chore(website): migrate to pnpm and enable minimum release age (#855)

## Summary

Migrates the `website/` subdirectory from Yarn 4 to pnpm 10 as part of
an org-wide supply-chain hardening migration. The Python root (managed
by uv) is unchanged.

Enables pnpm's `minimumReleaseAge` (1 day / 1440 minutes) to block
installing packages published within the last 24h, with exclusions for
first-party scopes `@apify/*` and `@crawlee/*`. Renovate is updated with
`internalChecksFilter: strict` and a matching 0-day package rule so our
own releases are not held back.

## Changes

- **website/package.json** — `packageManager` now `pnpm@10.24.0`; adds
`name: apify-sdk-python-website` and `private: true`; all scripts
rewritten from `yarn X` to `pnpm X`
- **website/pnpm-workspace.yaml** (new) — `minimumReleaseAge: 1440` plus
exclusions for `@apify/*` and `@crawlee/*`
- **website/.npmrc** (new) — `node-linker=hoisted` + workspace hoisting
settings to mirror the previous yarn `node-modules` layout
- **website/.yarnrc.yml, website/yarn.lock** — removed (no
`.yarn/patches/` existed in this repo, so nothing was preserved)
- **website/pnpm-lock.yaml** (new) — generated via `pnpm install`
- **website/docusaurus.config.js** — renamed
`future.experimental_faster` -> `future.faster` (Docusaurus 3.10 rename,
forward-compatible)
- **.github/actions/pnpm-install/action.yml** (new) — composite action
copied from `apify-client-js`, extended with a `working-directory` input
so it can install inside `website/` without changing the caller's
default directory
- **.github/workflows/_release_docs.yaml** — `git add website/yarn.lock`
-> `git add website/pnpm-lock.yaml` in the auto-commit step of the
docs-theme update
- **.github/workflows/manual_release_stable.yaml** — removed `corepack
enable && yarn install`, installs via the new composite action with
`working-directory: website`; `npx docusaurus` -> `pnpm exec docusaurus`
- **pyproject.toml** — poe tasks `update-docs-theme`, `build-docs`,
`run-docs` now invoke `pnpm` directly (no more `corepack enable &&
yarn`)
- **renovate.json** — adds `internalChecksFilter: strict` and a
`packageRule` matching `@apify/*` / `@crawlee/*` with
`minimumReleaseAge: 0 days`. `ignoreDeps` unchanged (did not contain
`yarn`).
- **.gitignore** — replaced `website/.yarn` with `website/.pnpm-store`

## Verification

- `pnpm install` and `pnpm install --frozen-lockfile` both succeed in
`website/`
- Existing peer-dependency warnings (eslint v10, typescript v6,
styled-components) pre-date this migration and are carried over
unchanged
- Local docusaurus build was attempted but could not complete outside CI
because the typedoc plugin spawns `python` (not `python3`) and this
laptop doesn't expose `python` on PATH; in CI `actions/setup-python`
provides `python` so this will resolve there. This is orthogonal to the
pnpm migration.
- `pnpm lint` surfaces an eslint v10 flat-config error that pre-dates
this PR (no `eslint.config.js` present). Not introduced here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: B4nan

.github/workflows/manual_release_docs.yaml

@@ -55,13 +55,18 @@ jobs:
       - name: Install Python dependencies
         run: uv run poe install-dev
 
+      - name: Install pnpm and website dependencies
+        uses: apify/workflows/pnpm-install@main
+        with:
+          working-directory: website
+
       - name: Update docs theme
         run: uv run poe update-docs-theme
 
       - name: Commit the updated package.json and lockfile
         uses: EndBug/add-and-commit@v10
         with:
-          add: website/package.json website/yarn.lock
+          add: website/package.json website/pnpm-lock.yaml
           message: "chore: Automatic docs theme update [skip ci]"
           default_author: github_actions
           # `actions/checkout` detaches HEAD on SHA refs; EndBug needs a branch to push.

.github/workflows/manual_version_docs.yaml

@@ -36,7 +36,21 @@ jobs:
     permissions:
       contents: write
 
+    defaults:
+      run:
+        working-directory: website
+
     steps:
+      - name: Determine checkout ref
+        id: resolve_ref
+        working-directory: .
+        env:
+          INPUT_REF: ${{ inputs.ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          REF="${INPUT_REF:-$DEFAULT_BRANCH}"
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
@@ -60,14 +74,16 @@ jobs:
 
       - name: Install Python dependencies
         run: uv run poe install-dev
+        working-directory: .
+
+      - name: Install pnpm and website dependencies
+        uses: apify/workflows/pnpm-install@main
+        with:
+          working-directory: website
 
       - name: Snapshot the current version
         id: snapshot
         run: |
-          cd website
-          corepack enable
-          yarn install
-
           # Extract version from pyproject.toml.
           FULL_VERSION="$(uv version --short)"
           MAJOR_MINOR_VERSION="$(echo "$FULL_VERSION" | cut -d. -f1-2)"
@@ -98,8 +114,8 @@ jobs:
 
           # Build API reference and create Docusaurus version snapshots.
           bash build_api_reference.sh
-          uv run npx docusaurus docs:version "$MAJOR_MINOR_VERSION"
-          uv run npx docusaurus api:version "$MAJOR_MINOR_VERSION"
+          pnpm exec docusaurus docs:version "$MAJOR_MINOR_VERSION"
+          pnpm exec docusaurus api:version "$MAJOR_MINOR_VERSION"
 
       - name: Commit and push versioned docs
         id: commit_versioned_docs
@@ -110,6 +126,7 @@ jobs:
           default_author: github_actions
           # `actions/checkout` detaches HEAD on SHA refs; EndBug needs a branch to push.
           new_branch: ${{ github.event.repository.default_branch }}
+          pull: '--rebase --autostash'
 
       - name: Resolve output commitish
         id: resolve_commitish

.gitignore

@@ -69,6 +69,7 @@ website/versioned_docs/*/pyproject.toml
 # Website build artifacts, node dependencies
 website/build
 website/node_modules
+website/yarn.lock
 website/.yarn
 website/.docusaurus
 website/api-typedoc-generated.json

pyproject.toml

@@ -228,6 +228,13 @@ context = 7
 # Minimal defense against supply-chain attacks.
 exclude-newer = "24 hours"
 
+[tool.uv.exclude-newer-package]
+# Allow internal Apify packages to install immediately.
+apify-client = false
+apify-shared = false
+apify_fingerprint_datapoints = false
+crawlee = false
+
 # Run tasks with: uv run poe <task>
 [tool.poe.tasks]
 clean = "rm -rf .coverage .pytest_cache .ruff_cache .ty_cache build dist htmlcov"
@@ -253,13 +260,13 @@ shell = "uv run ruff format --check && uv run ruff check"
 shell = "uv run ruff check --fix && uv run ruff format"
 
 [tool.poe.tasks.update-docs-theme]
-shell = "corepack enable && yarn up @apify/docs-theme"
+shell = "pnpm update @apify/docs-theme"
 cwd = "website"
 
 [tool.poe.tasks.build-docs]
-shell = "./build_api_reference.sh && corepack enable && yarn && uv run yarn build"
+shell = "./build_api_reference.sh && pnpm install && uv run pnpm build"
 cwd = "website"
 
 [tool.poe.tasks.run-docs]
-shell = "./build_api_reference.sh && corepack enable && yarn && uv run yarn start"
+shell = "./build_api_reference.sh && pnpm install && uv run pnpm start"
 cwd = "website"

renovate.json

@@ -19,9 +19,14 @@
             "groupSlug": "dev-dependencies",
             "automerge": true,
             "automergeType": "branch"
+        },
+        {
+            "matchPackageNames": ["@apify/*", "@crawlee/*", "apify", "apify-client", "apify-shared", "apify-fingerprint-datapoints", "crawlee", "got-scraping"],
+            "minimumReleaseAge": "0 days"
         }
     ],
     "minimumReleaseAge": "1 day",
+    "internalChecksFilter": "strict",
     "schedule": ["before 7am every weekday"],
     "ignoreDeps": ["apify", "docusaurus-plugin-typedoc-api"]
 }

website/.yarnrc.yml

@@ -44,7 +44,7 @@ module.exports = {
     scripts: ['/js/custom.js', ...(config.scripts ?? [])],
     githubHost: 'github.com',
     future: {
-        experimental_faster: {
+        faster: {
             // ssgWorkerThreads: true,
             swcJsLoader: true,
             swcJsMinimizer: true,

website/docusaurus.config.js

@@ -1,21 +1,23 @@
 {
-    "name": "apify-sdk-python",
+    "name": "apify-sdk-python-website",
+    "private": true,
     "scripts": {
         "clean": "rimraf .docusaurus build",
-        "build": "yarn clean && docusaurus build",
-        "start": "yarn clean && docusaurus start",
-        "deploy": "yarn clean && docusaurus deploy",
+        "build": "pnpm clean && docusaurus build",
+        "start": "pnpm clean && docusaurus start",
+        "deploy": "pnpm clean && docusaurus deploy",
         "docusaurus": "docusaurus",
         "publish-gh-pages": "docusaurus-publish",
         "rename-version": "docusaurus rename-version",
         "swizzle": "docusaurus swizzle",
         "version": "docusaurus version",
         "write-translations": "docusaurus write-translations",
         "prettify": "prettier --write --config ./tools/docs-prettier.config.js ../docs/*.md ../docs/*.mdx",
-        "lint": "yarn lint:code",
-        "lint:fix": "yarn lint:code:fix",
+        "lint": "pnpm lint:code",
+        "lint:fix": "pnpm lint:code:fix",
         "lint:code": "eslint .",
-        "lint:code:fix": "eslint . --fix"
+        "lint:code:fix": "eslint . --fix",
+        "preinstall": "npx only-allow pnpm"
     },
     "dependencies": {
         "@apify/docs-theme": "^1.0.243",
@@ -47,5 +49,5 @@
         "rimraf": "^6.0.0",
         "typescript": "^6.0.0"
     },
-    "packageManager": "yarn@4.13.0"
+    "packageManager": "pnpm@10.24.0"
 }