SF-3821 Switch to pnpm

.devcontainer/Dockerfile

@@ -6,6 +6,7 @@ ARG UBUNTU_NAME=noble
 FROM mcr.microsoft.com/dotnet/sdk:${DOTNET_VERSION}-${UBUNTU_NAME}-amd64
 
 ARG NODE_MAJOR=22
+ARG PNPM_VERSION=11.10
 
 # Avoid prompts during package installation
 ENV DEBIAN_FRONTEND=noninteractive
@@ -32,7 +33,8 @@ RUN apt-get update \
       https://brave-browser-apt-release.s3.brave.com/brave-browser.sources \
     && apt-get update \
     && apt-get install --assume-yes brave-browser \
-    && apt-get distclean
+    && apt-get distclean \
+    && npm install --global pnpm@${PNPM_VERSION}
 
 # Set up Scripture Forge data directories
 RUN mkdir --parents /var/lib/scriptureforge/sync \

.devcontainer/README.md

@@ -67,8 +67,8 @@ You can run tests:
 
 ```bash
 cd /workspaces/web-xforge && dotnet test
-cd /workspaces/web-xforge/src/SIL.XForge.Scripture/ClientApp && npm run test:headless -- --no-watch
-cd /workspaces/web-xforge/src/RealtimeServer && npm run test
+cd /workspaces/web-xforge/src/SIL.XForge.Scripture/ClientApp && pnpm run test:headless --no-watch
+cd /workspaces/web-xforge/src/RealtimeServer && pnpm run test
 ```
 
 ## Ports

.devcontainer/post-create.sh

@@ -10,12 +10,12 @@ dotnet tool restore
 echo "=== Restoring .NET packages ==="
 dotnet restore
 
-echo "=== Installing RealtimeServer npm packages ==="
+echo "=== Installing RealtimeServer pnpm packages ==="
 cd src/RealtimeServer
-npm ci
+pnpm ci
 
-echo "=== Installing ClientApp npm packages ==="
+echo "=== Installing ClientApp pnpm packages ==="
 cd ../SIL.XForge.Scripture/ClientApp
-npm ci
+pnpm ci
 
 echo "=== Post-create setup complete ==="

.github/workflows/build-and-test.yml

@@ -21,6 +21,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
+        pnpm_version: ["11.10.0"]
       # Continue building in other environments to see which are working.
       fail-fast: false
     runs-on: ${{matrix.os}}
@@ -36,14 +37,18 @@ jobs:
           dotnet-version: ${{matrix.dotnet_version}}
           cache: true
           cache-dependency-path: src/SIL.XForge.Scripture/packages.lock.json
+      - name: "Deps: pnpm"
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: ${{matrix.pnpm_version}}
       - name: "Deps: Node"
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: ${{matrix.node_version}}
-          cache: "npm"
+          cache: "pnpm"
           cache-dependency-path: |
-            src/SIL.XForge.Scripture/ClientApp/package-lock.json
-            src/RealtimeServer/package-lock.json
+            src/SIL.XForge.Scripture/ClientApp/pnpm-lock.yaml
+            src/RealtimeServer/pnpm-lock.yaml
       - name: "Deps: npm"
         env:
           NPM_VERSION: ${{matrix.npm_version}}
@@ -62,38 +67,42 @@ jobs:
           node --version
           which npm
           npm --version
+          which pnpm
+          pnpm --version
           which chromium-browser
           chromium-browser --version
       - name: "Ensure desired tool versions"
         # The build machine may come with newer tools than we are ready for.
         env:
           NODE_VERSION: ${{matrix.node_version}}
           NPM_VERSION: ${{matrix.npm_version}}
+          PNPM_VERSION: ${{matrix.pnpm_version}}
         run: |
           set -xueo pipefail
           [[ $(node --version) == v${NODE_VERSION} ]]
           [[ $(npm --version) == ${NPM_VERSION} ]]
+          [[ $(pnpm --version) == ${PNPM_VERSION} ]]
 
       - name: "Deps: reportgenerator tool"
         run: dotnet tool install --global dotnet-reportgenerator-globaltool
-      - name: "Deps: RealtimeServer npm"
-        run: cd src/RealtimeServer && (npm ci || (sleep 3m && npm ci))
+      - name: "Deps: RealtimeServer pnpm"
+        run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
       - name: "Deps: Backend nuget"
         run: dotnet restore
-      - name: "Deps: Frontend npm"
-        run: cd src/SIL.XForge.Scripture/ClientApp && (npm ci || (sleep 3m && npm ci))
+      - name: "Deps: Frontend pnpm"
+        run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci))
 
       - name: "Build: Backend, RealtimeServer"
         run: dotnet build xForge.sln
       - name: "Build: Frontend"
-        run: cd src/SIL.XForge.Scripture/ClientApp && npm run build
+        run: cd src/SIL.XForge.Scripture/ClientApp && pnpm run build
 
       - name: "Test: Ensure tests not focused on a subset"
         # grep returns code 123 when no matches are found. The operator ! negates the exit code.
         run: |
           ! git ls-files | grep "\\.spec\\.ts" | xargs grep -P "^\s*(fdescribe|fit)\("
       - name: "Test: RealtimeServer"
-        run: cd src/RealtimeServer && npm run test:ci
+        run: cd src/RealtimeServer && pnpm run test:ci
       - name: "Test: Backend"
         run: |
           dotnet test \
@@ -107,7 +116,7 @@ jobs:
         run: |
           set -euo pipefail
           cd src/SIL.XForge.Scripture/ClientApp
-          npm run test:gha | tee test_output.log
+          pnpm run test:gha | tee test_output.log
           if grep --perl-regex '\bNG\d+\b|ERROR:|WARN:|LOG:|INFO:' test_output.log; then
             echo "Error: Disallowed token found in test run output, as shown above.";
             exit 1;
@@ -139,6 +148,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
+        pnpm_version: ["11.10.0"]
       fail-fast: false
     runs-on: ${{matrix.os}}
     steps:
@@ -153,14 +163,18 @@ jobs:
           dotnet-version: ${{matrix.dotnet_version}}
           cache: true
           cache-dependency-path: src/SIL.XForge.Scripture/packages.lock.json
+      - name: "Deps: pnpm"
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: ${{matrix.pnpm_version}}
       - name: "Deps: Node"
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: ${{matrix.node_version}}
-          cache: "npm"
+          cache: "pnpm"
           cache-dependency-path: |
-            src/SIL.XForge.Scripture/ClientApp/package-lock.json
-            src/RealtimeServer/package-lock.json
+            src/SIL.XForge.Scripture/ClientApp/pnpm-lock.yaml
+            src/RealtimeServer/pnpm-lock.yaml
       - name: "Deps: npm"
         env:
           NPM_VERSION: ${{matrix.npm_version}}
@@ -179,23 +193,27 @@ jobs:
           node --version
           which npm
           npm --version
+          which pnpm
+          pnpm --version
           which chromium-browser
           chromium-browser --version
       - name: "Ensure desired tool versions"
         env:
           NODE_VERSION: ${{matrix.node_version}}
           NPM_VERSION: ${{matrix.npm_version}}
+          PNPM_VERSION: ${{matrix.pnpm_version}}
         run: |
           set -xueo pipefail
           [[ $(node --version) == v${NODE_VERSION} ]]
           [[ $(npm --version) == ${NPM_VERSION} ]]
+          [[ $(pnpm --version) == ${PNPM_VERSION} ]]
 
       - name: "Production build"
         run: scripts/build-production
 
       - name: "Test: Backend"
         run: dotnet test xForge.sln
       - name: "Test: RealtimeServer"
-        run: cd src/RealtimeServer && npm run test:ci
+        run: cd src/RealtimeServer && pnpm run test:ci
       - name: "Test: Frontend"
-        run: cd src/SIL.XForge.Scripture/ClientApp && npm run test:gha
+        run: cd src/SIL.XForge.Scripture/ClientApp && pnpm run test:gha

.github/workflows/ci-lint-prettier.yml

@@ -19,30 +19,35 @@ jobs:
       matrix:
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
+        pnpm_version: ["11.10.0"]
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Use Node.js ${{ matrix.node_version }}
+      - name: "Deps: pnpm"
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: ${{matrix.pnpm_version}}
+      - name: Use Node.js ${{matrix.node_version}}
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
-          node-version: ${{ matrix.node_version }}
-          cache: "npm"
+          node-version: ${{matrix.node_version}}
+          cache: "pnpm"
           cache-dependency-path: |
-            src/SIL.XForge.Scripture/ClientApp/package-lock.json
-            src/RealtimeServer/package-lock.json
+            src/SIL.XForge.Scripture/ClientApp/pnpm-lock.yaml
+            src/RealtimeServer/pnpm-lock.yaml
       - name: Upgrade npm
         env:
-          NPM_VERSION: ${{ matrix.npm_version }}
+          NPM_VERSION: ${{matrix.npm_version}}
         run: |
           set -xueo pipefail
-          npm install -g npm@${NPM_VERSION}
+          npm install --global npm@${NPM_VERSION}
       - name: Realtime Server Lint check
-        run: cd src/RealtimeServer && (npm ci || (sleep 3m && npm ci)) && npm run lint
+        run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci)) && pnpm run lint
       - name: Realtime Server Prettier format check
-        run: cd src/RealtimeServer && npm run prettier:ci
+        run: cd src/RealtimeServer && pnpm run prettier:ci
       - name: Angular Frontend Lint check
-        run: cd src/SIL.XForge.Scripture/ClientApp && (npm ci || (sleep 3m && npm ci)) && npm run lint
+        run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci)) && pnpm run lint
       - name: Angular Frontend Prettier format check
-        run: cd src/SIL.XForge.Scripture/ClientApp && npm run prettier:ci
+        run: cd src/SIL.XForge.Scripture/ClientApp && pnpm run prettier:ci

.github/workflows/ci-production-build.yml

@@ -13,35 +13,40 @@ on:
 
 jobs:
   build:
-    name: node ${{ matrix.node_version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
+    name: node ${{matrix.node_version }} on ${{matrix.os}}
+    runs-on: ${{matrix.os}}
 
     strategy:
       matrix:
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
+        pnpm_version: ["11.10.0"]
         os: [ubuntu-latest]
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Use Node.js ${{ matrix.node_version }}
+      - name: "Deps: pnpm"
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: ${{matrix.pnpm_version}}
+      - name: Use Node.js ${{matrix.node_version}}
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
-          node-version: ${{ matrix.node_version }}
-          cache: "npm"
+          node-version: ${{matrix.node_version}}
+          cache: "pnpm"
           cache-dependency-path: |
-            src/SIL.XForge.Scripture/ClientApp/package-lock.json
-            src/RealtimeServer/package-lock.json
+            src/SIL.XForge.Scripture/ClientApp/pnpm-lock.yaml
+            src/RealtimeServer/pnpm-lock.yaml
       - name: Upgrade npm
         env:
-          NPM_VERSION: ${{ matrix.npm_version }}
+          NPM_VERSION: ${{matrix.npm_version}}
         run: |
           set -xueo pipefail
-          npm install -g npm@${NPM_VERSION}
+          npm install --global npm@${NPM_VERSION}
       - name: Build Realtime server dependencies for Angular
-        run: cd src/RealtimeServer && (npm ci || (sleep 3m && npm ci))
+        run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
       - name: Angular Frontend Production Build
-        run: cd src/SIL.XForge.Scripture/ClientApp && (npm ci || (sleep 3m && npm ci)) && npm run build
+        run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci)) && pnpm run build

.github/workflows/codeql.yml

@@ -50,6 +50,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
+        pnpm_version: ["11.10.0"]
 
     steps:
       - name: Checkout repository
@@ -64,25 +65,30 @@ jobs:
           cache: true
           cache-dependency-path: src/SIL.XForge.Scripture/packages.lock.json
 
-      - name: Use Node.js ${{ matrix.node_version }}
+      - name: "Deps: pnpm"
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: ${{matrix.pnpm_version}}
+
+      - name: Use Node.js ${{matrix.node_version}}
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
-          node-version: ${{ matrix.node_version }}
-          cache: "npm"
+          node-version: ${{matrix.node_version}}
+          cache: "pnpm"
           cache-dependency-path: |
-            src/SIL.XForge.Scripture/ClientApp/package-lock.json
-            src/RealtimeServer/package-lock.json
+            src/SIL.XForge.Scripture/ClientApp/pnpm-lock.yaml
+            src/RealtimeServer/pnpm-lock.yaml
 
       - name: Upgrade npm
-        run: npm install -g npm@${{matrix.npm_version}}
+        run: npm install --global npm@${{matrix.npm_version}}
 
-      # Install NPM dependencies. This is an attempt to fix errors building TypeScript that occur in the Autobuild step.
-      # They might be caused by NPM dependencies not being successfully installed before trying to build. If this
+      # Install PNPM dependencies. This is an attempt to fix errors building TypeScript that occur in the Autobuild step.
+      # They might be caused by PNPM dependencies not being successfully installed before trying to build. If this
       # doesn't prevent those errors, we should remove this step.
       # Another possible approach would be to create a C# build config that does not build the realtime server at all,
       # which would result in faster analysis and remove this failure mode.
       - name: Install realtime-server dependencies
-        run: cd src/RealtimeServer && (npm ci || (sleep 3m && npm ci))
+        run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1