Migrate frontend from Deno to Node/pnpm (#190)

* Migrate frontend from Deno to Node/npm

Removes the dual-package-manager friction that bit us repeatedly:
Trivy scans the npm lockfile while builds ran on Deno, so security
bumps via Dependabot and local builds drifted apart. Single lockfile
now (package-lock.json), tooling ecosystem expects npm anyway.

- Dockerfile: denoland/deno:2.6.5 -> node:22-alpine (multi-stage,
  builder + runtime, npm ci with --omit=dev at runtime)
- CI: setup-deno -> setup-node@v5 with built-in npm cache
- package.json: add scripts (dev/build/preview/start/test:e2e*)
- Delete deno.json + deno.lock

Astro adapter (@astrojs/node) was already in deps. No source changes
needed (no Deno.* APIs in src/). Verified locally: npm ci, npm run
build, node dist/server/entry.mjs serves HTTP 200.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Switch frontend from npm to pnpm

Aligns with the pnpm stub already present in the repo. Single
package, not part of a workspace (root pnpm-workspace.yaml deleted
since it never matched apps/*; can be added back if we ever extract
shared packages).

Changes:
- apps/frontend: pnpm-lock.yaml replaces package-lock.json
- Dockerfile: corepack enable + pnpm install --frozen-lockfile
- CI: pnpm/action-setup + setup-node cache=pnpm
- Root scripts (frontend:dev/build): pnpm instead of deno task
- Docs (README, azure-deployment): commands updated
- .gitignore: drop /deno.lock (Deno path retired)
- dependabot.yml: comment updated; npm ecosystem reads pnpm-lock too
- playwright.config.cjs webServer: pnpm run dev

CMS folder unchanged. No Deno or stale npm artefacts left.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: larsekhansen

.github/dependabot.yml

@@ -1,6 +1,7 @@
 version: 2
 updates:
-  # Frontend (Astro/React/Deno-runtime npm deps)
+  # Frontend (Astro/React on Node, managed with pnpm — Dependabot's npm
+  # ecosystem reads pnpm-lock.yaml too).
   - package-ecosystem: "npm"
     directory: "/apps/frontend"
     schedule:

.github/workflows/ci.yml

@@ -8,22 +8,28 @@ on:
 
 jobs:
   frontend-build:
-    name: Frontend (Astro/Deno) build
+    name: Frontend (Astro/Node) build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
 
-      - uses: denoland/setup-deno@v2
+      - uses: pnpm/action-setup@v4
         with:
-          deno-version: v2.x
+          version: 10
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+          cache-dependency-path: apps/frontend/pnpm-lock.yaml
 
       - name: Install
         working-directory: apps/frontend
-        run: deno task install
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         working-directory: apps/frontend
-        run: deno task build
+        run: pnpm run build
 
   cms-build:
     name: CMS (Umbraco/.NET) build

.gitignore

@@ -32,8 +32,6 @@ apps/cms/data/
 apps/cms/.strapi/
 apps/cms/.strapi-updater.json
 
-# Deno (root-level lockfile is a stray artifact)
-/deno.lock
 
 # Logs
 *.log

README.md

@@ -83,10 +83,11 @@ On first CMS run, the SQLite database is created, `ContentTypeComposer` creates
 all content types, and `ContentSeeder` populates demo content. Admin user is
 created via unattended install env vars.
 
-**Terminal 2 — Frontend (Astro/Deno):**
+**Terminal 2 — Frontend (Astro/Node + pnpm):**
 ```bash
 cd apps/frontend
-deno task dev
+pnpm install
+pnpm run dev
 ```
 - Frontend: http://localhost:4321
 
@@ -99,7 +100,7 @@ The frontend uses **hybrid rendering**:
 
 In development, the Astro dev server re-fetches from Umbraco on each page load, so CMS changes appear on refresh.
 
-In production, run `deno task build` to rebuild with latest content. Consider webhook-triggered rebuilds when CMS content changes.
+In production, run `pnpm run build` to rebuild with latest content. Consider webhook-triggered rebuilds when CMS content changes.
 
 ## Content Types
 
@@ -175,13 +176,13 @@ The preview flow: Umbraco → Razor template redirect → `/api/preview?secret=.
 cd apps/frontend
 
 # Run all tests (starts dev server automatically)
-deno task test:e2e
+pnpm run test:e2e
 
 # Update visual regression snapshots
-deno task test:e2e:update
+pnpm run test:e2e:update
 
 # Run tests with UI
-deno task test:e2e:ui
+pnpm run test:e2e:ui
 ```
 
 81 tests across 6 browser configurations (Chrome, Firefox, Safari, Chrome Dark, Mobile Chrome, Mobile Safari).

apps/frontend/Dockerfile

@@ -1,22 +1,34 @@
-FROM denoland/deno:2.6.5
+# Multi-stage build: install + build with pnpm, run the standalone server on Node.
+# The Astro Node adapter outputs dist/server/entry.mjs which is a self-contained
+# HTTP server — no Astro CLI needed at runtime.
 
+FROM node:22-alpine AS builder
 WORKDIR /app
 
-# Copy dependency files first for layer caching
-COPY deno.json deno.lock package.json ./
+# Enable corepack so pnpm is available (Node 22+ ships with corepack).
+RUN corepack enable
 
-# Install dependencies
-RUN deno install --allow-scripts=npm:sharp
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
 
-# Copy source code
 COPY . .
+RUN pnpm run build
 
-# Build the Astro site
-RUN deno task build
+# ─── Runtime stage ──────────────────────────────────────────────────────────
+FROM node:22-alpine
+WORKDIR /app
+
+RUN corepack enable
+
+# Production deps only at runtime; @astrojs/node bundles what it needs
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile --prod && pnpm store prune
+
+COPY --from=builder /app/dist ./dist
 
-# The Node adapter outputs a standalone server at dist/server/entry.mjs
 ENV HOST=0.0.0.0
 ENV PORT=4321
+ENV NODE_ENV=production
 EXPOSE 4321
 
-CMD ["deno", "-A", "dist/server/entry.mjs"]
+CMD ["node", "dist/server/entry.mjs"]