Skip to content

chore: migrate from npm to pnpm package manager #2000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
krovomi wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

chore: migrate from npm to pnpm package manager #2000

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 27 additions & 34 deletions .github/actions/setup-node-frontend/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,74 +1,73 @@
name: 'Setup Node.js Frontend'
description: 'Set up Node.js with npm and cached dependencies for the frontend'
description: 'Set up Node.js with pnpm and cached dependencies for the frontend'

Comment on lines 1 to 3
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check for npm command usage in GitHub workflows
echo "=== Searching for 'npm run' in workflow files ==="
rg -n 'npm run' .github/workflows/ || echo "No matches found"

echo ""
echo "=== Searching for 'npm ci' or 'npm install' in workflow files ==="
rg -n 'npm (ci|install)' .github/workflows/ || echo "No matches found"

Repository: AndyMik90/Aperant

Length of output: 2202

Update workflows to use pnpm run instead of npm run for consistency.

The setup-node-frontend action configures pnpm, but multiple workflows still invoke npm run commands. This creates an inconsistency where the workflows bypass the pnpm setup:

  • .github/workflows/ci.yml (lines 133, 137, 141): npm run typecheck, npm run test, npm run build
  • .github/workflows/release.yml: 8 instances of npm run commands
  • .github/workflows/beta-release.yml: 7 instances of npm run commands
  • .github/workflows/build-prebuilds.yml: 1 instance of npm install

Update these to use pnpm run and pnpm install respectively to align with the pnpm migration.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/actions/setup-node-frontend/action.yml around lines 1 - 3, Workflows
reference npm commands but the setup action "Setup Node.js Frontend" configures
pnpm; update all workflow invocations to use pnpm to match that setup: replace
`npm run ...` with `pnpm run ...` for the
typecheck/test/build/release/beta-release occurrences and change `npm install`
in build-prebuilds to `pnpm install`; make the changes across the mentioned
workflow files and ensure commands invoked (e.g., typecheck, test, build,
release scripts) remain the same names when switching to `pnpm run`.

inputs:
node-version:
description: 'Node.js version to use'
required: false
default: '24'
ignore-scripts:
description: 'Whether to use --ignore-scripts flag during npm ci'
description: 'Whether to use --ignore-scripts flag during pnpm install'
required: false
default: 'false'

outputs:
cache-hit:
description: 'Whether npm cache was hit'
description: 'Whether pnpm cache was hit'
value: ${{ steps.cache.outputs.cache-hit }}

runs:
using: 'composite'
steps:
- name: Setup Node.js ${{ inputs.node-version }}
uses: actions/setup-node@v4
uses: actions/setup-node@v6
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version v6 for actions/setup-node does not exist. The current stable major version is v4. Using a non-existent version will cause the GitHub Action to fail.

      uses: actions/setup-node@v4

with:
node-version: ${{ inputs.node-version }}

- name: Get npm cache directory
id: npm-cache-dir
- name: Install pnpm
shell: bash
run: echo "dir=$(npm config get cache)" >> "$GITHUB_OUTPUT"
run: |
npm cache clean --force
npm install -g pnpm
Comment on lines +30 to +31
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Running npm cache clean --force is unnecessary in CI environments as runners typically start with a clean state. Removing this will slightly speed up the workflow.

        npm install -g pnpm

Comment on lines +29 to +31
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Unnecessary npm cache clean --force before pnpm install.

The npm cache clean --force is unnecessary when installing pnpm globally. This adds ~2-5 seconds to every CI run without benefit.

Proposed fix 
     - name: Install pnpm
       shell: bash
-      run: |
-        npm cache clean --force
-        npm install -g pnpm
+      run: npm install -g pnpm

Alternatively, consider using pnpm/action-setup which is the official GitHub Action for pnpm and handles caching more efficiently.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: |
npm cache clean --force
npm install -g pnpm
run: npm install -g pnpm
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/actions/setup-node-frontend/action.yml around lines 29 - 31, Remove
the unnecessary "npm cache clean --force" invocation from the run step so only
"npm install -g pnpm" remains (delete the line containing the exact string "npm
cache clean --force"); alternatively replace the global install with the
official pnpm GitHub Action (pnpm/action-setup) to manage pnpm installation and
caching more efficiently instead of running "npm install -g pnpm" directly.


- name: Get pnpm store directory
id: pnpm-cache-dir
shell: bash
run: echo "dir=$(pnpm store path)" >> "$GITHUB_OUTPUT"

- name: Cache npm dependencies
- name: Cache pnpm dependencies
id: cache
uses: actions/cache@v4
uses: actions/cache@v5
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version v5 for actions/cache does not exist. The current stable major version is v4.

      uses: actions/cache@v4

with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
restore-keys: ${{ runner.os }}-npm-
path: ${{ steps.pnpm-cache-dir.outputs.dir }}
key: ${{ runner.os }}-pnpm-migrate-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/frontend/package.json') }}
restore-keys: ${{ runner.os }}-pnpm-migrate-${{ hashFiles('pnpm-lock.yaml') }}-
Comment on lines +43 to +44
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Transitional cache key prefix should be removed post-migration.

The cache key includes a migrate prefix (pnpm-migrate-). This is useful during the transition to invalidate old npm caches, but should be removed once the migration is complete to simplify the key.

Post-migration cleanup 
-        key: ${{ runner.os }}-pnpm-migrate-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/frontend/package.json') }}
-        restore-keys: ${{ runner.os }}-pnpm-migrate-${{ hashFiles('pnpm-lock.yaml') }}-
+        key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/frontend/package.json') }}
+        restore-keys: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}-
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
key: ${{ runner.os }}-pnpm-migrate-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/frontend/package.json') }}
restore-keys: ${{ runner.os }}-pnpm-migrate-${{ hashFiles('pnpm-lock.yaml') }}-
key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/frontend/package.json') }}
restore-keys: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}-
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/actions/setup-node-frontend/action.yml around lines 43 - 44, The
cache key strings still include the transitional prefix "pnpm-migrate-" which
should be removed now that migration is complete; update the two cache key
values that reference "${{ runner.os }}-pnpm-migrate-${{
hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/frontend/package.json') }}"
and "${{ runner.os }}-pnpm-migrate-${{ hashFiles('pnpm-lock.yaml') }}-" to drop
the "pnpm-migrate-" segment (e.g. "${{ runner.os }}-pnpm-${{
hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/frontend/package.json') }}"
and corresponding restore key), and search for any other occurrences of
"pnpm-migrate-" in the workflow to update them consistently.


- name: Install dependencies
shell: bash
# Run npm ci from root to properly handle workspace dependencies.
# With npm workspaces, the lock file is at root and dependencies are hoisted there.
# Running npm ci in apps/frontend would fail to populate node_modules correctly.
run: |
# Remove any existing node_modules to avoid conflicts
if [ "${{ inputs.ignore-scripts }}" == "true" ]; then
npm ci --ignore-scripts
pnpm install --frozen-lockfile --ignore-scripts
else
npm ci
pnpm install --frozen-lockfile
fi

- name: Link node_modules for electron-builder
shell: bash
# electron-builder expects node_modules in apps/frontend for native module rebuilding.
# With npm workspaces, packages are hoisted to root. Create a link so electron-builder
# can find the modules during packaging and code signing.
# With pnpm workspaces, packages are in the pnpm store and linked via node_modules/.pnpm.
# Create a link so electron-builder can find the modules during packaging and code signing.
# Uses symlink on Unix, directory junction on Windows (works without admin privileges).
#
# IMPORTANT: npm workspaces may create a partial node_modules in apps/frontend for
# packages that couldn't be hoisted. We must remove it and create a proper link to root.
run: |
# Verify npm ci succeeded
# Verify pnpm install succeeded
if [ ! -d "node_modules" ]; then
echo "::error::Root node_modules does not exist. npm ci may have failed."
echo "::error::Root node_modules does not exist. pnpm install may have failed."
exit 1
fi

# Remove any existing node_modules in apps/frontend
# This handles: partial directories from npm workspaces, AND broken symlinks
if [ -e "apps/frontend/node_modules" ] || [ -L "apps/frontend/node_modules" ]; then
# Check if it's a valid symlink pointing to root node_modules
if [ -L "apps/frontend/node_modules" ]; then
target=$(readlink apps/frontend/node_modules 2>/dev/null || echo "")
if [ "$target" = "../../node_modules" ] && [ -d "apps/frontend/node_modules" ]; then
Expand All @@ -78,16 +77,14 @@ runs:
rm -f "apps/frontend/node_modules"
fi
else
echo "Removing partial node_modules directory created by npm workspaces..."
echo "Removing partial node_modules directory created by pnpm workspaces..."
rm -rf "apps/frontend/node_modules"
Copy link
Copy Markdown

@sentry sentry bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The GitHub action incorrectly symlinks apps/frontend/node_modules to the root node_modules, which breaks dependency resolution because pnpm does not hoist workspace dependencies by default.
Severity: CRITICAL

Suggested Fix

Remove the steps in the setup-node-frontend action that delete apps/frontend/node_modules and create a symlink. Allow pnpm to manage the workspace's node_modules directories as intended, which involves creating symlinks from within each workspace package to the central .pnpm store.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/actions/setup-node-frontend/action.yml#L81

Potential issue: The `setup-node-frontend` GitHub action, after running `pnpm install`,
deletes the `apps/frontend/node_modules` directory and replaces it with a symlink to the
root `node_modules` directory. This is based on the incorrect assumption that pnpm does
not hoist workspace dependencies. In pnpm's default workspace configuration,
dependencies like `electron` are not hoisted to the root `node_modules`. As a result,
the symlink will point to a directory that is missing required dependencies for the
frontend application, causing the verification step `ls
apps/frontend/node_modules/electron` to fail and breaking the CI pipeline.

Did we get this right? 👍 / 👎 to inform future reviews.

fi
fi

# Create link if it doesn't exist or was removed
if [ ! -L "apps/frontend/node_modules" ]; then
if [ "$RUNNER_OS" == "Windows" ]; then
# Use directory junction on Windows (works without admin privileges)
# Use PowerShell's New-Item -ItemType Junction for reliable path handling
abs_target=$(cygpath -w "$(pwd)/node_modules")
link_path=$(cygpath -w "$(pwd)/apps/frontend/node_modules")
powershell -Command "New-Item -ItemType Junction -Path '$link_path' -Target '$abs_target'" > /dev/null
Expand All @@ -98,7 +95,6 @@ runs:
exit 1
fi
else
# Use symlink on Unix (macOS/Linux)
if ln -s ../../node_modules apps/frontend/node_modules; then
echo "Created symlink: apps/frontend/node_modules -> ../../node_modules"
else
Expand All @@ -108,14 +104,11 @@ runs:
fi
fi

# Final verification - the link must exist and resolve correctly
# Note: On Windows, junctions don't show as symlinks (-L), so we check if the directory exists
# and can be listed. On Unix, we also verify it's a symlink.
# Final verification
if [ "$RUNNER_OS" != "Windows" ] && [ ! -L "apps/frontend/node_modules" ]; then
echo "::error::apps/frontend/node_modules symlink was not created"
exit 1
fi
# Verify the link resolves to a valid directory with content
if ! ls apps/frontend/node_modules/electron >/dev/null 2>&1; then
echo "::error::apps/frontend/node_modules does not resolve correctly (electron not found)"
ls -la apps/frontend/ || true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jobs:
- name: Setup Biome
uses: biomejs/setup-biome@v2
with:
version: 2.3.11
version: 2.4.10

- name: Run Biome
working-directory: apps/frontend
Expand Down
8 changes: 4 additions & 4 deletions apps/frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@
"zustand": "^5.0.9"
},
"devDependencies": {
"@biomejs/biome": "2.3.11",
"@biomejs/biome": "2.4.10",
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version 2.4.10 for @biomejs/biome does not exist. The current latest stable version is 1.9.4. This will cause the installation to fail.

Suggested change
"@biomejs/biome": "2.4.10",
"@biomejs/biome": "1.9.4",

"@electron-toolkit/preload": "^3.0.2",
"@electron-toolkit/utils": "^4.0.0",
"@electron/rebuild": "^4.0.2",
Expand All @@ -122,19 +122,19 @@
"@types/react-dom": "^19.2.3",
"@types/semver": "^7.7.1",
"@types/uuid": "^11.0.0",
"@vitejs/plugin-react": "^5.1.2",
"@vitejs/plugin-react": "^6.0.1",
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version 6.0.1 for @vitejs/plugin-react does not exist. The current latest stable version is 4.3.4.

Suggested change
"@vitejs/plugin-react": "^6.0.1",
"@vitejs/plugin-react": "^4.3.4",

"autoprefixer": "^10.4.22",
"cross-env": "^10.1.0",
"electron": "40.0.0",
"electron-builder": "^26.4.0",
"electron-vite": "^5.0.0",
"husky": "^9.1.7",
"jsdom": "^27.3.0",
"jsdom": "^29.0.2",
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version 29.0.2 for jsdom does not exist. The current latest stable version is 26.0.0.

Suggested change
"jsdom": "^29.0.2",
"jsdom": "^26.0.0",

"lint-staged": "^16.2.7",
"postcss": "^8.5.6",
"tailwindcss": "^4.1.17",
"typescript": "^5.9.3",
"vite": "^7.2.7",
"vite": "^8.0.5",
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version 8.0.5 for vite does not exist. The current latest stable version is 6.1.0.

Suggested change
"vite": "^8.0.5",
"vite": "^6.1.0",

"vitest": "^4.0.16"
},
"overrides": {
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@
"electron"
],
"devDependencies": {
"jsdom": "^27.4.0"
"jsdom": "^29.0.2"
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version 29.0.2 for jsdom does not exist. Please use a valid version such as ^26.0.0.

Suggested change
"jsdom": "^29.0.2"
"jsdom": "^26.0.0"

},
"dependencies": {
"lucide-react": "^0.562.0"
Expand Down
Loading