chore: migrate to pnpm and enable minimum release age (#273)

* chore: migrate to pnpm and enable minimum release age

Migrates actor-scraper from npm workspaces to pnpm workspaces and
adds a 1-day minimum release age supply-chain guard at the package
manager layer (pnpm-workspace.yaml) and at the Renovate layer.
Internal `@apify/*` and `@crawlee/*` packages are whitelisted at
both layers for immediate updates.

Notable changes:
- package.json: drop "workspaces" (moved to pnpm-workspace.yaml);
  set packageManager to pnpm@10.24.0; add @isaacs/brace-expansion
  as explicit root devDep (pnpm 10 doesn't pull it transitively
  for minimatch@10 which actor-scraper-sitemap depends on)
- lerna.json: npmClient: "pnpm"
- .npmrc: node-linker=hoisted + link-workspace-packages=true +
  prefer-workspace-packages=true (flat layout for debugging +
  prefer workspace packages over registry)
- packages/actor-scraper/*/package.json: use "workspace:*" protocol
  for @apify/scraper-tools so pnpm links the workspace copy instead
  of fetching the identical version from npm (required for consistent
  peer-dep resolution across workspace and registry types)
- packages/scraper-tools/src/browser_tools.ts: relax Page interface
  exposeFunction return type from Promise<void> to Promise<unknown>
  so it accepts both Puppeteer (Promise<void>) and newer Playwright
  (Promise<Disposable>) page types. Return value is unused.
- New .github/actions/pnpm-install composite action adopts the
  caching pattern from apify/apify-cli#1068 (pnpm store cache
  keyed by year-month + lockfile hash)
- CI workflows: delegate install to the composite; drop the
  separate npm cache config on setup-node
- renovate.json: minimumReleaseAge "1 day", internalChecksFilter
  "strict", @apify/* and @crawlee/* whitelist; drop npm constraint

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refresh pnpm-lock.yaml after rebase

* ci: approve build scripts for puppeteer/playwright/swc/esbuild/camoufox

pnpm 10 blocks install scripts by default; these are needed to download
the browser binaries for CI tests.

* ci: use shared apify/workflows/pnpm-install action

Replaces the local .github/actions/pnpm-install composite copy
with the shared one from apify/workflows@main. Identical behavior,
less duplication.

* chore: whitelist internal apify-client/apify/crawlee/got-scraping from release-age gate

* chore: move pnpm config from .npmrc to pnpm-workspace.yaml

Silences npm warnings about unknown options like node-linker; pnpm
reads the same keys from pnpm-workspace.yaml in camelCase form.

* chore: enforce pnpm via devEngines, switch husky hook to pnpm exec

npx invokes npm which now refuses to run because of devEngines.

* chore: normalize .gitignore — add yarn.lock and .yarn, drop .pnpm-store

* chore: remove stale .prettierignore entry and sync renovate allowlist with pnpm-workspace exclusions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: replace devEngines with only-allow preinstall

devEngines.packageManager breaks pnpm commands that delegate to npm
(pnpm version, pnpm pkg set, etc). Use the battle-tested only-allow
approach instead (same as Vite, Vue, Astro).

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: B4nan

.github/workflows/on-pull-request.yml

@@ -22,18 +22,15 @@ jobs:
               uses: actions/setup-node@v6
               with:
                   node-version: 24
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
 
-            - name: Install Dependencies
-              run: |
-                  npm ci
+            - name: Install pnpm and dependencies
+              uses: apify/workflows/pnpm-install@main
 
             - name: Build
-              run: npm run ci:build
+              run: pnpm ci:build
 
             - name: Tests
-              run: npm test
+              run: pnpm test
 
     lint:
         name: Lint
@@ -46,14 +43,12 @@ jobs:
               uses: actions/setup-node@v6
               with:
                   node-version: 24
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
 
-            - name: Install Dependencies
-              run: npm ci
+            - name: Install pnpm and dependencies
+              uses: apify/workflows/pnpm-install@main
 
             - name: ESLint
-              run: npm run lint
+              run: pnpm lint
 
             - name: Prettier
-              run: npm run format:check
+              run: pnpm format:check

.github/workflows/test-e2e.yaml

@@ -10,7 +10,6 @@ on:
         - cron: '0 2 * * *'
 
 jobs:
-    # NPM install is done in a separate job and cached to speed up the following jobs.
     build_and_test:
         name: Build & Test
         runs-on: ubuntu-22.04
@@ -28,8 +27,6 @@ jobs:
               uses: actions/setup-node@v6
               with:
                   node-version: 24
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
 
             - name: Turbo cache
               id: turbo-cache
@@ -40,13 +37,13 @@ jobs:
                   restore-keys: |
                       turbo-${{ github.job }}-${{ github.ref_name }}-
 
-            - name: Install Dependencies
-              run: npm ci
+            - name: Install pnpm and dependencies
+              uses: apify/workflows/pnpm-install@main
 
             - name: Build
-              run: npm run ci:build
+              run: pnpm ci:build
 
             - name: Test
-              run: npm run test:e2e
+              run: pnpm test:e2e
               env:
                   APIFY_TOKEN: ${{ secrets.APIFY_SCRAPER_TESTS_API_TOKEN }}

.gitignore

@@ -17,6 +17,7 @@ pids
 .idea
 .vscode
 yarn.lock
+.yarn
 tmp
 jsconfig.json
 types

.husky/pre-commit

@@ -1 +1 @@
-npx lint-staged
+pnpm exec lint-staged

.prettierignore

@@ -1,2 +1,6 @@
 .husky/pre-commit
 .prettierignore
+
+# pnpm
+pnpm-lock.yaml
+pnpm-workspace.yaml

lerna.json

@@ -12,5 +12,6 @@
         }
     },
     "useNx": false,
+    "npmClient": "pnpm",
     "ignoreChanges": ["**/test/**", "**/*.md"]
 }