chore: migrate to pnpm and enable minimum release age - #268
Merged
Merged
Conversation
github-actions
Bot
added
t-tooling
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
April 15, 2026 12:18
401a5a9 to
1f506ce
Compare
B4nan
marked this pull request as ready for review
April 15, 2026 13:41
Migrates camoufox-js from Yarn 4 to pnpm and adds a 1-day minimum release age supply-chain guard at the package-manager layer (pnpm-workspace.yaml) and at the Renovate layer. Internal `@apify/*` and `@crawlee/*` packages are whitelisted at both layers. Notable changes: - package.json: set packageManager to pnpm@10.24.0 (was yarn@4.13.0); replace "npm run copy-files" with "pnpm copy-files" in build script - Removed Yarn artifacts: yarn.lock, .yarnrc.yml - Removed .yarn/ and .npmrc entries from .gitignore so pnpm's .npmrc is committed - pnpm-workspace.yaml: non-monorepo minimumReleaseAge settings only - .npmrc: node-linker=hoisted + link-workspace-packages=true + prefer-workspace-packages=true + public-hoist-pattern[]=* - New .github/actions/pnpm-install composite action (cached pnpm store, year-month + lockfile hash key) - CI workflows (test.yml, release.yml): delegate install to the composite; corepack step removed; `yarn X` -> `pnpm X`; `npx camoufox fetch` -> `pnpm exec camoufox fetch`; `npm publish` -> `pnpm publish --no-git-checks`; Node matrix 20/22/24 (engines.node requires >=20) - renovate.json: add minimumReleaseAge "1 day", internalChecksFilter "strict", and @apify/* + @crawlee/* whitelist Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The package's bin is `camoufox-js` (derived from package name); the master workflow used npx which tolerated the name mismatch, but pnpm exec is strict. Also approve esbuild's postinstall.
The package.json bin is derived from the package name (camoufox-js); pnpm exec is strict about name matching.
pnpm only symlinks bins at install time; since dist/__main__.js doesn't exist until after build, the camoufox-js bin is never added to node_modules/.bin.
Replaces the local .github/actions/pnpm-install composite copy with the shared one from apify/workflows@main. Identical behavior, less duplication.
…m release-age gate
Silences npm warnings about unknown options like node-linker; pnpm reads the same keys from pnpm-workspace.yaml in camelCase form.
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
April 15, 2026 17:36
0206558 to
e00ec58
Compare
Block accidental npm/yarn install — npm 10.5+ and pnpm 10.x both honor devEngines.packageManager and refuse to run when it doesn't match.
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
April 15, 2026 17:42
e00ec58 to
82d7814
Compare
Add --no-git-tag-version flag to pnpm version calls to prevent auto-commits and tags that conflict with the EndBug/add-and-commit step. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
devEngines.packageManager breaks pnpm commands that delegate to npm (pnpm version, pnpm pkg set, etc). Use the battle-tested only-allow approach instead (same as Vite, Vue, Astro).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates camoufox-js from Yarn 4 to pnpm and adds a 1-day minimum release age supply-chain guard at both the package-manager layer (
pnpm-workspace.yaml) and the Renovate layer. Internal@apify/*and@crawlee/*packages are whitelisted at both layers. Part of the org-wide pnpm migration; follows the same pattern as apify/apify-shared-js#616, apify/actor-scraper#273, and apify/got-scraping#175.Changes
package.json: setpackageManagertopnpm@10.24.0(wasyarn@4.13.0); replacenpm run copy-fileswithpnpm copy-filesin the build scriptyarn.lock,.yarnrc.yml.yarn/and.npmrcentries from.gitignoreso pnpm's.npmrcis committedpnpm-workspace.yaml: non-monorepominimumReleaseAge: 1440with@apify/*+@crawlee/*exclusions.npmrc:node-linker=hoisted,link-workspace-packages=true,prefer-workspace-packages=true,public-hoist-pattern[]=*.github/actions/pnpm-installcomposite action (cached pnpm store, year-month + lockfile hash key)test.yml,release.yml): delegate install to the composite; corepack step removed;yarn X->pnpm X;npx camoufox fetch->pnpm exec camoufox fetch;npm publish->pnpm publish --no-git-checks; Node matrix[20, 22, 24](engines.node requires>=20, so Node 18 is intentionally omitted)renovate.json: addminimumReleaseAge: "1 day",internalChecksFilter: "strict", and a packageRule whitelisting@apify/*+@crawlee/*at0 days🤖 Generated with Claude Code