Skip to content

Commit a43b746

Browse files
Robdel12Robdel12
authored
🔒 Migrate JavaScript installs to pnpm (#276)
## Why Move this repo to a single pnpm workspace lockfile and add stronger dependency-supply-chain controls after the Dependabot churn. ## What changed - Replaced npm lockfiles with one pnpm workspace lockfile. - Added pnpm 11.3.0 via packageManager and migrated CI/dev scripts to frozen pnpm installs. - Added pnpm minimum release age settings with a one-off exact exception for @vizzly-testing/honeydiff@0.10.3. - Added explicit build-script allowlists for canvas, esbuild, node-pty, and odiff-bin. - Added Dependabot cooldowns for npm ecosystem updates. - Added pnpm overrides for @babel/runtime, ws, and uuid to clear moderate audit findings. ## Verification - npx pnpm@11.3.0 install --frozen-lockfile - npx pnpm@11.3.0 audit --audit-level=moderate (passes; 3 low findings remain) - npx pnpm@11.3.0 run build - npx pnpm@11.3.0 run format:check - npx pnpm@11.3.0 run lint - npx pnpm@11.3.0 run test:types - npx pnpm@11.3.0 test - npx pnpm@11.3.0 run test:reporter - git diff --check Docker TUI build was attempted, but Docker stalled on node:22-slim metadata resolution before reaching our Dockerfile steps.
1 parent 7be83c2 commit a43b746

69 files changed

Lines changed: 17185 additions & 47989 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codex/config.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
[mcp_servers.playwright]
2-
args = ["@playwright/mcp@latest"]
3-
command = "npx"
2+
args = ["pnpm", "dlx", "@playwright/mcp@latest"]
3+
command = "corepack"

‎.github/dependabot.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,9 @@ updates:
2020
update-types:
2121
- "major"
2222
open-pull-requests-limit: 10
23+
cooldown:
24+
semver-major-days: 30
25+
semver-minor-days: 14
26+
semver-patch-days: 3
2327
reviewers:
24-
- "@dependabot"
28+
- "@dependabot"

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,18 @@ jobs:
1818
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
1919
with:
2020
node-version: 22
21-
cache: 'npm'
21+
22+
- name: Install pnpm
23+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
2224

2325
- name: Install dependencies
24-
run: npm ci
26+
run: pnpm install --frozen-lockfile
2527

2628
- name: Run linter
27-
run: npm run lint
29+
run: pnpm run lint
2830

2931
- name: Check formatting
30-
run: npm run format:check
32+
run: pnpm run format:check
3133

3234
test:
3335
name: Test (Node ${{ matrix.node-version }})
@@ -46,21 +48,23 @@ jobs:
4648
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
4749
with:
4850
node-version: ${{ matrix.node-version }}
49-
cache: 'npm'
51+
52+
- name: Install pnpm
53+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
5054

5155
- name: Install dependencies
52-
run: npm ci
56+
run: pnpm install --frozen-lockfile
5357

5458
- name: Run tests
55-
run: npm test
59+
run: pnpm test
5660
env:
5761
CI: true
5862

5963
- name: Build
60-
run: npm run build
64+
run: pnpm run build
6165

6266
- name: Run type tests
63-
run: npm run test:types
67+
run: pnpm run test:types
6468

6569
check:
6670
name: CI Status

‎.github/workflows/release-beta.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,16 @@ jobs:
3737
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3838
with:
3939
node-version: '22'
40-
cache: 'npm'
4140
registry-url: 'https://registry.npmjs.org'
4241

4342
- name: Upgrade npm for Trusted Publishers
4443
run: npm install -g npm@11.5.1
4544

45+
- name: Install pnpm
46+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
47+
4648
- name: Install dependencies
47-
run: npm ci
49+
run: pnpm install --frozen-lockfile
4850

4951
- name: Configure git
5052
run: |

‎.github/workflows/release-ember-client.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ jobs:
4141
- name: Upgrade npm for Trusted Publishers
4242
run: npm install -g npm@11.5.1
4343

44+
- name: Install pnpm
45+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
46+
4447
- name: Configure git
4548
run: |
4649
git config --local user.email "${{ secrets.GIT_USER_EMAIL }}"
@@ -111,15 +114,15 @@ jobs:
111114
112115
- name: Install dependencies
113116
working-directory: ./clients/ember
114-
run: npm install
117+
run: pnpm install --frozen-lockfile
115118

116119
- name: Run tests
117120
working-directory: ./clients/ember
118-
run: npm test
121+
run: pnpm test
119122

120123
- name: Run linter
121124
working-directory: ./clients/ember
122-
run: npm run lint
125+
run: pnpm run lint
123126

124127
- name: Update CHANGELOG.md
125128
working-directory: ./clients/ember

‎.github/workflows/release-static-site-client.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ jobs:
3636
- name: Upgrade npm for Trusted Publishers
3737
run: npm install -g npm@11.5.1
3838

39+
- name: Install pnpm
40+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
41+
3942
- name: Configure git
4043
run: |
4144
git config --local user.email "${{ secrets.GIT_USER_EMAIL }}"
@@ -102,15 +105,15 @@ jobs:
102105
103106
- name: Install dependencies
104107
working-directory: ./clients/static-site
105-
run: npm install
108+
run: pnpm install --frozen-lockfile
106109

107110
- name: Run tests
108111
working-directory: ./clients/static-site
109-
run: npm test
112+
run: pnpm test
110113

111114
- name: Run linter
112115
working-directory: ./clients/static-site
113-
run: npm run lint
116+
run: pnpm run lint
114117

115118
- name: Update CHANGELOG.md
116119
working-directory: ./clients/static-site
@@ -160,7 +163,7 @@ jobs:
160163
161164
- name: Build package
162165
working-directory: ./clients/static-site
163-
run: npm run build
166+
run: pnpm run build
164167

165168
- name: Reconfigure git auth
166169
run: |

‎.github/workflows/release-storybook-client.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,14 @@ jobs:
3131
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3232
with:
3333
node-version: '22'
34-
cache: 'npm'
3534
registry-url: 'https://registry.npmjs.org'
3635

3736
- name: Upgrade npm for Trusted Publishers
3837
run: npm install -g npm@11.5.1
3938

39+
- name: Install pnpm
40+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
41+
4042
- name: Configure git
4143
run: |
4244
git config --local user.email "${{ secrets.GIT_USER_EMAIL }}"
@@ -103,15 +105,15 @@ jobs:
103105
104106
- name: Install dependencies
105107
working-directory: ./clients/storybook
106-
run: npm install
108+
run: pnpm install --frozen-lockfile
107109

108110
- name: Run tests
109111
working-directory: ./clients/storybook
110-
run: npm test
112+
run: pnpm test
111113

112114
- name: Run linter
113115
working-directory: ./clients/storybook
114-
run: npm run lint
116+
run: pnpm run lint
115117

116118
- name: Update CHANGELOG.md
117119
working-directory: ./clients/storybook
@@ -145,7 +147,7 @@ jobs:
145147
146148
- name: Build package
147149
working-directory: ./clients/storybook
148-
run: npm run build
150+
run: pnpm run build
149151

150152
- name: Reconfigure git auth
151153
run: |

‎.github/workflows/release-vitest-client.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ jobs:
3636
- name: Upgrade npm for Trusted Publishers
3737
run: npm install -g npm@11.5.1
3838

39+
- name: Install pnpm
40+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
41+
3942
- name: Configure git
4043
run: |
4144
git config --local user.email "${{ secrets.GIT_USER_EMAIL }}"
@@ -102,15 +105,15 @@ jobs:
102105
103106
- name: Install dependencies
104107
working-directory: ./clients/vitest
105-
run: npm install
108+
run: pnpm install --frozen-lockfile
106109

107110
- name: Run tests
108111
working-directory: ./clients/vitest
109-
run: npm run test:unit
112+
run: pnpm run test:unit
110113

111114
- name: Run linter
112115
working-directory: ./clients/vitest
113-
run: npm run lint
116+
run: pnpm run lint
114117

115118
- name: Update CHANGELOG.md
116119
working-directory: ./clients/vitest

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,16 @@ jobs:
3232
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3333
with:
3434
node-version: '22'
35-
cache: 'npm'
3635
registry-url: 'https://registry.npmjs.org'
3736

3837
- name: Upgrade npm for Trusted Publishers
3938
run: npm install -g npm@11.5.1
4039

40+
- name: Install pnpm
41+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
42+
4143
- name: Install dependencies
42-
run: npm ci
44+
run: pnpm install --frozen-lockfile
4345

4446
- name: Configure git
4547
run: |
@@ -59,7 +61,7 @@ jobs:
5961
echo "package_version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
6062
6163
if [ "${{ github.event.inputs.version_type }}" != "current" ]; then
62-
git add package.json package-lock.json
64+
git add package.json pnpm-lock.yaml
6365
git commit -m "🔖 v$PACKAGE_VERSION"
6466
fi
6567

‎.github/workflows/reporter.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,17 +19,19 @@ jobs:
1919
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2020
with:
2121
node-version: 22
22-
cache: 'npm'
22+
23+
- name: Install pnpm
24+
run: corepack enable && corepack prepare pnpm@11.3.0 --activate
2325

2426
- name: Install dependencies
25-
run: npm ci
27+
run: pnpm install --frozen-lockfile
2628

2729
- name: Build
28-
run: npm run build
30+
run: pnpm run build
2931

3032
- name: Get installed Playwright version
3133
id: playwright-version
32-
run: echo "version=$(npx playwright --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" >> $GITHUB_OUTPUT
34+
run: echo "version=$(pnpm exec playwright --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" >> $GITHUB_OUTPUT
3335

3436
- name: Cache Playwright browsers
3537
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -40,10 +42,10 @@ jobs:
4042

4143
- name: Install Playwright browsers
4244
if: steps.playwright-cache.outputs.cache-hit != 'true'
43-
run: npx playwright install firefox --with-deps
45+
run: pnpm exec playwright install firefox --with-deps
4446

4547
- name: Run reporter visual tests
46-
run: npm run test:reporter:visual
48+
run: pnpm run test:reporter:visual
4749
env:
4850
CI: true
4951
VIZZLY_TOKEN: ${{ secrets.VIZZLY_REPORTER_TOKEN }}

0 commit comments

Comments
 (0)