chore: migrate impit-node to pnpm and enable minimum release age#436
Open
chore: migrate impit-node to pnpm and enable minimum release age#436
Conversation
github-actions
bot
added
the
t-tooling
Migrate the impit-node Node/TypeScript subpackage from Yarn 4 to pnpm 10.24.0 as part of org-wide supply-chain hardening. The Rust workspace root and impit-python are unaffected. Changes: - impit-node/package.json: set packageManager to [email protected]; rewrite scripts (npm run -> pnpm) so they work outside Yarn. - impit-node/pnpm-workspace.yaml: 24h minimumReleaseAge with @apify/* and @crawlee/* excluded. - impit-node/.npmrc: hoisted node-linker + public-hoist-pattern to keep napi-rs / TypeDoc happy with a flat-ish layout. - Delete impit-node/yarn.lock and impit-node/.yarnrc.yml; add impit-node/pnpm-lock.yaml. (No .yarn/patches existed.) - .github/actions/pnpm-install/action.yml: shared composite action (copied from apify/got-scraping) for potential reuse. - .github/workflows/node-test.yaml, node-release.yaml, docs.yaml: drop corepack enable / cache: yarn; replace yarn with pnpm across the build matrix, release pipeline and typedoc job. Node test matrix is now [18, 20, 22, 24]. npm publish becomes pnpm publish --no-git-checks. The build jobs keep defaults.run.working-directory: impit-node and use inline pnpm setup (Rust + Node in sequence makes approach (a) cleaner than the composite action). - renovate.json: add minimumReleaseAge "1 day" and internalChecksFilter "strict"; add @apify/*, @crawlee/* bypass rule; drop the npm constraints block that is no longer meaningful. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Repo root has no package.json, so pnpm/action-setup can't infer the version from packageManager. Pin to 10.24.0 explicitly (matches impit-node/package.json).
Replaces the local .github/actions/pnpm-install composite copy with the shared one from apify/workflows@main. Identical behavior, less duplication.
…m release-age gate
Silences npm warnings about unknown options like node-linker; pnpm reads the same keys from pnpm-workspace.yaml in camelCase form.
Block accidental npm/yarn install — npm 10.5+ and pnpm 10.x both honor devEngines.packageManager and refuse to run when it doesn't match.
B4nan
force-pushed
the
chore/migrate-to-pnpm
branch
from
3494ed8 to
f7916eb
Compare
barjin
reviewed
Apr 16, 2026
Replace all pnpm/action-setup + manual install with the shared composite action. Docker builds keep npm install -g pnpm (can't use GH actions inside containers). Depends on apify/workflows#269 for the working-directory input.
barjin
approved these changes
Apr 16, 2026
Member
barjin
left a comment
barjin
left a comment
There was a problem hiding this comment.
One nit, otherwise ✔️ . Thanks!
Switch deprecated ::set-output syntax to $GITHUB_OUTPUT and use pnpm instead of npm for version command consistency. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
devEngines.packageManager breaks pnpm commands that delegate to npm (pnpm version, pnpm pkg set, etc). Use the battle-tested only-allow approach instead (same as Vite, Vue, Astro).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate the
impit-node/Node/TypeScript subpackage from Yarn 4 to pnpm 10.24.0 as part of the org-wide supply-chain hardening rollout (aligning with apify/got-scraping#175 and apify/actor-scraper#273). The Rust workspace (impit/) andimpit-python/are untouched.A 24 h
minimumReleaseAgeis enforced viapnpm-workspace.yamland Renovate, with@apify/*and@crawlee/*excluded so first-party packages flow through immediately.Changes
impit-node/package.json:packageManager->[email protected]; scripts rewritten sonpm run build:debugbecomespnpm build:debug.engines.nodewas already>= 20so no change needed.impit-node/pnpm-workspace.yaml(new):minimumReleaseAge: 1440with@apify/*,@crawlee/*in the exclude list.impit-node/.npmrc(new):node-linker=hoisted,link-workspace-packages=true,prefer-workspace-packages=true,public-hoist-pattern[]=*- needed sonapi-rs,typedoc, and friends can resolve transitive deps without the Yarn PnP / flat layout they implicitly rely on.impit-node/yarn.lock,impit-node/.yarnrc.yml. There was no.yarn/patches/directory to preserve.impit-node/pnpm-lock.yaml(generated bypnpm install)..github/actions/pnpm-install/action.yml(new): composite action copied verbatim fromapify/got-scrapingfor consistency. The impit workflows don't end up using it (see below) but it's in place for future reuse..github/workflows/node-test.yaml: removedcache: yarn,corepack enable,yarn global add pnpm lerna; replacedyarn --cwd impit-node Xwithpnpm X(build job already setsdefaults.run.working-directory: impit-node); inlined the pnpm setup (pnpm/[email protected]+pnpm install --frozen-lockfile) rather than using the composite because each job interleaves Rust toolchain setup,dtolnay/rust-toolchain, cargo caching, and Docker-based musl builds - approach (a) from the migration guide is cleaner here. Node test matrix is now[18, 20, 22, 24](was[20, 22]). Docker-based musl/aarch64 test shells install pnpm vianpm install -g [email protected]before invoking it..github/workflows/node-release.yaml: same pnpm substitution;yarn version->npm version --no-git-tag-version+pnpm copy-version;npm publish --provenance->pnpm publish --no-git-checks --provenance;yarn install --no-immutablelockfile refresh ->pnpm install --lockfile-only;npx semver->pnpm dlx semver..github/workflows/docs.yaml: replaced the Yarn setup in the TypeDoc job with pnpm;cd impit-node && yarn docs->cd impit-node && pnpm docs. Rust and Python docs jobs untouched.renovate.json: addedminimumReleaseAge: "1 day"andinternalChecksFilter: "strict"; added a package rule bypassing the delay for@apify/*and@crawlee/*; dropped theconstraints.npmblock which no longer reflects reality under pnpm.Rust + Node layout notes
impit-node/is one crate in a multi-crate Cargo workspace.cargo metadataand the napi build both run fromimpit-node/and reach out to the parentCargo.toml, so nothing about the pnpm change affects the Rust side.buildjob innode-test.yamlusesdefaults.run.working-directory: impit-nodeand the inline pnpm setup honours that. The docker-based musl matrix entries stillcd impit-nodeexplicitly because they run from the mounted workspace root (/build).Verification
pnpm installandpnpm install --frozen-lockfileinimpit-node/both succeed with pnpm 10.24.0.pnpm exec napi --versionresolves (3.6.1), confirming the napi CLI is reachable through the hoisted layout.pnpm build/pnpm build:debug/pnpm testrequire the Rust toolchain, which is not available in this environment; they are exercised by CI which already installsdtolnay/rust-toolchain@stable.lintscript exists inimpit-node/package.json, so nothing to run there.🤖 Generated with Claude Code