ci: migrate to pnpm and adopt the shared PR checks workflow - #74
Merged
Conversation
json-up was the only repo in the org still on npm and Node 20; every other package is pnpm 11.0.9 on Node 22. That divergence is why it could not join the shared PR checks workflow, which fixes one toolchain rather than carrying a package-manager input for a single repo. - package-lock.json replaced with pnpm-lock.yaml - engines.node raised from >=20 to >=22 - packageManager pinned to pnpm@11.0.9, matching the org - pnpm-workspace.yaml added so esbuild is the only dependency permitted to run install scripts, rather than pnpm silently ignoring build scripts as it did on first install Verified under pnpm before pushing: lint, types, format, knip, build and the full AVA suite all pass, coverage 99.29% — the highest in the org and comfortably over the 80% floor. Fifth repo onto the shared workflow. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WoygKgfq3ahXinVVHqjA8
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
The previous commit swapped the lockfile but left npm everywhere it was actually invoked, so release.yml and update-badges.yml would both have broken on merge — `npm ci` fails with ENOLOCK once package-lock.json is gone. CI caught the first instance: test:audit was still `npm audit` and failed in the advisory job. - test:audit: npm audit -> pnpm audit --audit-level=high --ignore-unfixable, matching the rest of the org - scripts/test.sh: npm run -> pnpm run throughout - release.yml and update-badges.yml: add pnpm/action-setup, cache pnpm rather than npm, npm ci -> pnpm install --frozen-lockfile, and pnpm for build/test - prepublishOnly: npm run -> pnpm run `npm view` and `npm publish` stay as they are — publishing reads package.json and the built files, and get-md does the same on pnpm. Verified: `pnpm test:all` passes end to end, including the audit step that failed in CI. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WoygKgfq3ahXinVVHqjA8
Semgrep flagged three findings on the pnpm-workspace.yaml added in this branch, all correct and all mine: the file allowlisted esbuild builds but carried none of the hardening sentinel and nanocoder already use. - blockExoticSubdeps: true - minimumReleaseAge: 10080 (7 days) - trustPolicy: no-downgrade Verified with a clean install — node_modules removed, then `pnpm install --frozen-lockfile` — so the release-age quarantine does not reject anything currently resolved. No minimumReleaseAgeExclude needed, unlike sentinel. This is the posture the collective documents but applies inconsistently: sentinel and nanocoder have it, prompt-scrubber does not (semgrep flags the same three rules there). Worth a conformance check rather than per-repo archaeology. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WoygKgfq3ahXinVVHqjA8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fifth repo onto the shared
pr-checksworkflow inNano-Collective/.github.Why this one needed a migration first
json-upwas the only repo in the org still on npm and Node 20. Every other package is pnpm 11.0.9 on Node 22:package-lock.json)pnpm-lock.yaml)engines.node>=20>=22packageManagerpnpm@11.0.9The shared workflow fixes one toolchain rather than carrying a package-manager input for a single outlier, so standardising here was the prerequisite.
pnpm-workspace.yaml
Added, because the first
pnpm installreported:pnpm blocks install scripts by default.
esbuildis now explicitly the only dependency permitted to run one, matching how nanoterm and sentinel handle the same thing — an allowlist rather than a silent skip.Verified locally under pnpm before pushing
All six blocking checks, run against the new lockfile:
test:linttest:typestest:formattest:knipbuildtest:ava:coverageThat is the highest coverage in the org and comfortably clear of the 80% floor, so no interim threshold is needed here.
What it gains
Blocking — Linting, Type Checks, Format Checks, Unused Dependencies, Unit Tests & Coverage Analysis, Verify Build, plus fail-on-drop against the coverage badge on
main.Advisory — Package Audit Analysis, Semgrep Security Scan, CodeQL Security Analysis. They report but never fail the PR.