migrates actor-scraper from npm workspaces to pnpm workspaces and
adds a 1-day minimum release age supply-chain guard at the package
manager layer (pnpm-workspace.yaml) and at the Renovate layer.
Internal `@apify/*` and `@crawlee/*` packages are whitelisted at
both layers for immediate updates.

Notable changes:
- package.json: drop "workspaces" (moved to pnpm-workspace.yaml);
  set packageManager to pnpm@10.24.0; add @isaacs/brace-expansion
  as explicit root devDep (pnpm 10 doesn't pull it transitively
  for minimatch@10 which actor-scraper-sitemap depends on)
- lerna.json: npmClient: "pnpm"
- .npmrc: node-linker=hoisted + link-workspace-packages=true +
  prefer-workspace-packages=true (flat layout for debugging +
  prefer workspace packages over registry)
- packages/actor-scraper/*/package.json: use "workspace:*" protocol
  for @apify/scraper-tools so pnpm links the workspace copy instead
  of fetching the identical version from npm (required for consistent
  peer-dep resolution across workspace and registry types)
- packages/scraper-tools/src/browser_tools.ts: relax Page interface
  exposeFunction return type from Promise<void> to Promise<unknown>
  so it accepts both Puppeteer (Promise<void>) and newer Playwright
  (Promise<Disposable>) page types. Return value is unused.
- New .github/actions/pnpm-install composite action adopts the
  caching pattern from apify/apify-cli#1068 (pnpm store cache
  keyed by year-month + lockfile hash)
- CI workflows: delegate install to the composite; drop the
  separate npm cache config on setup-node
- renovate.json: minimumReleaseAge "1 day", internalChecksFilter
  "strict", @apify/* and @crawlee/* whitelist; drop npm constraint

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: B4nan

.github/actions/pnpm-install/action.yml

@@ -0,0 +1,42 @@
+name: "pnpm install"
+description: "Run pnpm install with cache enabled"
+runs:
+    using: "composite"
+    steps:
+        - name: Set up swap space
+          if: runner.os == 'Linux'
+          uses: pierotofy/set-swap-space@v1.0
+          with:
+              swap-size-gb: 10
+
+        - uses: pnpm/action-setup@v4.1.0
+          name: Install pnpm
+          with:
+              run_install: false
+
+        - name: Expose pnpm config(s) through "$GITHUB_OUTPUT"
+          id: pnpm-config
+          shell: bash
+          run: |
+              echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+        - name: Cache rotation keys
+          id: cache-rotation
+          shell: bash
+          run: |
+              echo "YEAR_MONTH=$(/bin/date -u "+%Y%m")" >> $GITHUB_OUTPUT
+
+        - uses: actions/cache@v4
+          name: Setup pnpm cache
+          with:
+              path: ${{ steps.pnpm-config.outputs.STORE_PATH }}
+              key: ${{ runner.os }}-pnpm-store-cache-${{ steps.cache-rotation.outputs.YEAR_MONTH }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+              restore-keys: |
+                  ${{ runner.os }}-pnpm-store-cache-${{ steps.cache-rotation.outputs.YEAR_MONTH }}-
+
+        - name: Install dependencies
+          shell: bash
+          run: |
+              pnpm install --frozen-lockfile --prefer-offline --loglevel error
+          env:
+              HUSKY: "0"

.github/workflows/on-pull-request.yml

@@ -22,18 +22,15 @@ jobs:
               uses: actions/setup-node@v6
               with:
                   node-version: 24
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
 
-            - name: Install Dependencies
-              run: |
-                  npm ci
+            - name: Install pnpm and dependencies
+              uses: ./.github/actions/pnpm-install
 
             - name: Build
-              run: npm run ci:build
+              run: pnpm ci:build
 
             - name: Tests
-              run: npm test
+              run: pnpm test
 
     lint:
         name: Lint
@@ -46,14 +43,12 @@ jobs:
               uses: actions/setup-node@v6
               with:
                   node-version: 24
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
 
-            - name: Install Dependencies
-              run: npm ci
+            - name: Install pnpm and dependencies
+              uses: ./.github/actions/pnpm-install
 
             - name: ESLint
-              run: npm run lint
+              run: pnpm lint
 
             - name: Prettier
-              run: npm run format:check
+              run: pnpm format:check

.github/workflows/test-e2e.yaml

@@ -10,7 +10,6 @@ on:
         - cron: '0 2 * * *'
 
 jobs:
-    # NPM install is done in a separate job and cached to speed up the following jobs.
     build_and_test:
         name: Build & Test
         runs-on: ubuntu-22.04
@@ -28,8 +27,6 @@ jobs:
               uses: actions/setup-node@v6
               with:
                   node-version: 24
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
 
             - name: Turbo cache
               id: turbo-cache
@@ -40,13 +37,13 @@ jobs:
                   restore-keys: |
                       turbo-${{ github.job }}-${{ github.ref_name }}-
 
-            - name: Install Dependencies
-              run: npm ci
+            - name: Install pnpm and dependencies
+              uses: ./.github/actions/pnpm-install
 
             - name: Build
-              run: npm run ci:build
+              run: pnpm ci:build
 
             - name: Test
-              run: npm run test:e2e
+              run: pnpm test:e2e
               env:
                   APIFY_TOKEN: ${{ secrets.APIFY_SCRAPER_TESTS_API_TOKEN }}

.npmrc

@@ -0,0 +1,3 @@
+node-linker=hoisted
+link-workspace-packages=true
+prefer-workspace-packages=true

.prettierignore

@@ -1,2 +1,7 @@
 .husky/pre-commit
 .prettierignore
+
+# pnpm
+pnpm-lock.yaml
+pnpm-workspace.yaml
+.github/actions/pnpm-install/action.yml

lerna.json

@@ -12,5 +12,6 @@
         }
     },
     "useNx": false,
+    "npmClient": "pnpm",
     "ignoreChanges": ["**/test/**", "**/*.md"]
 }