chore: migrate to pnpm and enable minimum release age#2429
Open
chore: migrate to pnpm and enable minimum release age#2429
Conversation
github-actions
Bot
added
the
t-tooling
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
7ec245d to
22f3a6a
Compare
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
b899ab2 to
2420e79
Compare
Part of the org-wide supply-chain hardening effort. Migrates the repo
from npm to pnpm (10.24.0) and introduces a minimum release age window
for renovate updates, mirroring the setup in apify-client-js.
Workspace / package manager
- Set `packageManager` to `pnpm@10.24.0` in root package.json.
- Drop the `workspaces` field from package.json; moved to
pnpm-workspace.yaml (`apify-docs-theme`).
- Replace `npm run X` / `npx` with `pnpm X` / `pnpm exec` in root scripts.
- Add `.npmrc` (node-linker=hoisted, link-workspace-packages,
prefer-workspace-packages, public-hoist-pattern, legacy-peer-deps).
- Add `pnpm-workspace.yaml` with `minimumReleaseAge: 1440` and exclude
`@apify/*` and `@crawlee/*`.
- Replace `package-lock.json` with `pnpm-lock.yaml`.
Renovate
- Add `minimumReleaseAge: "1 day"` and `internalChecksFilter: strict`.
- Add packageRule exempting `@apify/*` and `@crawlee/*` from the delay.
- Remove the old `constraints: { npm: ^9.0.0 }` block.
CI composite action
- Copy `.github/actions/pnpm-install` from apify-client-js verbatim
(pnpm/action-setup + pnpm store cache keyed on pnpm-lock.yaml).
Workflows (6 of 13 touched; 7 left as-is)
- Updated to use `./.github/actions/pnpm-install` and `pnpm`/`pnpm exec`:
- `docs.yaml` (GitHub Pages deploy)
- `lychee.yml` (nightly link checker; also builds the site)
- `openapi-ci.yaml` (lint/build/validate OpenAPI, 3 jobs)
- `publish-to-npm.yaml` (theme publish: `pnpm publish --no-git-checks`,
keep `npm show`/`npm pkg set` for registry lookups, theme bump now
uses `pnpm version patch`)
- `test-academy.yml` (monthly bats run)
- `test.yaml` (build + nginx assertions + markdown/code lint)
- Removed `cache: 'npm'` / `cache-dependency-path`, the stray
`corepack enable` steps, and the `npm ci --force` / `npm install`
calls in favor of the composite action.
- Left untouched (no Node dep install): `actions-checks.yaml`,
`bump-openapi-version.yaml`, `check-pr-title.yaml`, `deploy-nginx.yml`,
`pr-previews.yaml`, `spell-check.yaml`, `vale.yaml`.
Notes
- `docusaurus.config.js` still uses `future.experimental_faster` because
this repo is on Docusaurus 3.9.2; the `future.faster` rename only
lands in 3.10.
- Local `pnpm install --frozen-lockfile` + `pnpm build` + `pnpm lint:code`
pass.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replaces the local .github/actions/pnpm-install composite copy with the shared one from apify/workflows@main. Identical behavior, less duplication.
…m release-age gate
Silences npm warnings about unknown options like node-linker; pnpm reads the same keys from pnpm-workspace.yaml in camelCase form.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
devEngines.packageManager breaks pnpm commands that delegate to npm (pnpm version, pnpm pkg set, etc). Use the battle-tested only-allow approach instead (same as Vite, Vue, Astro).
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
2420e79 to
6315822
Compare
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
6315822 to
aa502b3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates apify-docs from npm to pnpm (10.24.0) as part of the org-wide supply-chain hardening effort, mirroring the setup already in place for apify-client-js and apify-shared-js.
Alongside the package manager switch this introduces a minimum release age window for renovate updates so supply-chain attacks on transitive dependencies are less likely to land in a green CI run.
Changes
Workspace / package manager
packageManager->pnpm@10.24.0in rootpackage.json;workspacesfield dropped in favor ofpnpm-workspace.yaml(still containing onlyapify-docs-theme).pnpm X/pnpm execinstead ofnpm run X/npx..npmrcwithnode-linker=hoisted,link-workspace-packages=true,prefer-workspace-packages=true,public-hoist-pattern[]=*(existinglegacy-peer-deps=truepreserved).pnpm-workspace.yamlwithminimumReleaseAge: 1440andminimumReleaseAgeExcludefor@apify/*and@crawlee/*.package-lock.jsonreplaced bypnpm-lock.yaml.Renovate
minimumReleaseAge: "1 day"andinternalChecksFilter: "strict".packageRulesentry exempting@apify/*and@crawlee/*from the delay.constraints: { npm: "^9.0.0" }block.CI composite action
.github/actions/pnpm-install/action.ymlverbatim from apify-client-js (swap space,pnpm/action-setup@v4.1.0, monthly-rotated store cache keyed onpnpm-lock.yaml,pnpm install --frozen-lockfile --prefer-offline).Workflows (6 of 13 updated, 7 left untouched)
pnpm/pnpm exec:docs.yaml- GitHub Pages deploy.lychee.yml- nightly link checker (also builds the site).openapi-ci.yaml- OpenAPI lint/build/validate (3 jobs).publish-to-npm.yaml- theme publish now usespnpm publish --no-git-checksandpnpm version patch;npm showandnpm pkg setkept for registry lookups and direct manifest edits.test-academy.yml- monthly Bats run.test.yaml- build + nginx header assertions + markdown/code lint (3 jobs).cache: 'npm'/cache-dependency-path, the leftovercorepack enablesteps, and thenpm ci --force/npm installcalls in those workflows.actions-checks.yaml,bump-openapi-version.yaml,check-pr-title.yaml,deploy-nginx.yml,pr-previews.yaml,spell-check.yaml,vale.yaml.Notes
docusaurus.config.jskeepsfuture.experimental_faster; thefuture.fasterrename only lands in Docusaurus 3.10 and this repo is still on 3.9.2.pnpm install --frozen-lockfile,pnpm build, andpnpm lint:codeall pass.🤖 Generated with Claude Code