migrate to pnpm (#609)

* migrate to `pnpm`

* rename `simple-project` fixture packages to remove socket security errors

* add pnpm `dedupe` options

* update release-pr workflow

* update

* update snashots

* tweaks

* tweak

* tweak

* fix missing ci-setup

* tweak

* tweak deps

* update pnpm

* ok, Socket, let's rename them

* update snapshots

* rename again

* fmt

---------

Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>

.github/workflows/publish.yml

@@ -21,17 +21,21 @@ jobs:
       issues: write # to post issue comments (changesets/action)
       pull-requests: write # to create pull request (changesets/action)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/ci-setup
 
       - name: Build
-        run: yarn build
+        run: pnpm build
 
       - name: Create or update release pull request
         id: changesets
         uses: ./
         with:
-          version: yarn bump
+          version: pnpm bump
 
   publish:
     name: Publish
@@ -49,17 +53,19 @@ jobs:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: true
           # we need this token to bypass the branch and tag protection rules
           token: ${{ steps.app-token.outputs.token }}
 
       - uses: ./.github/actions/ci-setup
 
       - name: Build
-        run: yarn build
+        run: pnpm build
 
       - name: Publish to marketplace
         uses: ./
         with:
-          publish: yarn release
+          publish: pnpm release