Migrate from npm CLI to pnpm (#1211)

* Migrate npm/javy package from npm CLI to pnpm

Improve supply-chain security for the javy npm package by switching its
install/build/publish flow to pnpm. pnpm refuses to execute install
scripts from transitive dependencies by default, uses a
content-addressed store that detects tampered tarballs, and enforces
strict dependency isolation.

Pins pnpm 10.28.0 via the packageManager field so local dev and CI run
the same version. Replaces package-lock.json with pnpm-lock.yaml. CI
workflows install pnpm via pnpm/action-setup, pointed at npm/javy's
package.json for the version.

Tracks #1210.

* Migrate wpt harness from npm CLI to pnpm

Apply the same supply-chain hardening to the Web Platform Tests harness
so contributors and CI don't need the npm CLI to run WPT. Updates the
Makefile test-wpt-ci target and the WPT step in ci.yml to use pnpm,
switches the inner test script to pnpm run, and pins pnpm 10.28.0 via
the packageManager field.

Tracks #1210.

Author: saga-dasgupta

.github/workflows/ci-npm-javy.yml

@@ -28,8 +28,12 @@ jobs:
           tar xvf /tmp/wasmtime.tar.xz --strip-components=1 -C /tmp/wasmtime
           echo "/tmp/wasmtime" >> $GITHUB_PATH
 
-      - run: npm install
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: npm/javy/package.json
+
+      - run: pnpm install
         working-directory: npm/javy
 
-      - run: npm test
+      - run: pnpm test
         working-directory: npm/javy

.github/workflows/ci.yml

@@ -68,7 +68,11 @@ jobs:
       - name: Test
         run: make test-native-targets-ci
 
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: wpt/package.json
+
       - name: WPT
         run: |
-          npm install --prefix wpt
-          npm test --prefix wpt
+          pnpm -C wpt install
+          pnpm -C wpt test

.github/workflows/publish-npm.yml

@@ -12,24 +12,28 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: npm/javy/package.json
+
       - uses: actions/setup-node@v6
         with:
           registry-url: "https://registry.npmjs.org"
 
       - name: Install package dependencies
-        run: npm install
+        run: pnpm install
         working-directory: npm/javy
 
       - name: Build NPM package
-        run: npm run build
+        run: pnpm run build
         working-directory: npm/javy
 
       - name: Publish NPM package if new version
         run: |
-          if [[ $(cat package.json | jq -r .version) == $(npm view javy version) ]]; then
+          if [[ $(cat package.json | jq -r .version) == $(pnpm view javy version) ]]; then
             echo "Skipping publish because the version is already published"
           else
-            npm publish
+            pnpm publish --no-git-checks
           fi
         working-directory: npm/javy
         env:

Makefile

@@ -93,8 +93,8 @@ native-targets: lint-native-targets test-native-targets
 
 # For usage in CI, in which we assume pre-existing assets.
 test-wpt-ci:
-	npm install --prefix wpt
-	npm test --prefix wpt
+	pnpm -C wpt install
+	pnpm -C wpt test
 
 test-wpt: cli test-wpt-ci
 

npm/javy/README.md

@@ -35,8 +35,8 @@ writeFileSync(STDIO.Stderr, textEncoder.encode(stderrContent));
 
 ## Tests
 
-To run the tests, run `npm test`. It requires you to have a release build of `javy` and have `wasmtime` installed.
+To run the tests, run `pnpm test`. It requires you to have a release build of `javy` and have `wasmtime` installed.
 
 ## Publishing
 
-Run `npm run build` before running `npm publish`.
+Run `pnpm run build` before running `pnpm publish`.