feat(infra): adopt pnpm

[bmuenzenmeyer]

• next.config.js, next-intl, i18n work — commit
• pnpm build — import errors resolved, packages cleaned up
  • pnpm build when installed with --prod
• pnpm dev
  • pnpm dev when installed with --prod
• pnpm test - subpath import work needed
• pnpm test:ci
• pnpm lint
• pnpm lint:fix
• pnpm prettier
• pnpm prettier:fix
• pnpm format
• pnpm storybook
• pnpm storybook:build
• pnpm check-types
• pnpm scripts:release-post
• Vercel Deployments
• npm use cases

Tasks from Vote

• Add pnpm to README and docs
• Add package-lock.json to .gitignore
• Use pnpm in CI
• Check pnpm-lock.yaml in CI
  • This is always done when installing from a CI environment, see https://pnpm.io/cli/install#--frozen-lockfile
• Add devEngines and packageManager to package.json

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
nodejs-org	✅ Ready (Inspect)	Visit Preview	May 2, 2025 8:43pm

[bmuenzenmeyer]

running full ci just for fun

[avivkeller]

running full ci just for fun

FWIW because this changes the pull_request_target workflows, a full CI will almost certainly fail every time (as the main branch CI doesn't set up pnpm). What I would do is, add a workflow_dispatch trigger to each of the CIs you want to test, and trigger them with:

gh workflow run lint-and-tests.yml --ref pnpm

Before merging, just remove the trigger.

[avivkeller]

Assuming that CI passes, all reviews, tasks, and failures have been addressed

[avivkeller]

Required checks, despite being listed as pending, pass on manual run:

• https://github.com/nodejs/nodejs.org/actions/runs/14784000640
• https://github.com/nodejs/nodejs.org/actions/runs/14783998030

Review dependencies fails because of GHSA-f7f6-9jq7-3rqj. AFAICT this isn't an issue for us, since all the content we are supplying has been manually reviewed (unlike a public forum, where the data is arbitrary)

[avivkeller]

@nodejs/web-infra This cannot land via the merge queue. When you feel comfortable landing this (not now, but when your ready), you will need bypass the branch protection rules.

[AugustinMauroy]

if we can ovoid pnpm and use node that would be nice

[avivkeller]

if we can ovoid pnpm and use node that would be nice

According to the vote, we are to use pnpm when possible.

#5334 (reply in thread)

[avivkeller]

If there are no other objections, could someone with Bypass Rules permissions merge this on Monday? (I'm -1 on merging before the weekend, lest something bad happen)

[ovflowd]

If there are no other objections, could someone with Bypass Rules permissions merge this on Monday? (I'm -1 on merging before the weekend, lest something bad happen)

I'm feeling daring today :P

[ovflowd]

(Amazing work y'all, btw)

[flakey5]

(Amazing work y'all, btw)

+1