Migrate frontend from Deno to Node/pnpm#190
Merged
Merged
Conversation
Removes the dual-package-manager friction that bit us repeatedly: Trivy scans the npm lockfile while builds ran on Deno, so security bumps via Dependabot and local builds drifted apart. Single lockfile now (package-lock.json), tooling ecosystem expects npm anyway. - Dockerfile: denoland/deno:2.6.5 -> node:22-alpine (multi-stage, builder + runtime, npm ci with --omit=dev at runtime) - CI: setup-deno -> setup-node@v5 with built-in npm cache - package.json: add scripts (dev/build/preview/start/test:e2e*) - Delete deno.json + deno.lock Astro adapter (@astrojs/node) was already in deps. No source changes needed (no Deno.* APIs in src/). Verified locally: npm ci, npm run build, node dist/server/entry.mjs serves HTTP 200. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
|
can we update to use pnpm as well? 🙏🏻 |
Aligns with the pnpm stub already present in the repo. Single package, not part of a workspace (root pnpm-workspace.yaml deleted since it never matched apps/*; can be added back if we ever extract shared packages). Changes: - apps/frontend: pnpm-lock.yaml replaces package-lock.json - Dockerfile: corepack enable + pnpm install --frozen-lockfile - CI: pnpm/action-setup + setup-node cache=pnpm - Root scripts (frontend:dev/build): pnpm instead of deno task - Docs (README, azure-deployment): commands updated - .gitignore: drop /deno.lock (Deno path retired) - dependabot.yml: comment updated; npm ecosystem reads pnpm-lock too - playwright.config.cjs webServer: pnpm run dev CMS folder unchanged. No Deno or stale npm artefacts left. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
larsekhansen
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - uses: actions/checkout@v6 | ||
|
|
||
| - uses: denoland/setup-deno@v2 | ||
| - uses: pnpm/action-setup@v4 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fjerner Deno fra frontend, går til Node + pnpm. Roten i den vedvarende dual-lockfile-friksjonen var at Trivy/Dependabot leste npm-lockfilen mens bygget kjørte på Deno, så security-bumps og lokale builds drev fra hverandre.
denoland/deno:2.6.5→node:22-alpine(multi-stage med corepack + pnpm install --frozen-lockfile)setup-deno→pnpm/action-setup+setup-nodemed pnpm-cacheapps/frontend/pnpm-lock.yamlerstatterpackage-lock.jsonapps/*, kan legges tilbake hvis vi får delte pakker)package.jsonscripts (frontend:dev,frontend:build) bruker pnpm/deno.lock-entry fra.gitignoreAstro-adapter (
@astrojs/node) var allerede i deps. Ingen Deno-spesifikke API-er isrc/. Bygg + runtime verifisert lokalt.