feat: migrate package manager from npm to pnpm - #669
Draft
serendipty01 wants to merge 1 commit into
Draft
Conversation
serendipty01
requested review from
a team,
cassidyjames,
dom-notion,
juanmrad,
julietshen and
vinaysrao1
as code owners
June 2, 2026 16:01
Contributor
|
Warning Review limit reached
More reviews will be available in 55 minutes and 8 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (8)
📒 Files selected for processing (18)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR migrates the repo from npm-driven per-package installs to a pnpm workspace layout and updates local tooling + CI + Docker/publish flows accordingly.
Changes:
- Switches package scripts across workspaces from
npm runtopnpm runand adds root workspace orchestration scripts. - Introduces
pnpm-workspace.yamland updates Dockerfiles/docker-compose/CI workflows to install withpnpm. - Updates developer docs and agent guidance to reflect pnpm workspace workflows and new supply-chain guardrails.
Reviewed changes
Copilot reviewed 17 out of 26 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| types/package.json | Use pnpm for prepublishOnly and tests. |
| server/package.json | Use pnpm for scripts; add typings/dev deps to support Postgres + Jest snapshot behavior. |
| scripts/publish-packages.sh | Publish script migrated from npm to pnpm with frozen installs. |
| pnpm-workspace.yaml | Adds workspace package list plus dependency/security-related pnpm configuration. |
| package.json | Declares pnpm as package manager; adds recursive workspace scripts. |
| migrator/package.json | Uses pnpm for prepublish build step. |
| docs/development/local.md | Updates local CI-equivalent commands from npm to pnpm. |
| docker-compose.yaml | Updates services to run pnpm-based lint/build/test/migrations; adjusts working dirs/volumes. |
| db/Dockerfile | Switches db image build to pnpm lockfile-based install/build/prune. |
| client/package.json | Updates scripts to pnpm; adds new UI deps. |
| client/Dockerfile | Switches client image build to workspace-aware pnpm install and build. |
| Dockerfile | Switches server/backend images to pnpm workspace install + new runtime paths. |
| AGENTS.md | Updates architecture/dev commands guidance for pnpm workspace + lockfile and security notes. |
| .gitignore | Ignores local pnpm store dir. |
| .github/workflows/publish-types.yaml | Publishes types package using pnpm with pnpm caching. |
| .github/workflows/publish-db-migrator.yaml | Publishes migrator using pnpm with pnpm caching. |
| .github/workflows/apply_pr_checks.yaml | Runs docker-compose checks using pnpm inside containers. |
| .env.githubci | Sets CI=true for docker-compose bash conditionals. |
Files not reviewed (4)
- db/package-lock.json: Language not supported
- migrator/package-lock.json: Language not supported
- nodejs-instrumentation/package-lock.json: Language not supported
- types/package-lock.json: Language not supported
Comment on lines
+25
to
+31
| command: bash -c 'set -e && corepack enable | ||
| && pnpm install --filter coop-data-migrator --frozen-lockfile --store-dir /tmp/pnpm-store | ||
| && ( [ "$$CI" = "true" ] && ( cd db && NODE_OPTIONS="--loader ts-node/esm" node src/index.ts clean --env staging ) || true ) | ||
| && for db in api-server-pg scylla clickhouse; do | ||
| ( cd db && NODE_OPTIONS="--loader ts-node/esm" node src/index.ts create --db "$$db" --env staging ); | ||
| ( cd db && NODE_OPTIONS="--loader ts-node/esm" node src/index.ts apply --db "$$db" --env staging ); | ||
| done' |
| drop_dbs: | ||
| image: node:24.14.1-bullseye-slim | ||
| command: bash -c 'npm i && npm run db:drop -- --env staging' | ||
| command: bash -c 'corepack enable && pnpm install --filter coop-data-migrator --frozen-lockfile --store-dir /tmp/pnpm-store && ( cd db && NODE_OPTIONS="--loader ts-node/esm" node src/index.ts drop --env staging )' |
Comment on lines
+9
to
+17
| overrides: | ||
| # Force all packages (including transitive deps like @node-saml/passport-saml) | ||
| # to use @types/express v5. Mirrors the override in server/package.json that | ||
| # worked under npm but is ignored by pnpm (pnpm only reads root overrides). | ||
| "@types/express": "^5" | ||
| # v6 fixes the interface Matchers<R, T = {}> incompatibility with @types/jest@30. | ||
| # v5 used Matchers<R> (one param) which doesn't merge with jest@30's two-param | ||
| # signature. v6 is already in the pnpm store (pulled by storybook@9). | ||
| "@testing-library/jest-dom": "^6" |
| # clone-or-copy: use copy-on-write cloning from the pnpm store (fastest on APFS/macOS), | ||
| # fall back to copying on Linux CI where CoW may not be available. | ||
| # Avoids hardlinks, which can cause confusing behaviour when editing node_modules locally. | ||
| packageImportMethod: clone-or-copy |
Comment on lines
+27
to
+29
| preferWorkspacePackages: true | ||
|
|
||
| ignoredBuiltDependencies: |
| - protobufjs | ||
| - unrs-resolver | ||
|
|
||
| onlyBuiltDependencies: |
|
|
||
| # Refuse to install packages published less than 7 days ago (10080 minutes). | ||
| # Mitigates "publish-and-immediately-compromise" supply chain attacks. | ||
| minimumReleaseAge: 10080 |
Comment on lines
+54
to
+56
| blockExoticSubdeps: true | ||
|
|
||
| allowBuilds: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces npm with pnpm as the package manager across the monorepo. This is a pure tooling change — no TypeScript source files are modified (those type hygiene fixes landed separately in #668).
What changes:
pnpm-workspace.yamldefining the workspace with 6 packages, supply-chain minimum age (7 days), and build dependenciespackage-lock.jsonfiles with a single rootpnpm-lock.yaml"packageManager": "pnpm@10.22.0"in rootpackage.json; replaces allnpm run/npx→pnpm run/pnpm execin scriptsserver/package.json(@types/pg,jest-snapshot) and new UI deps toclient/package.json(@ant-design/icons,@radix-ui/react-dialog,@radix-ui/react-slot)corepack enable && pnpm install --frozen-lockfiledocker-compose.yamlworking dirs and volume paths for pnpm workspace layoutpnpmdocs/development/local.mdandAGENTS.mdDependencies
Requires #668 to merge first. The type hygiene fixes in #668 (phantom-dep
safe-stable-stringifyassertions, etc.) must be inmainbefore this PR's pnpm lock file takes effect — pnpm's strictnodeLinkerwon't hoist those transitive types automatically.Test plan
docker compose run --rm backend pnpm run lintdocker compose run --rm backend pnpm run builddocker compose run --rm client pnpm run lintdocker compose run --rm client pnpm run builddocker compose run --rm testdocker compose run --rm codegen-checkRelated
Closes #224 — this PR plus #668 together replace the original pnpm migration PR.