Skip to content

chore(deps): Migrate from npm to pnpm with workspace support#1275

Closed
yamadashy wants to merge 9 commits intomainfrom
chore/migrate-to-pnpm-workspace
Closed

chore(deps): Migrate from npm to pnpm with workspace support#1275
yamadashy wants to merge 9 commits intomainfrom
chore/migrate-to-pnpm-workspace

Conversation

@yamadashy
Copy link
Copy Markdown
Owner

@yamadashy yamadashy commented Mar 21, 2026

Summary

Migrate the project from npm to pnpm as the package manager and set up pnpm workspaces to centralize dependency management across all sub-packages (browser, scripts/memory, website/client, website/server).

Changes

Package manager migration:

  • Replace npm with pnpm (packageManager field, .tool-versions)
  • Replace all package-lock.json files (5 total) with a single pnpm-lock.yaml
  • Use corepack enable consistently in all Dockerfiles

Workspace setup:

  • Add pnpm-workspace.yaml with 4 workspace packages
  • Change scripts/memory dependency: "file:../..""workspace:*"
  • Change website/server dependency: "github:yamadashy/repomix#main""workspace:*"
  • Rename browser package from "repomix" to "repomix-browser" to avoid name collision

CI simplification:

  • All workflows use pnpm/action-setup + pnpm install --frozen-lockfile
  • Remove npm link dance for website server — workspace resolves dependencies automatically
  • Use pnpm --filter <name> for sub-package commands
  • perf-benchmark.yml includes npm fallback for transition period

Docker updates:

  • Root Dockerfile: use corepack enable + pnpm link --global
  • Server Dockerfile: build from repo root context for workspace dependency resolution
  • Compose files: mount repo root for workspace support

Checklist

  • Run pnpm run test (113 files, 1086 tests passed)
  • Run pnpm run lint (lint-ts, lint-secretlint passed)

🤖 Generated with Claude Code


Open with Devin

yamadashy and others added 2 commits March 21, 2026 16:38
Replace npm with pnpm as the package manager and set up pnpm workspaces
to centralize dependency management across all sub-packages.

Changes:
- Add pnpm-workspace.yaml with browser, scripts/memory, website/client,
  website/server as workspace packages
- Replace all package-lock.json files with a single pnpm-lock.yaml
- Update .tool-versions: npm → pnpm
- Add packageManager field to package.json
- Update all CI workflows to use pnpm/action-setup and pnpm commands
- Update root Dockerfile to use pnpm
- Update website server Dockerfile to build from repo root context
  with workspace dependency resolution
- Update website client Dockerfile and compose files for pnpm
- Change workspace dependencies:
  - scripts/memory: file:../.. → workspace:*
  - website/server: github:yamadashy/repomix#main → workspace:*
- Simplify CI jobs: remove npm link dance, use pnpm --filter instead

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Rename browser package from "repomix" to "repomix-browser" to avoid
  workspace name collision with root package
- Fix cloud-deploy script to submit repo root as build context
- Use corepack enable consistently in all Dockerfiles instead of
  hardcoding pnpm version (reduces maintenance when version bumps)
- Replace npm link with pnpm link --global in root Dockerfile
- Change prepack script from "npm run build" to "node --run build"
- Replace "npm run" with "pnpm run" in sub-package scripts
  (browser, website/client, website/server)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 21, 2026

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 14936635-e6d3-42e9-bfd9-5a1c7993b522

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This PR performs a comprehensive migration from npm to pnpm across the entire project, including GitHub Actions workflows, Docker configurations, workspace setup, and package.json files. It replaces npm commands with pnpm equivalents and adds a pnpm workspace configuration.

Changes

Cohort / File(s) Summary
GitHub Actions Workflows
.github/workflows/autofix.yml, benchmark.yml, ci.yml, npm-publish.yml, perf-benchmark.yml, schema-update.yml
Switched all workflows from npm to pnpm: added pnpm/action-setup, replaced cache: npm with cache: pnpm, replaced npm ci with pnpm install --frozen-lockfile, and updated all script invocations from npm run to pnpm run (or pnpm --filter ... run for workspace packages). Notable: perf-benchmark.yml includes fallback logic to npm if pnpm-lock.yaml is missing.
Package Manager Configuration
.tool-versions, .gitignore, pnpm-workspace.yaml
Updated .tool-versions to specify pnpm 10.32.1 instead of npm 11.10.0. Changed .gitignore to ignore .pnpm-store/ instead of .yarn/. Added new pnpm-workspace.yaml declaring workspace packages: browser, scripts/memory, website/client, and website/server.
Root and Workspace Package.json Files
package.json, browser/package.json, website/client/package.json, website/server/package.json, scripts/memory/package.json
Updated package.json to add packageManager: pnpm@10.32.1, replace yarn engine requirement with pnpm >=10.0.0, and use node --run build in prepack. Renamed browser package to repomix-browser. Updated website/client lint script to use pnpm run lint-tsc. Changed website/server cloud-deploy context from . to ../.. and dependency from GitHub main to workspace:*. Switched scripts/memory repomix dependency from file:../.. to workspace:*.
Dockerfiles and Compose
Dockerfile, website/client/Dockerfile, website/server/Dockerfile, website/compose.yml, website/compose.bundle.yml
Replaced all npm ci, npm run build, and npm cache clean with pnpm equivalents (pnpm install --frozen-lockfile, pnpm run build, pnpm store prune). Enabled pnpm via corepack enable. In website/server/Dockerfile, restructured to use pnpm workspace workflow with targeted builds (pnpm --filter repomix-website-server run bundle). Updated compose services to mount workspace root (..:/workspace) instead of subdirectories, set appropriate working directories, and use pnpm commands in startup. Website/client Dockerfile simplified by removing deps stage.
Cloud Build Configuration
website/server/cloudbuild.yaml
Changed Docker build context argument from website/server to . (repository root) while retaining Dockerfile path website/server/Dockerfile.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: migrating from npm to pnpm with workspace support setup.
Description check ✅ Passed The PR description covers all required sections with clear details about package manager migration, workspace setup, CI changes, and Docker updates. Test and lint checklist items are completed.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/migrate-to-pnpm-workspace

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly refactors the project's dependency management system by transitioning from npm to pnpm and establishing a monorepo structure using pnpm workspaces. This change aims to improve build performance, reduce disk space usage, and streamline dependency resolution across all sub-packages. The migration also simplifies CI/CD pipelines and updates Docker configurations to align with the new package management approach, enhancing overall development efficiency and consistency.

Highlights

  • Package Manager Migration: The project has been migrated from npm to pnpm, including updates to lock files, .tool-versions, and Dockerfiles to reflect the new package manager.
  • pnpm Workspaces Setup: pnpm workspaces have been configured to centralize dependency management across browser, scripts/memory, website/client, and website/server sub-packages, replacing direct file or GitHub dependencies with workspace:*.
  • CI Workflow Simplification: CI workflows are simplified by using pnpm/action-setup and pnpm install --frozen-lockfile, removing npm link steps, and utilizing pnpm --filter for sub-package commands.
  • Docker Configuration Updates: Dockerfiles and Docker Compose configurations have been updated to support pnpm and workspaces, including corepack enable, building from the repository root context, and mounting the root for workspace resolution.
  • Browser Package Renaming: The browser package was renamed from repomix to repomix-browser to prevent potential name collisions within the workspace.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files
  • Ignored by pattern: .github/workflows/** (6)
    • .github/workflows/autofix.yml
    • .github/workflows/benchmark.yml
    • .github/workflows/ci.yml
    • .github/workflows/npm-publish.yml
    • .github/workflows/perf-benchmark.yml
    • .github/workflows/schema-update.yml
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 21, 2026

⚡ Performance Benchmark

Latest commit:6b80f57
Status:✅ Benchmark complete!
Ubuntu:2.35s (±0.02s) → 2.38s (±0.04s) · +0.03s (+1.4%)
macOS:1.50s (±0.15s) → 1.52s (±0.18s) · +0.02s (+1.5%)
Windows:3.65s (±0.16s) → 3.75s (±0.09s) · +0.10s (+2.9%)
Details
  • Packing the repomix repository with node bin/repomix.cjs
  • Warmup: 2 runs (discarded)
  • Measurement: 10 runs / 20 on macOS (median ± IQR)
  • Workflow run

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request successfully migrates the project from npm to pnpm, introducing pnpm workspaces for better monorepo management. The changes are comprehensive, updating package scripts, CI workflows, and Docker configurations to align with the new setup. The use of corepack, pnpm --filter, and the workspace:* protocol are all correctly implemented. The Dockerfiles have been thoughtfully updated to support workspace-aware builds, especially the multi-stage build for the server.

I have one suggestion regarding the Docker Compose configuration for development to improve clarity and maintainability. Otherwise, this is a great improvement for the project's dependency management and build process.

Comment on lines 20 to 21
context: ./client
dockerfile: Dockerfile
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Configuring the server service to use the client's build context and Dockerfile is confusing and could lead to maintenance issues. It makes it seem like the server's build is dependent on the client's files. Since both services use the same generic base image for development, a clearer approach would be to use a dedicated, neutrally-located Dockerfile. For example, moving website/client/Dockerfile to website/Dockerfile.dev and updating both client and server services to use it would make the configuration more intuitive and decoupled.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (2)
website/server/cloudbuild.yaml (1)

15-15: Root .dockerignore is comprehensive but could be more explicit about excluding workspace Dockerfiles.

The root .dockerignore exists and covers most cases (node_modules, .git, .env.*, *.md, .vscode, coverage, dist, build). However, when building with context ., it doesn't explicitly exclude Dockerfile and cloudbuild.yaml files from workspace subdirectories (e.g., website/server/Dockerfile, website/server/cloudbuild.yaml, website/client/Dockerfile). Adding these to the root .dockerignore would reduce build context bloat without affecting functionality:

Dockerfile
cloudbuild.yaml
cloudbuild.yml
.dockerignore

This prevents unnecessary inclusion of non-runtime container build artifacts in the uploaded context.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@website/server/cloudbuild.yaml` at line 15, Update the root .dockerignore to
explicitly exclude workspace Dockerfiles and Cloud Build manifests to shrink
build context: add entries for Dockerfile, cloudbuild.yaml, cloudbuild.yml and
.dockerignore (so files like website/server/Dockerfile,
website/server/cloudbuild.yaml, website/client/Dockerfile are ignored when
building with context '.'); modify the root .dockerignore file to include those
patterns alongside the existing ignores.
.github/workflows/npm-publish.yml (1)

28-33: Add pnpm cache configuration to setup-node.

Other workflows in this PR (autofix.yml, benchmark.yml) include cache: pnpm in the actions/setup-node step, but this workflow is missing it. This omission may cause slower CI runs due to repeated dependency downloads.

♻️ Proposed fix to add cache configuration
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: .tool-versions
           registry-url: 'https://registry.npmjs.org'
+          cache: pnpm
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/npm-publish.yml around lines 28 - 33, The setup-node step
using actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f is missing
pnpm caching; update that step (the block with node-version-file: .tool-versions
and registry-url: 'https://registry.npmjs.org') to include cache: pnpm so
dependencies are cached between runs and CI is faster.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/npm-publish.yml:
- Line 60: The workflow uses the pnpm publish command with the --no-git-checks
flag which bypasses pnpm's safety check; either remove --no-git-checks from the
run: pnpm publish --provenance --access public --dry-run to restore git
cleanliness verification, or if intentional, add an inline comment in the
workflow explaining why --no-git-checks is required and ensure the same
change/comment is applied to the other occurrence (the run line at the second
occurrence noted in the review).

In `@package.json`:
- Line 22: The prepack script currently uses "prepack" with "node --run build"
which requires Node 22+, but the package.json "engines.node" allows Node 20;
update one of them so the declared engine range matches the script: either
change the "prepack" script to a Node-20-compatible command (for example invoke
the build via "npm run build" or another shell-safe build invocation) or raise
"engines.node" to >=22.0.0; touch the "prepack" entry and/or the "engines.node"
value in package.json (referencing the prepack script name "prepack" and the
engines field "engines.node") so they are consistent.

In `@website/compose.yml`:
- Around line 18-21: The server service in the compose file is using the wrong
build context; update the server build block so context points to the repository
root (e.g., context: ..) and the dockerfile points to the server Dockerfile
(dockerfile: website/server/Dockerfile) to match how compose.bundle.yml
configures the server; modify the server build configuration (service name:
server, keys: context and dockerfile) accordingly so the files copied in
website/server/Dockerfile (pnpm-lock.yaml, pnpm-workspace.yaml, .npmrc) are
available during docker build.

---

Nitpick comments:
In @.github/workflows/npm-publish.yml:
- Around line 28-33: The setup-node step using
actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f is missing pnpm
caching; update that step (the block with node-version-file: .tool-versions and
registry-url: 'https://registry.npmjs.org') to include cache: pnpm so
dependencies are cached between runs and CI is faster.

In `@website/server/cloudbuild.yaml`:
- Line 15: Update the root .dockerignore to explicitly exclude workspace
Dockerfiles and Cloud Build manifests to shrink build context: add entries for
Dockerfile, cloudbuild.yaml, cloudbuild.yml and .dockerignore (so files like
website/server/Dockerfile, website/server/cloudbuild.yaml,
website/client/Dockerfile are ignored when building with context '.'); modify
the root .dockerignore file to include those patterns alongside the existing
ignores.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4a9cd5c7-c39f-4eed-9145-f3496b2a062a

📥 Commits

Reviewing files that changed from the base of the PR and between 4798698 and ab0e501.

⛔ Files ignored due to path filters (6)
  • browser/package-lock.json is excluded by !**/package-lock.json
  • package-lock.json is excluded by !**/package-lock.json
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
  • scripts/memory/package-lock.json is excluded by !**/package-lock.json
  • website/client/package-lock.json is excluded by !**/package-lock.json
  • website/server/package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (20)
  • .github/workflows/autofix.yml
  • .github/workflows/benchmark.yml
  • .github/workflows/ci.yml
  • .github/workflows/npm-publish.yml
  • .github/workflows/perf-benchmark.yml
  • .github/workflows/schema-update.yml
  • .gitignore
  • .tool-versions
  • Dockerfile
  • browser/package.json
  • package.json
  • pnpm-workspace.yaml
  • scripts/memory/package.json
  • website/client/Dockerfile
  • website/client/package.json
  • website/compose.bundle.yml
  • website/compose.yml
  • website/server/Dockerfile
  • website/server/cloudbuild.yaml
  • website/server/package.json

- name: Publish (dry-run)
if: ${{ inputs.dry-run }}
run: npm publish --provenance --access public --dry-run
run: pnpm publish --provenance --access public --dry-run --no-git-checks
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

Does pnpm publish support --provenance flag for npm registry?

💡 Result:

Yes, pnpm publish supports the --provenance flag for the npm registry. pnpm passes unknown flags, including --provenance, through to the underlying npm CLI during publishing. This feature was explicitly added via a merged pull request in 2023 (PR #6436), and users have reported successful usage, such as in GitHub Actions workflows and issue resolutions where it works after ensuring a compatible npm version. Official pnpm documentation does not list --provenance as it focuses on pnpm-specific options, but npm docs confirm --provenance generates provenance statements when publishing from supported CI/CD environments like GitHub Actions ubuntu-latest runners. Alternatives like NPM_CONFIG_PROVENANCE=true or "publishConfig": {"provenance": true} in package.json also enable it without the flag.

Citations:


Ensure --no-git-checks is intentional.

The --no-git-checks flag disables pnpm's verification that the working directory is clean and HEAD matches a git tag. Confirm this is deliberate given it removes a safety check.

Also applies to: 64-64

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/npm-publish.yml at line 60, The workflow uses the pnpm
publish command with the --no-git-checks flag which bypasses pnpm's safety
check; either remove --no-git-checks from the run: pnpm publish --provenance
--access public --dry-run to restore git cleanliness verification, or if
intentional, add an inline comment in the workflow explaining why
--no-git-checks is required and ensure the same change/comment is applied to the
other occurrence (the run line at the second occurrence noted in the review).

package.json Outdated
"bin": "./bin/repomix.cjs",
"scripts": {
"prepack": "npm run build",
"prepack": "node --run build",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

What Node.js version first introduced support for the node --run <script> CLI option?

💡 Result:

Node.js version 22.0.0 first introduced support for the node --run <script> CLI option as an experimental feature. The implementing pull request #52190 was merged on 2024-04-08, before the v22.0.0 release on 2024-04-24. It remained experimental until marked stable in pull request #53763, merged on 2024-09-21.

Citations:


🏁 Script executed:

cat -n package.json | sed -n '20,26p'

Repository: yamadashy/repomix

Length of output: 436


🏁 Script executed:

cat -n package.json | sed -n '122,126p'

Repository: yamadashy/repomix

Length of output: 197


prepack script requires Node 22+, but engines declares Node 20+.

Line 22 uses node --run build, which requires Node 22.0.0 or later. However, Line 124 permits Node 20.0.0. This breaks prepack for Node 20 users in the declared support range.

Proposed fix
-    "prepack": "node --run build",
+    "prepack": "pnpm run build",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 22, The prepack script currently uses "prepack" with
"node --run build" which requires Node 22+, but the package.json "engines.node"
allows Node 20; update one of them so the declared engine range matches the
script: either change the "prepack" script to a Node-20-compatible command (for
example invoke the build via "npm run build" or another shell-safe build
invocation) or raise "engines.node" to >=22.0.0; touch the "prepack" entry
and/or the "engines.node" value in package.json (referencing the prepack script
name "prepack" and the engines field "engines.node") so they are consistent.

Comment on lines 18 to 21
server:
build:
context: ./server
context: ./client
dockerfile: Dockerfile
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Incorrect build context will cause Docker build failure.

The server service has context: ./client but the Dockerfile at website/server/Dockerfile expects the repository root as context. The Dockerfile copies pnpm-lock.yaml, pnpm-workspace.yaml, and .npmrc from the root level (see website/server/Dockerfile lines 14-15), which don't exist in ./client.

Compare with website/compose.bundle.yml lines 22-25, which correctly uses context: .. and dockerfile: website/server/Dockerfile.

🐛 Proposed fix
   server:
     build:
-      context: ./client
-      dockerfile: Dockerfile
+      context: ..
+      dockerfile: website/server/Dockerfile
     ports:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
server:
build:
context: ./server
context: ./client
dockerfile: Dockerfile
server:
build:
context: ..
dockerfile: website/server/Dockerfile
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@website/compose.yml` around lines 18 - 21, The server service in the compose
file is using the wrong build context; update the server build block so context
points to the repository root (e.g., context: ..) and the dockerfile points to
the server Dockerfile (dockerfile: website/server/Dockerfile) to match how
compose.bundle.yml configures the server; modify the server build configuration
(service name: server, keys: context and dockerfile) accordingly so the files
copied in website/server/Dockerfile (pnpm-lock.yaml, pnpm-workspace.yaml,
.npmrc) are available during docker build.

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Mar 21, 2026

PR review posted below

devin-ai-integration[bot]

This comment was marked as resolved.

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Mar 21, 2026

Please see below for full review

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Mar 21, 2026

PR Review: chore(deps): Migrate from npm to pnpm with workspace support

Overall well-structured migration. Issues found:

Bug: website/compose.yml - Server build context is ./client (copy-paste error). Should be .. with dockerfile: website/server/Dockerfile like compose.bundle.yml. Will cause Docker build failures.

node_modules in server Dockerfile - pnpm symlinks node_modules to .pnpm/ store. COPY of /app/node_modules/tinypool and tiktoken may not work. Verify in test build.

npm audit signatures - npm-publish.yml still uses npm audit signatures. npm wont find package-lock.json. Replace with pnpm audit or remove.

Heavy dev command - compose.yml server rebuilds entire monorepo on every start. Consider pre-building.

Minor: --no-git-checks on publish is fine for CI but worth documenting. Browser CI uses working-directory instead of pnpm --filter (inconsistent). Perf-benchmark npm fallback is good transitional measure.

Good: Pinned pnpm/action-setup SHA, corepack via packageManager field, workspace:* protocol, repomix-browser rename, Dockerfile layer caching, consistent corepack enable.

Generated with Claude Code

Replace npm's .npmrc min-release-age=7 (days) with pnpm's native
minimumReleaseAge: 10080 (minutes = 7 days) in pnpm-workspace.yaml.
The npm setting was silently ignored by pnpm.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages bot commented Mar 21, 2026

Deploying repomix with  Cloudflare Pages  Cloudflare Pages

Latest commit: 64320e7
Status: ✅  Deploy successful!
Preview URL: https://ea1e7e0f.repomix.pages.dev
Branch Preview URL: https://chore-migrate-to-pnpm-worksp.repomix.pages.dev

View logs

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 21, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.18%. Comparing base (4798698) to head (6b80f57).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1275   +/-   ##
=======================================
  Coverage   87.18%   87.18%           
=======================================
  Files         115      115           
  Lines        4324     4324           
  Branches     1002     1002           
=======================================
  Hits         3770     3770           
  Misses        554      554           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Mar 21, 2026

PR Review (Follow-up): chore(deps): Migrate from npm to pnpm with workspace support

Previous review identified several issues. Here's an updated assessment after the two fix commits:

Still Unresolved

Bug: website/compose.yml server build context (Critical)
The server service still has context: ./client which is incorrect. It should be context: .. with dockerfile: website/server/Dockerfile (matching compose.bundle.yml). The current value will cause Docker build failures since the server Dockerfile expects workspace root files (pnpm-lock.yaml, pnpm-workspace.yaml, src/, etc.) in its build context.

npm audit signatures in npm-publish.yml
Still uses bare npm audit signatures (line 61). With no package-lock.json, this will fail. Either replace with pnpm audit or remove the step.

node --run build in prepack requires Node 22+
The prepack script was changed from npm run build to node --run build, but engines.node allows >=20.0.0. node --run was introduced in Node 22. This will break for Node 20 users running npm pack or npm install from source.

Addressed by fix commits

The minimumReleaseAge in pnpm-workspace.yaml correctly replaces the deleted .npmrc min-release-age=7 (converted to 10080 minutes = 7 days).

Additional observations

Details
  • Missing cache: pnpm in npm-publish.yml setup-node step (all other workflows have it). Minor perf impact on CI.
  • pnpm symlinks vs COPY in server Dockerfile: The COPY --from=builder /app/node_modules/tinypool and tiktoken lines copy from the pnpm store structure. pnpm uses a content-addressable store with symlinks. Worth verifying these COPY commands work correctly in a test Docker build — if pnpm uses symlinks, COPY may copy empty symlinks instead of actual files. Consider using pnpm deploy for production isolation.
  • Browser CI inconsistency: Browser extension steps use working-directory: browser + pnpm run while other sub-packages use pnpm --filter. Not a bug but inconsistent.

Overall the migration is thorough and well-structured. The three items above (compose.yml context, npm audit, node --run compat) should be fixed before merge.

Generated with Claude Code

devin-ai-integration[bot]

This comment was marked as resolved.

Root Dockerfile:
- Use selective COPY instead of COPY . . to leverage Docker layer caching
- Use pnpm install --filter repomix to skip workspace packages' deps
- Use npm link instead of pnpm link --global (npm's global bin is in PATH)

Cloud Build:
- Add root .gcloudignore to reduce upload size when building server
  from repo root context (excludes node_modules, tests, .git, etc.)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@claude
Copy link
Copy Markdown
Contributor

claude bot commented Mar 21, 2026

PR Review: chore(deps): Migrate from npm to pnpm with workspace support

Overall this is a well-executed migration. The workspace setup is clean, CI simplification is a clear win, and Docker layer caching improvements in the root Dockerfile are solid. A few issues to flag:

Bug: website/compose.yml server build context points to client

The server service build context was changed to ./client:

server:
  build:
    context: ./client
    dockerfile: Dockerfile

This means the server will build using website/client/Dockerfile (VitePress). It happens to work for local dev because the command and volumes override everything, but it's semantically wrong and confusing. If the client Dockerfile changes, it could break the server. Consider using context: .. with dockerfile: website/server/Dockerfile to match compose.bundle.yml, or at minimum adding a comment explaining this reuse.

Potential issue: npm audit signatures in publish workflow

npm-publish.yml still has:

- name: Verify npm audit signatures
  run: npm audit signatures

After migration, npm may not be configured/reliable here. Verify this step still works, or consider removing it if pnpm handles integrity checking differently (pnpm verifies package integrity via its content-addressable store).

Docker: COPY --from=builder paths for symlinked deps

In website/server/Dockerfile, these lines copy external dependencies:

COPY --from=builder /app/node_modules/tinypool ./node_modules/tinypool
COPY --from=builder /app/node_modules/tiktoken ./node_modules/tiktoken

With pnpm's node_modules structure, node_modules/tinypool is a symlink to .pnpm/tinypool@.... Docker COPY follows symlinks, so this should work, but it's fragile — if pnpm's hoisting strategy changes or these packages have nested deps, the copy may be incomplete. Worth a manual Docker build test to confirm the bundled server starts correctly.

Nitpick: minimumReleaseAge scope

pnpm-workspace.yaml sets minimumReleaseAge: 10080 which is great for supply chain security. Note that this is a pnpm v10+ feature — just confirm the CI environments all use pnpm 10.32.1 via corepack (which they should, given packageManager in package.json).

Additional observations (non-blocking)
  • prepack script change to node --run build: This bypasses the package manager entirely, which is fine for pnpm publish but note that node --run requires Node 22+. The engines field specifies >=20.0.0, so this could fail on Node 20. Consider using pnpm run build instead, or bumping the engine requirement.
  • pnpm prune --prod in CI build-and-run job: This replaces npm ci --omit=dev. Verify that pnpm prune --prod correctly removes devDependencies in a workspace root context without affecting workspace packages.
  • --no-git-checks on publish: This is standard for CI pnpm publishing (pnpm checks for clean git state by default), so this is correct.
  • perf-benchmark npm fallback: Smart to include the if [ -f pnpm-lock.yaml ] check for the transition period when comparing PR branch vs main branch.

Premortem / Deployment Risks

  1. npm publish provenance: Verify pnpm publish --provenance works the same way as npm's provenance. pnpm added provenance support in v8.x but behavior might differ.
  2. Corepack availability: All Dockerfiles rely on corepack enable. Node 24 ships corepack, but if the project ever needs to support older Node images, this would break.
  3. Workspace resolution at publish time: workspace:* references get rewritten to actual versions by pnpm during pnpm publish. Make sure pnpm publish is only run from the root package context and not accidentally from a workspace package.

🤖 Generated with Claude Code

Own packages (@repomix/strip-comments, @repomix/tree-sitter-wasms)
are trusted and should be installable immediately after publish.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
devin-ai-integration[bot]

This comment was marked as resolved.

- Fix compose.yml server build context: ./client → .. (correct repo root)
- Fix WASM path resolution in bundle.mjs: use import.meta.resolve()
  instead of hardcoded node_modules paths (pnpm symlink compatible)
- Fix bundle.mjs buildTypeScript(): npm run build → pnpm run build
- Remove npm audit signatures step (requires package-lock.json)
- Fix prepack: node --run build → pnpm run build (Node 20 compat)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
devin-ai-integration[bot]

This comment was marked as resolved.

tsconfig.build.json extends tsconfig.json, so both files are needed
for the TypeScript build step. The selective COPY approach missed this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 new potential issue.

View 12 additional findings in Devin Review.

Open in Devin Review

context: ./server
dockerfile: Dockerfile
context: ..
dockerfile: website/client/Dockerfile
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Development compose server service incorrectly builds from client Dockerfile

In website/compose.yml, the server service uses dockerfile: website/client/Dockerfile (line 21). Previously, it used the server's own Dockerfile (context: ./server, dockerfile: Dockerfile). Now the server development container is built from the client's Dockerfile, which exposes port 5173 and has a default CMD of pnpm run docs:dev — both client-specific. While this currently works because docker compose overrides the command and working_dir, it's fragile: any future client-specific changes to website/client/Dockerfile (e.g., adding Vue.js tooling or client dependencies) will unintentionally break the server's dev environment. Note that website/compose.bundle.yml:24-25 correctly uses dockerfile: website/server/Dockerfile for the bundled server.

Prompt for agents
In website/compose.yml line 21, the server service uses `dockerfile: website/client/Dockerfile` which is semantically wrong. The server should not depend on the client's Dockerfile. Two options to fix:

1. Create a shared lightweight development Dockerfile (e.g., `website/Dockerfile.dev`) with just `FROM node:24-alpine`, `RUN apk add --no-cache git && corepack enable`, and `WORKDIR /app`. Use this for both client and server in compose.yml.

2. Add a `development` target stage to `website/server/Dockerfile` (similar to what the client Dockerfile has), then use `dockerfile: website/server/Dockerfile` with `target: development` in the compose.yml server service build config.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

yamadashy and others added 2 commits March 21, 2026 18:20
Remove pnpm minimumReleaseAge as it conflicts with Renovate's
rangeStrategy: bump — Renovate checks the bumped-to version (e.g.
2.4.7) but pnpm resolves the ^ range to a newer patch (e.g. 2.4.8)
that may not meet the age constraint. Renovate already enforces
minimumReleaseAge: 7 days at the PR creation level.

Add ace-builds as explicit dependency of website/client — previously
accessed as phantom dependency via vue3-ace-editor under npm's flat
node_modules, but pnpm's isolated layout requires explicit declaration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…mport

Add minimumReleaseAge: 10080 (7 days) to pnpm-workspace.yaml to prevent
installing package versions released less than 7 days ago. This
complements Renovate's minimumReleaseAge by catching newer patches
resolved via ^ ranges.

Regenerate pnpm-lock.yaml using `pnpm import` from the original
package-lock.json to preserve locked versions. The --frozen-lockfile
flag in CI bypasses the age check for already-locked versions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@yamadashy
Copy link
Copy Markdown
Owner Author

pnpm移行のメリットが現状の運用(Renovate による依存管理、独立したサブパッケージ構成)に対して薄いと判断し、クローズします。

@yamadashy yamadashy closed this Mar 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant