Merge pull request #177 from SableClient/chore/migrate-to-pnpm

chore: migrate package manager from npm to pnpm

Author: 7w1

.github/actions/setup/action.yml

@@ -5,24 +5,27 @@ inputs:
   install-command:
     description: Command used to install dependencies.
     required: false
-    default: npm ci
+    default: pnpm install --frozen-lockfile --ignore-scripts
   build:
     description: Whether to build the app after installing dependencies.
     required: false
     default: 'false'
   build-command:
     description: Command used when build is enabled.
     required: false
-    default: npm run build
+    default: pnpm run build
 
 runs:
   using: composite
   steps:
+    - name: Setup pnpm
+      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+
     - name: Setup node
       uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version-file: '.node-version'
-        cache: 'npm'
+        cache: 'pnpm'
 
     - name: Install dependencies
       shell: bash

.github/workflows/cloudflare-web-preview.yml

@@ -110,7 +110,7 @@ jobs:
           echo "preview_url=${preview_url}" >> "$GITHUB_OUTPUT"
 
       - name: Publish summary and PR comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           MARKER: '<!-- cloudflare-worker-preview -->'
           PREVIEW_URL: ${{ steps.preview.outputs.preview_url }}

.github/workflows/docker-publish.yml

@@ -69,14 +69,14 @@ jobs:
       - name: Setup app
         uses: ./.github/actions/setup
         with:
-          install-command: npm ci --ignore-scripts
+          install-command: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Build site
         env:
           VITE_BUILD_HASH: ${{ steps.vars.outputs.short_sha }}
           VITE_IS_RELEASE_TAG: ${{ steps.release_tag.outputs.is_release }}
         run: |
-          NODE_OPTIONS=--max_old_space_size=4096 npm run build
+          NODE_OPTIONS=--max_old_space_size=4096 pnpm run build
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

.github/workflows/prepare-release.yml

@@ -32,7 +32,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enrich changelog with PR attribution
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/quality-checks.yml

@@ -21,7 +21,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Check formatting
-        run: npm run fmt:check
+        run: pnpm run fmt:check
 
   lint:
     name: Lint
@@ -38,7 +38,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Run ESLint
-        run: npm run lint
+        run: pnpm run lint
 
   typecheck:
     name: Typecheck
@@ -55,7 +55,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Run TypeScript typecheck
-        run: npm run typecheck -- --pretty false
+        run: pnpm run typecheck --pretty false
 
   knip:
     name: Knip
@@ -70,8 +70,6 @@ jobs:
 
       - name: Setup app
         uses: ./.github/actions/setup
-        with:
-          install-command: npm ci --ignore-scripts
 
       - name: Run Knip
-        run: npm run knip
+        run: pnpm run knip

.github/workflows/require-changeset.yml

@@ -49,7 +49,7 @@ jobs:
           fi
 
       - name: Manage changeset comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           SKIP: ${{ steps.labels.outputs.skip }}
           CHANGESET_FOUND: ${{ steps.check.outputs.found }}
@@ -86,7 +86,7 @@ jobs:
 
             **How to add a changeset:**
 
-            1. Run \`npm run document-change\` (interactive) and commit the generated file, or
+            1. Run \`pnpm run document-change\` (interactive) and commit the generated file, or
             2. Manually create \`.changeset/<descriptive-name>.md\`:
 
             \`\`\`md

.npmrc

@@ -1,7 +1,7 @@
 dist
 node_modules
 package.json
-package-lock.json
+pnpm-lock.yaml
 LICENSE
 README.md
 CHANGELOG.md

.prettierignore

@@ -39,10 +39,10 @@ Also, we use [ESLint](https://eslint.org/) for clean and stylistically consisten
 
 **Pull requests are not merged unless all quality checks are passing.** At minimum, `format`, `lint`, `typecheck`, and `knip` must all be green before a pull request can be merged. Run these locally before opening or updating a pull request:
 
-- `npm run fmt:check`
-- `npm run lint`
-- `npm run typecheck`
-- `npm run knip`
+- `pnpm run fmt:check`
+- `pnpm run lint`
+- `pnpm run typecheck`
+- `pnpm run knip`
 
 ## Restrictions on Generative AI Usage
 
@@ -62,7 +62,7 @@ We use [Knope](https://knope.tech/) with the Knope GitHub Bot to manage change d
 
 If you have used [Changesets](https://github.com/changesets/changesets) before, Knope should feel very similar. The main difference is scope: Changesets is typically used for JavaScript repositories because it relies on `package.json`, while Knope is multi-language.
 
-If you prefer, you can install the Knope CLI yourself using the [official installation guide](https://knope.tech/installation/). This repo also exposes the CLI through npm scripts, so you can run `npm run knope -- <subcommand>` (for example: `npm run knope -- document-change`). Otherwise, this repo installs Knope for you via `postinstall`, so running `npm i` is enough.
+If you prefer, you can install the Knope CLI yourself using the [official installation guide](https://knope.tech/installation/). This repo also exposes the CLI through pnpm scripts, so you can run `pnpm run knope -- <subcommand>` (for example: `pnpm run knope -- document-change`). Otherwise, this repo installs Knope for you via `postinstall`, so running `pnpm i` is enough.
 
 ### Documenting a change
 
@@ -72,8 +72,8 @@ For user-facing pull requests, add one before requesting review.
 
 CLI paths:
 
-- `npm run document-change`
-- `npm run knope -- document-change`
+- `pnpm run document-change`
+- `pnpm run knope -- document-change`
 - `knope document-change` (if Knope is installed locally)
 
 All commands open an interactive prompt; fill in the package, change type, and short summary, then commit the generated change file in your PR.
@@ -112,11 +112,11 @@ Releases are driven by Knope Bot (`[bot.releases].enabled = true`):
 
 Maintainers can preview behavior without changing files:
 
-- `npm run knope -- release --dry-run`
+- `pnpm run knope -- release --dry-run`
 
 You can also validate the local Knope config with:
 
-- `npm run knope -- --validate`
+- `pnpm run knope -- --validate`
 
 **For any query or design discussion, join our [Matrix room](https://matrix.to/#/#sable:sable.moe).**
 

CONTRIBUTING.md

@@ -1,18 +1,24 @@
+## Base
+FROM --platform=$BUILDPLATFORM node:24.13.1-alpine AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable
+
 ## Builder
-FROM --platform=$BUILDPLATFORM node:24.13.1-alpine AS builder
+FROM base AS builder
 
 WORKDIR /src
 
 ARG VITE_BUILD_HASH
 ARG VITE_IS_RELEASE_TAG=false
 ENV VITE_BUILD_HASH=$VITE_BUILD_HASH
 ENV VITE_IS_RELEASE_TAG=$VITE_IS_RELEASE_TAG
-
-COPY .npmrc package.json package-lock.json /src/
-RUN npm ci --ignore-scripts
+COPY pnpm-lock.yaml /src/
+RUN pnpm fetch
 COPY . /src/
+RUN pnpm install --offline --frozen-lockfile --ignore-scripts
 ENV NODE_OPTIONS=--max_old_space_size=4096
-RUN npm run build
+RUN pnpm run build
 
 ## Dist
 FROM scratch AS site-dist