chore: enforce frozen pnpm installs

Author: BartWaardenburg

.github/scripts/workflow-policy.test.mjs

@@ -0,0 +1,55 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { access, readdir, readFile } from "node:fs/promises";
+import { describe, it } from "node:test";
+
+const ROOT_URL = new URL("../../", import.meta.url);
+const WORKFLOWS_URL = new URL("workflows/", new URL("../", import.meta.url));
+
+const trackedPackageLocks = async () => {
+  const tracked = execFileSync("git", ["ls-files", "--", ":(glob)**/package-lock.json"], {
+    cwd: ROOT_URL,
+    encoding: "utf8",
+  })
+    .trim()
+    .split("\n")
+    .filter(Boolean);
+
+  const existing = await Promise.all(
+    tracked.map(async (path) => {
+      try {
+        await access(new URL(path, ROOT_URL));
+        return path;
+      } catch {
+        return null;
+      }
+    }),
+  );
+
+  return existing.filter((path) => path !== null);
+};
+
+const workflowFiles = async () => {
+  const entries = await readdir(WORKFLOWS_URL, { withFileTypes: true });
+  return entries.filter((entry) => entry.isFile() && /\.ya?ml$/.test(entry.name));
+};
+
+describe("JavaScript dependency policy", () => {
+  it("keeps pnpm-lock.yaml as the only tracked JavaScript lockfile", async () => {
+    assert.deepEqual(await trackedPackageLocks(), []);
+  });
+
+  it("uses frozen pnpm installs in every workflow", async () => {
+    for (const entry of await workflowFiles()) {
+      const workflow = await readFile(new URL(entry.name, WORKFLOWS_URL), "utf8");
+      assert.doesNotMatch(workflow, /--no-frozen-lockfile/, entry.name);
+
+      const installs = workflow.split("\n").filter((line) => /\bpnpm install\b/.test(line));
+
+      for (const install of installs) {
+        assert.match(install, /--ignore-scripts\b/, `${entry.name}: ${install.trim()}`);
+        assert.match(install, /--frozen-lockfile\b/, `${entry.name}: ${install.trim()}`);
+      }
+    }
+  });
+});

.github/workflows/bench.yml

@@ -93,7 +93,7 @@ jobs:
 
       - name: Install JS dependencies
         if: matrix.kind == 'node'
-        run: corepack pnpm install --ignore-scripts --no-frozen-lockfile
+        run: corepack pnpm install --ignore-scripts --frozen-lockfile
 
       - name: Install wasm-pack
         if: matrix.kind == 'node'

.github/workflows/ci.yml

@@ -150,7 +150,7 @@ jobs:
       - name: Enable Corepack
         run: corepack enable
       - name: Install JS dependencies
-        run: corepack pnpm install --ignore-scripts --no-frozen-lockfile
+        run: corepack pnpm install --ignore-scripts --frozen-lockfile
       - name: Run JS lint and format checks
         run: corepack pnpm run lint:js
       - name: Run JS formatter check
@@ -174,7 +174,7 @@ jobs:
           targets: wasm32-unknown-unknown
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - name: Install JS dependencies
-        run: corepack pnpm install --ignore-scripts --no-frozen-lockfile
+        run: corepack pnpm install --ignore-scripts --frozen-lockfile
       - name: Install wasm-pack
         shell: bash
         run: |

.github/workflows/coverage.yml

@@ -39,7 +39,7 @@ jobs:
         run: corepack enable
 
       - name: Install JS dependencies
-        run: corepack pnpm install --ignore-scripts --no-frozen-lockfile
+        run: corepack pnpm install --ignore-scripts --frozen-lockfile
 
       - name: Install wasm-pack
         shell: bash

CONTRIBUTING.md

@@ -15,15 +15,17 @@ Thanks for your interest in contributing to srcmap! Whether it's a bug fix, new
 ```bash
 git clone https://github.com/fallow-rs/srcmap.git
 cd srcmap
+corepack enable
+corepack pnpm install --frozen-lockfile
 
 # Build all Rust crates
 cargo build
 
 # Run tests
 cargo test
 
-# Run JS tests (requires building WASM packages first)
-npm test
+# Run JS tests (requires building NAPI and WASM packages first)
+corepack pnpm test
 ```
 
 ## Project structure
@@ -72,7 +74,7 @@ cd packages/sourcemap-wasm && wasm-pack build --target web
 ```bash
 cargo test                      # All Rust tests
 cargo test -p srcmap-sourcemap  # Single crate
-npm run test:js                 # JS/WASM tests
+corepack pnpm run test:js       # JS/WASM tests
 ```
 
 ### Benchmarks
@@ -82,14 +84,14 @@ npm run test:js                 # JS/WASM tests
 cargo bench -p srcmap-sourcemap
 
 # JS benchmarks (comparison with other libraries)
-cd benchmarks && npm install && node sourcemap-wasm.mjs
+corepack pnpm --dir benchmarks exec node sourcemap-wasm.mjs
 ```
 
 ### Coverage
 
 ```bash
-npm run coverage:rust           # Rust coverage (requires cargo-llvm-cov)
-npm run coverage:js             # JS coverage
+corepack pnpm run coverage:rust # Rust coverage (requires cargo-llvm-cov)
+corepack pnpm run coverage:js   # JS coverage
 ```
 
 ## Code standards