migrate to pnpm (#609)

* migrate to `pnpm`

* rename `simple-project` fixture packages to remove socket security errors

* add pnpm `dedupe` options

* update release-pr workflow

* update

* update snashots

* tweaks

* tweak

* tweak

* fix missing ci-setup

* tweak

* tweak deps

* update pnpm

* ok, Socket, let's rename them

* update snapshots

* rename again

* fmt

---------

Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>
This commit is contained in:
Marco Pasqualetti
2026-05-14 09:04:38 +00:00
committed by GitHub
co-authored by Mateusz Burzyński
parent ccba80bb5a
commit 04ba326779
16 changed files with 3721 additions and 3161 deletions
+7 -4
View File
@@ -1,14 +1,17 @@
name: Setup CI
description: Setup CI
runs:
using: composite
steps:
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
- name: Set up pnpm
uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version-file: ".node-version"
cache: yarn
cache: pnpm
- name: Install dependencies
shell: bash
run: yarn install --frozen-lockfile
run: pnpm install --frozen-lockfile
+16 -6
View File
@@ -3,9 +3,11 @@ name: CI
on:
pull_request:
push:
branches: [main]
branches:
- main
merge_group:
branches: [main]
branches:
- main
permissions:
contents: read
@@ -17,11 +19,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Check out repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: ./.github/actions/ci-setup
- name: Test
run: yarn test
run: pnpm test
typecheck:
name: Typecheck
@@ -29,11 +35,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Check out repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: ./.github/actions/ci-setup
- name: Typecheck
run: yarn typecheck
run: pnpm typecheck
ci-ok:
name: CI OK
+12 -6
View File
@@ -21,17 +21,21 @@ jobs:
issues: write # to post issue comments (changesets/action)
pull-requests: write # to create pull request (changesets/action)
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Check out repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: ./.github/actions/ci-setup
- name: Build
run: yarn build
run: pnpm build
- name: Create or update release pull request
id: changesets
uses: ./
with:
version: yarn bump
version: pnpm bump
publish:
name: Publish
@@ -49,17 +53,19 @@ jobs:
client-id: ${{ vars.APP_CLIENT_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Check out repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: true
# we need this token to bypass the branch and tag protection rules
token: ${{ steps.app-token.outputs.token }}
- uses: ./.github/actions/ci-setup
- name: Build
run: yarn build
run: pnpm build
- name: Publish to marketplace
uses: ./
with:
publish: yarn release
publish: pnpm release
+28 -10
View File
@@ -9,11 +9,14 @@ permissions: {}
jobs:
release_check:
if: github.repository == 'changesets/action' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/release-pr')
timeout-minutes: 5
runs-on: ubuntu-latest
permissions:
contents: read
issues: write
pull-requests: read
steps:
- id: report_in_progress
run: |
@@ -99,12 +102,18 @@ jobs:
timeout-minutes: 20
runs-on: ubuntu-latest
needs: release_check
permissions:
contents: write
issues: write
pull-requests: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Check out repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: ./.github/actions/ci-setup
- name: Fetch validated commit from pull request head repository
@@ -131,12 +140,13 @@ jobs:
if: steps.check_version_packages.outputs.version_packages == 'true'
run: git reset --hard HEAD~1
- run: yarn changeset version --snapshot pr${{ github.event.issue.number }}
- name: Create snapshot version
run: pnpm changeset version --snapshot pr${{ github.event.issue.number }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Build
run: yarn build
run: pnpm build
- name: Setup Git user
run: |
@@ -144,17 +154,20 @@ jobs:
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
- name: Release snapshot version
run: yarn run release:pr
run: pnpm release:pr
- run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='rocket'
- name: Add success reaction
run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='rocket'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
- name: Remove in-progress reaction
run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: |
- name: Comment success
run: |
gh pr comment ${{ github.event.issue.number }} --body "The release for \`${{ needs.release_check.outputs.resolved_sha }}\` triggered by [this comment](${{ github.event.comment.url }}) has [succeeded](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}). Published commit: [${{ github.repository }}@$(git rev-parse HEAD)](https://github.com/${{ github.repository }}/commit/$(git rev-parse HEAD))."
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -164,19 +177,24 @@ jobs:
timeout-minutes: 2
runs-on: ubuntu-latest
if: failure() && github.repository == 'changesets/action' && (needs.release_check.result == 'failure' || needs.release.result == 'failure')
permissions:
issues: write
pull-requests: write
steps:
- run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='-1'
- name: Add failure reaction
run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='-1'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
- name: Remove in-progress reaction
run: gh api -X DELETE /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions/${{ needs.release_check.outputs.in_progress_reaction_id }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: |
- name: Comment failure
run: |
gh pr comment ${{ github.event.issue.number }} --body "The release for \`${{ needs.release_check.outputs.requested_sha }}\` triggered by [this comment](${{ github.event.comment.url }}) has [failed](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})."
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+38 -26
View File
@@ -21,7 +21,7 @@ This action for [Changesets](https://github.com/changesets/changesets) creates a
- published - A boolean value to indicate whether a publishing has happened or not
- publishedPackages - A JSON array to present the published packages. The format is `[{"name": "@xx/xx", "version": "1.2.0"}, {"name": "@xx/xy", "version": "0.8.9"}]`
### Example workflow:
### Example workflow
#### Without Publishing
@@ -43,15 +43,18 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@v3
uses: actions/checkout@v6
- name: Setup Node.js 20
uses: actions/setup-node@v3
- name: Setup pnpm
uses: pnpm/action-setup@v6
- name: Setup Node.js 26
uses: actions/setup-node@v6
with:
node-version: 20
node-version: 26
- name: Install Dependencies
run: yarn
run: pnpm install --frozen-lockfile
- name: Create Release Pull Request
uses: changesets/action@v1
@@ -77,22 +80,25 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@v3
uses: actions/checkout@v6
- name: Setup Node.js 20.x
uses: actions/setup-node@v3
- name: Setup pnpm
uses: pnpm/action-setup@v6
- name: Setup Node.js 26
uses: actions/setup-node@v6
with:
node-version: 20.x
node-version: 26
- name: Install Dependencies
run: yarn
run: pnpm install --frozen-lockfile
- name: Create Release Pull Request or Publish to npm
id: changesets
uses: changesets/action@v1
with:
# This expects you to have a script called release which does a build for your packages and calls changeset publish
publish: yarn release
publish: pnpm release
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -104,7 +110,7 @@ jobs:
By default the GitHub Action creates a `.npmrc` file with the following content:
```
```txt
//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}
```
@@ -141,15 +147,18 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@v3
uses: actions/checkout@v6
- name: Setup Node.js 20.x
uses: actions/setup-node@v3
- name: Setup pnpm
uses: pnpm/action-setup@v6
- name: Setup Node.js 26
uses: actions/setup-node@v6
with:
node-version: 20.x
node-version: 26
- name: Install Dependencies
run: yarn
run: pnpm install --frozen-lockfile
- name: Create Release Pull Request or Publish to npm
id: changesets
@@ -158,7 +167,7 @@ jobs:
- name: Publish
if: steps.changesets.outputs.hasChangesets == 'false'
# You can do something when a publish should happen.
run: yarn publish
run: pnpm publish
```
#### With version script
@@ -183,21 +192,24 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@v3
uses: actions/checkout@v6
- name: Setup Node.js 20.x
uses: actions/setup-node@v3
- name: Setup pnpm
uses: pnpm/action-setup@v6
- name: Setup Node.js 26
uses: actions/setup-node@v6
with:
node-version: 20.x
node-version: 26
- name: Install Dependencies
run: yarn
run: pnpm install --frozen-lockfile
- name: Create Release Pull Request
uses: changesets/action@v1
with:
# this expects you to have a npm script called version that runs some logic and then calls `changeset version`.
version: yarn version
version: pnpm version
```
#### With Yarn 2 / Plug'n'Play
@@ -208,5 +220,5 @@ If you are using [Yarn Plug'n'Play](https://yarnpkg.com/features/pnp), you shoul
- uses: changesets/action@v1
with:
version: yarn changeset version
...
# ...
```
@@ -1,4 +1,6 @@
{
"$schema": "https://unpkg.com/@changesets/config@1.3.0/schema.json",
"ignore": ["ignored-package-pkg-a"]
"ignore": [
"changesets-dev-ignored-package-pkg-a"
]
}
@@ -1,7 +1,7 @@
{
"name": "ignored-package-pkg-a",
"name": "changesets-dev-ignored-package-pkg-a",
"version": "1.0.0",
"dependencies": {
"ignored-package-pkg-b": "1.0.0"
"changesets-dev-ignored-package-pkg-b": "1.0.0"
}
}
@@ -1,4 +1,4 @@
{
"name": "ignored-package-pkg-b",
"name": "changesets-dev-ignored-package-pkg-b",
"version": "1.0.0"
}
@@ -1,7 +1,7 @@
{
"name": "simple-project-pkg-a",
"name": "changesets-dev-simple-project-pkg-a",
"version": "1.0.0",
"dependencies": {
"simple-project-pkg-b": "1.0.0"
"changesets-dev-simple-project-pkg-b": "1.0.0"
}
}
@@ -1,4 +1,4 @@
{
"name": "simple-project-pkg-b",
"name": "changesets-dev-simple-project-pkg-b",
"version": "1.0.0"
}
+13 -14
View File
@@ -7,17 +7,17 @@
"devDependencies": {
"@changesets/changelog-github": "^0.5.1",
"@changesets/cli": "^2.29.3",
"@changesets/types": "^6.1.0",
"@changesets/write": "^0.4.0",
"@rollup/plugin-commonjs": "^28.0.3",
"@rollup/plugin-json": "^6.1.0",
"@rollup/plugin-node-resolve": "^16.0.1",
"@rollup/plugin-terser": "^0.4.4",
"@types/node": "^22.15.17",
"@types/node": "^24.12.2",
"@types/semver": "^7.5.0",
"builtin-modules": "^5.0.0",
"esbuild": "^0.25.4",
"fixturez": "^1.1.0",
"husky": "^3.0.3",
"prettier": "^2.0.5",
"rollup": "^4.40.2",
"typescript": "^5.8.3",
@@ -26,7 +26,7 @@
"scripts": {
"build": "rollup -c",
"test": "vitest",
"test:watch": "yarn test --watch",
"test:watch": "pnpm test --watch",
"typecheck": "tsc",
"changeset": "changeset",
"bump": "node --experimental-strip-types ./scripts/bump.ts",
@@ -37,15 +37,15 @@
"node": ">= 24"
},
"dependencies": {
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.1",
"@actions/core": "^3.0.1",
"@actions/exec": "^3.0.0",
"@actions/github": "^9.1.1",
"@changesets/ghcommit": "^2.0.1",
"@changesets/pre": "^2.0.2",
"@changesets/read": "^0.6.5",
"@manypkg/get-packages": "^1.1.3",
"@octokit/core": "^5.2.1",
"@octokit/plugin-throttling": "^8.0.0",
"@octokit/core": "^7.0.6",
"@octokit/plugin-throttling": "^11.0.3",
"@types/mdast": "^3.0.0",
"mdast-util-to-string": "^1.0.6",
"remark-parse": "^7.0.1",
@@ -53,13 +53,12 @@
"semver": "^7.5.3",
"unified": "^8.3.2"
},
"husky": {
"hooks": {}
},
"prettier": {},
"resolutions": {
"pnpm": {
"overrides": {
"trim": "^0.0.3",
"y18n": "^4.0.1"
}
},
"packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
"prettier": {},
"packageManager": "pnpm@11.1.1+sha512.d1fdf5f73c617b64fa1a56a81c3c8dfe0e966e33a6010aa256b517ae77be21d93e05affc0de1a83b0e4f29d569f68b446ae8f068cd7247c0bb3df0fb4d7bdf9a"
}
+3571
View File
File diff suppressed because it is too large Load Diff
+8
View File
@@ -0,0 +1,8 @@
allowBuilds:
esbuild: true
blockExoticSubdeps: true
dedupePeers: true
dedupePeerDependents: true
minimumReleaseAge: 10080
trustPolicy: no-downgrade
+9 -9
View File
@@ -8,7 +8,7 @@ exports[`version > creates a draft PR when prDraft is "create" 1`] = `
# Releases
## simple-project-pkg-a@1.1.0
## changesets-dev-simple-project-pkg-a@1.1.0
### Minor Changes
@@ -31,7 +31,7 @@ exports[`version > creates simple PR 1`] = `
# Releases
## simple-project-pkg-a@1.1.0
## changesets-dev-simple-project-pkg-a@1.1.0
### Minor Changes
@@ -40,9 +40,9 @@ exports[`version > creates simple PR 1`] = `
### Patch Changes
- Updated dependencies
- simple-project-pkg-b@1.1.0
- changesets-dev-simple-project-pkg-b@1.1.0
## simple-project-pkg-b@1.1.0
## changesets-dev-simple-project-pkg-b@1.1.0
### Minor Changes
@@ -87,7 +87,7 @@ exports[`version > does not include changelog entries if full message exceeds si
> The changelog information of each package has been omitted from this message, as the content exceeds the size limit.
## simple-project-pkg-a@1.1.0
## changesets-dev-simple-project-pkg-a@1.1.0
",
"draft": false,
@@ -107,7 +107,7 @@ exports[`version > doesn't include ignored package that got a dependency update
# Releases
## ignored-package-pkg-b@1.1.0
## changesets-dev-ignored-package-pkg-b@1.1.0
### Minor Changes
@@ -130,7 +130,7 @@ exports[`version > only includes bumped packages in the PR body 1`] = `
# Releases
## simple-project-pkg-a@1.1.0
## changesets-dev-simple-project-pkg-a@1.1.0
### Minor Changes
@@ -183,7 +183,7 @@ exports[`version > updates an existing PR via GraphQL and converts it to draft w
# Releases
## simple-project-pkg-a@1.1.0
## changesets-dev-simple-project-pkg-a@1.1.0
### Minor Changes
@@ -224,7 +224,7 @@ exports[`version > updates an existing PR via GraphQL without converting it to d
# Releases
## simple-project-pkg-a@1.1.0
## changesets-dev-simple-project-pkg-a@1.1.0
### Minor Changes
+9 -9
View File
@@ -68,11 +68,11 @@ describe("version", () => {
{
releases: [
{
name: "simple-project-pkg-a",
name: "changesets-dev-simple-project-pkg-a",
type: "minor",
},
{
name: "simple-project-pkg-b",
name: "changesets-dev-simple-project-pkg-b",
type: "minor",
},
],
@@ -107,7 +107,7 @@ describe("version", () => {
{
releases: [
{
name: "simple-project-pkg-a",
name: "changesets-dev-simple-project-pkg-a",
type: "minor",
},
],
@@ -143,7 +143,7 @@ describe("version", () => {
{
releases: [
{
name: "simple-project-pkg-a",
name: "changesets-dev-simple-project-pkg-a",
type: "minor",
},
],
@@ -178,7 +178,7 @@ describe("version", () => {
{
releases: [
{
name: "ignored-package-pkg-b",
name: "changesets-dev-ignored-package-pkg-b",
type: "minor",
},
],
@@ -213,7 +213,7 @@ describe("version", () => {
{
releases: [
{
name: "simple-project-pkg-a",
name: "changesets-dev-simple-project-pkg-a",
type: "minor",
},
],
@@ -272,7 +272,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
{
releases: [
{
name: "simple-project-pkg-a",
name: "changesets-dev-simple-project-pkg-a",
type: "minor",
},
],
@@ -329,7 +329,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
{
releases: [
{
name: "simple-project-pkg-a",
name: "changesets-dev-simple-project-pkg-a",
type: "minor",
},
],
@@ -363,7 +363,7 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
{
releases: [
{
name: "simple-project-pkg-a",
name: "changesets-dev-simple-project-pkg-a",
type: "minor",
},
],
-3069
View File
File diff suppressed because it is too large Load Diff