chore: migrate to pnpm and enable minimum release age#587
Open
chore: migrate to pnpm and enable minimum release age#587
Conversation
Migrates apify-sdk-js from npm to pnpm and adds a 1-day minimum release age supply-chain guard at the package manager layer (pnpm-workspace.yaml) and at the Renovate layer. Internal `@apify/*` and `@crawlee/*` packages are whitelisted at both layers. The website/ directory becomes a proper workspace (previously had its own lockfile). Single root lockfile now. Notable changes: - package.json: set packageManager to pnpm@10.24.0; bump engines.node to >=18; "npm run X" -> "pnpm X" in scripts - pnpm-workspace.yaml: packages [website], release-age settings - .npmrc: node-linker=hoisted, link-workspace-packages=true, prefer-workspace-packages=true, public-hoist-pattern[]=* - website/package.json: add "name": "apify-sdk-website" and "private": true so pnpm recognises it as a workspace - website/docusaurus.config.js: rename future.experimental_faster -> future.faster (renamed in Docusaurus 3.10, which pnpm resolves from the ^3.8.1 range) - New .github/actions/pnpm-install composite action (cached pnpm store, keyed by year-month + lockfile hash) - All relevant CI workflows (test-and-release, docs, release, test-e2e, publish-to-npm) use the composite; npm/npx/`npm version` -> pnpm equivalents. docs workflow's `npm update @apify/docs-theme` becomes `pnpm --filter apify-sdk-website update @apify/docs-theme`. publish uses `pnpm publish --tag X --no-git-checks`. - renovate.json: add minimumReleaseAge "1 day", internalChecksFilter "strict", @apify/* + @crawlee/* whitelist - .prettierignore: ignore pnpm-lock.yaml - Both package-lock.json files deleted; single pnpm-lock.yaml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-actions
bot
added
the
t-tooling
Replaces the local .github/actions/pnpm-install composite copy with the shared one from apify/workflows@main. Identical behavior, less duplication.
…m release-age gate
Silences npm warnings about unknown options like node-linker; pnpm reads the same keys from pnpm-workspace.yaml in camelCase form.
npx invokes npm which now refuses to run because of devEngines.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
devEngines.packageManager breaks pnpm commands that delegate to npm (pnpm version, pnpm pkg set, etc). Use the battle-tested only-allow approach instead (same as Vite, Vue, Astro).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates
apify-sdk-jsfrom npm to pnpm as part of an org-wide supply-chain hardening. Adds a 1-dayminimumReleaseAgeguard at both the package manager layer (pnpm-workspace.yaml) and the Renovate layer. Internal@apify/*and@crawlee/*packages are whitelisted at both layers.website/becomes a proper pnpm workspace — single root lockfile now.Changes
package.json:packageManagerset topnpm@10.24.0;engines.nodebumped to>=18;npm run X->pnpm Xin scriptspnpm-workspace.yaml(new): packages[website];minimumReleaseAge: 1440; whitelist@apify/*and@crawlee/*.npmrc(new):node-linker=hoisted,link-workspace-packages=true,prefer-workspace-packages=true,public-hoist-pattern[]=*website/package.json: add"name": "apify-sdk-website"and"private": trueso pnpm recognises it as a workspace;npm run X->pnpm Xwebsite/docusaurus.config.js: renamefuture.experimental_faster->future.faster(renamed in Docusaurus 3.10, which pnpm resolves from the^3.8.1range).github/actions/pnpm-install/action.yml(new): composite action with cached pnpm store keyed by year-month + lockfile hash (pattern from apify-client-js)test-and-release,docs,release,test-e2e,publish-to-npm) updated to use the composite;npm ci/npx/npm version-> pnpm equivalents; docs workflow'snpm update @apify/docs-themebecomespnpm --filter apify-sdk-website update @apify/docs-theme; publish usespnpm publish --tag X --no-git-checksrenovate.json: addminimumReleaseAge: "1 day",internalChecksFilter: "strict", and@apify/*+@crawlee/*whitelist package rule.prettierignore: ignorepnpm-lock.yamlpackage-lock.jsonandwebsite/package-lock.jsondeleted; singlepnpm-lock.yamlat rootLocal verification:
pnpm install --frozen-lockfile,pnpm build,pnpm test,pnpm lintall pass.pnpm format:checkpasses (only warnings are for untracked local files that don't exist in CI).🤖 Generated with Claude Code