Skip to content

chore: migrate to PNPM #1793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

chore: migrate to PNPM #1793

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ec73414
chore: initial move to pnpm
chris-olszewski Sep 29, 2025
e337663
chore: update GH workflows to use pnpm
chris-olszewski Oct 6, 2025
d528f6f
chore: add @types/uuid dependency to client
chris-olszewski Oct 6, 2025
b9cdd15
chore: add docs to workspace
chris-olszewski Oct 6, 2025
f4b7186
chore: update other workflows
chris-olszewski Oct 7, 2025
5939bb0
specify pnpm version
chris-olszewski Nov 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions .github/actions/setup-node-deps/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,33 +25,39 @@ outputs:
runs:
using: 'composite'
steps:
- name: Install pnpm
uses: pnpm/action-setup@v4
with:
run_install: false

- name: Install Node
uses: actions/setup-node@v4
with:
node-version: ${{ inputs.node-version }}
cache: "pnpm"

- name: Get NPM cache directory
- name: Get PNPM store directory
id: npm-cache-dir
shell: bash
run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
run: echo "dir=$(pnpm store path)" >> ${GITHUB_OUTPUT}

- name: Restore NPM cache
- name: Restore PNPM store
id: restore-cache
uses: actions/cache/restore@v4
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
key: npm-main-${{ inputs.platform }}-${{ hashFiles('./package-lock.json') }}
key: pnpm-main-${{ inputs.platform }}-${{ hashFiles('./pnpm-lock.yaml') }}
restore-keys: |
npm-main-${{ inputs.platform }}-
pnpm-main-${{ inputs.platform }}-

- name: Download dependencies
shell: bash
run: |
npm ci --ignore-scripts --verbose || npm ci --ignore-scripts --verbose || npm ci --ignore-scripts --verbose
pnpm install --frozen-lockfile || pnpm install --frozen-lockfile || pnpm install --frozen-lockfile

- name: Save NPM cache
- name: Save PNPM store
if: inputs.save-cache == 'true'
uses: actions/cache/save@v4
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
key: npm-main-${{ inputs.platform }}-${{ hashFiles('./package-lock.json') }}
key: pnpm-main-${{ inputs.platform }}-${{ hashFiles('./pnpm-lock.yaml') }}
5 changes: 3 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ jobs:
working-directory: ${{ runner.temp }}

- name: Compile code
run: npm run build -- --ignore @temporalio/core-bridge
run: pnpm run build --ignore @temporalio/core-bridge

- name: Publish to Verdaccio
run: node scripts/publish-to-verdaccio.js --registry-dir ${{ steps.tmp-dir.outputs.dir }}/npm-registry
Expand All @@ -196,7 +196,7 @@ jobs:
--headless &> ./devserver.log &

- name: Run Tests
run: npm run test
run: pnpm run test
env:
RUN_INTEGRATION_TESTS: true
REUSE_V8_CONTEXT: ${{ matrix.reuse-v8-context }}
Expand Down Expand Up @@ -260,6 +260,7 @@ jobs:

# End samples

# TODO: PNPM doesn't write logs to file by default
- name: Upload NPM logs
uses: actions/upload-artifact@v4
if: failure() || cancelled()
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/conventions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:

# eslint-import-resolver-typescript requires packages to be built
- name: Compile all non-rust code
run: npm run build -- --ignore @temporalio/core-bridge
run: pnpm run build --ignore @temporalio/core-bridge

- run: npm run lint.check
- run: npm run lint.prune
- run: pnpm run lint.check
- run: pnpm run lint.prune
6 changes: 3 additions & 3 deletions .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,10 +45,10 @@ jobs:
node-version: '22'
platform: 'linux-x64'

- run: npm run build -- --ignore @temporalio/core-bridge
- run: pnpm run build --ignore @temporalio/core-bridge

- name: Build docs
run: npm run docs
run: pnpm run docs
env:
ALGOLIA_API_KEY: ${{ secrets.ALGOLIA_API_KEY }}

Expand All @@ -58,7 +58,7 @@ jobs:
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
run: |
npx vercel deploy packages/docs/build \
pnpm dlx vercel deploy packages/docs/build \
-t '${{ secrets.VERCEL_TOKEN }}' \
--yes \
${{ inputs.publish_target == 'prod' && '--prod' || '' }}
Comment on lines 60 to 64
Copy link

@semgrep-managed-scans semgrep-managed-scans bot Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified a blocking 🔴 issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

You can view more details about this finding in the Semgrep AppSec Platform.

8 changes: 1 addition & 7 deletions .github/workflows/nightly-throughput-stress.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ jobs:
with:
node-version: '22'
platform: 'linux-x64'
save-cache: 'true'

- name: Install protoc
uses: arduino/setup-protoc@v3
Expand All @@ -101,13 +102,6 @@ jobs:
env:
BUILD_CORE_RELEASE: true

- name: Save NPM cache
uses: actions/cache/save@v4
if: always()
with:
path: ${{ steps.setup-node.outputs.cache-dir }}
key: npm-main-linux-x64-${{ hashFiles('./package-lock.json') }}

- name: Install Temporal CLI
uses: temporalio/setup-temporal@v0

Expand Down
10 changes: 2 additions & 8 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,9 +175,10 @@ jobs:
with:
node-version: '22'
platform: ${{ matrix.platform }}
save-cache: ${{ env.IS_MAIN_OR_RELEASE }}

- name: Compile code
run: npm run build -- --ignore @temporalio/core-bridge
run: pnpm run build --ignore @temporalio/core-bridge

- name: Publish to Verdaccio
run: node scripts/publish-to-verdaccio.js --registry-dir ./tmp/registry
Expand All @@ -188,13 +189,6 @@ jobs:
name: verdaccio-repo
path: ./tmp/registry/storage

- name: Save NPM cache
uses: actions/cache/save@v4
# Only saves NPM cache from the main branch, to reduce pressure on the cache (limited to 10GB).
if: ${{ env.IS_MAIN_OR_RELEASE == 'true' }}
with:
path: ${{ steps.setup-node.outputs.cache-dir }}
key: npm-main-${{ matrix.platform }}-${{ hashFiles('./package-lock.json') }}

# Tests that npm init @temporalio results in a working worker and client
test-npm-init:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/stress.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ jobs:
save-if: ${{ env.IS_MAIN_OR_RELEASE == 'true' }}

- name: Compile code
run: npm run build
run: pnpm run build
env:
BUILD_CORE_RELEASE: true

Expand Down
4 changes: 2 additions & 2 deletions lerna.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"version": "1.13.1",
"npmClient": "npm",
"npmClient": "pnpm",
"command": {
"publish": {
"message": "chore(release): Publish",
Expand All @@ -11,4 +11,4 @@
}
},
"$schema": "node_modules/lerna/schemas/lerna-schema.json"
}
}
Loading
Loading