chore: migrate npm to pnpm across CI, Docker, and scripts by Anshumancanrock · Pull Request #555 · cameri/nostream

Anshumancanrock · 2026-04-21T01:14:34Z

Migrates the package manager from npm to pnpm to improve install times, enforce strict dependency resolution, and reduce disk space usage.

Changes

Replaced package-lock.json with pnpm-lock.yaml (using pnpm@10.33.0).
Updated GitHub Actions to use pnpm/action-setup and pnpm install --frozen-lockfile.
Updated Dockerfile and docker-compose configuration to use pnpm.
Fixed Husky pre-commit/pre-push hooks to use pnpm exec.
Updated command references in README.md, CONTRIBUTING.md, and CONFIGURATION.md.
Added patch changeset to satisfy CI dependency constraint.

Closes #434

npm vs pnpm benchmark (cold install, 3 runs each)

run	npm install	pnpm install --frozen-lockfile
1	78.64s	13.78s
2	47.86s	28.72s
3	66.91s	29.12s

Installation is ~2.5× faster

Testing

Install and script flows run with pnpm locally.
CI workflow steps are updated for pnpm.
Docker-related command paths are updated to pnpm.

socket-security · 2026-04-21T01:15:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	zod@3.25.76
	axios@1.15.0 ⏵ 1.15.1	^-1			⁺¹

View full report

coveralls · 2026-04-21T01:18:36Z

coverage: 74.946%. remained the same — Anshumancanrock:chore/pnpm-migration into cameri:main

Copilot

Pull request overview

Migrates the project’s tooling and documentation from npm to pnpm across local scripts, CI workflows, and Docker-based environments.

Changes:

Switch CI workflows to install/cache dependencies with pnpm and frozen lockfile installs.
Update Dockerfiles/docker-compose migration steps and Husky hooks to use pnpm/pnpm exec.
Refresh docs and script usage text to reference pnpm commands; add a changeset for CI requirements.

Reviewed changes

Copilot reviewed 27 out of 30 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`test/integration/docker-compose.yml`	Updates DB migration step to use `corepack` + `pnpm dlx` during integration tests.
`docker-compose.yml`	Updates DB migration step to use `corepack` + `pnpm dlx` in local compose setup.
`src/scripts/export-events.ts`	Updates CLI usage output from `npm run` to `pnpm run`.
`src/scripts/benchmark-queries.ts`	Updates docstring/usage output from `npm run` to `pnpm run`.
`src/import-events.ts`	Updates CLI usage output from `npm run` to `pnpm run`.
`src/clean-db.ts`	Updates help text examples from `npm run` to `pnpm run`.
`scripts/verify-index-impact.ts`	Updates usage doc comment to `pnpm run`.
`scripts/smoke-nip03.ts`	Updates usage doc comment to `pnpm exec`.
`scripts/smoke-nip03.md`	Updates instructions to `pnpm run` / `pnpm exec`.
`scripts/security-load-test.ts`	Updates usage doc comment to `pnpm exec` / `pnpm run`.
`package.json`	Adds `packageManager` pin and updates scripts to use `pnpm`.
`Dockerfile.test`	Switches dependency install to `pnpm` with frozen lockfile.
`Dockerfile.railwayapp`	Switches build/runtime installs and migration invocation to `pnpm`.
`Dockerfile`	Switches build/runtime installs and build step to `pnpm`.
`README.md`	Updates developer/user commands to `pnpm`.
`CONTRIBUTING.md`	Updates contributor commands to `pnpm` / `pnpm exec`.
`CONFIGURATION.md`	Updates benchmarking commands to `pnpm`.
`.husky/pre-commit`	Updates hook commands to `pnpm run`.
`.husky/commit-msg`	Updates hook to use `pnpm exec commitlint`.
`.gitignore`	Ignores `package-lock.json` and pnpm cache artifacts.
`.github/workflows/checks.yml`	Updates CI jobs to use `pnpm/action-setup`, pnpm cache, and frozen installs.
`.github/workflows/changesets.yml`	Updates release workflow to use pnpm install and pnpm-based changeset commands.
`.changeset/bright-clocks-jam.md`	Adds a patch changeset documenting the migration.
`src/routes/index.ts`	Adds explicit `Router` typing and import adjustments.
`src/routes/invoices/index.ts`	Adds explicit `Router` typing for router instance.
`src/routes/callbacks/index.ts`	Adds explicit `Router` typing for router instance.
`src/routes/admissions/index.ts`	Adds explicit `Router` typing for router instance.
`src/factories/web-app-factory.ts`	Adds explicit `Express` return type for `createWebApp`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-22T00:10:20Z

      - sh
      - -c
-      - 'cd code && npm install --no-save --quiet knex@2.4.0 pg@8.8.0 && npx knex migrate:latest'
+      - 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'


This migration container runs corepack enable && pnpm dlx ... in /code without a package.json, so Corepack can’t read the repo’s packageManager pin and may pick a different pnpm version over time. To keep CI/integration tests reproducible, explicitly prepare/activate the pnpm version you expect (e.g., corepack prepare pnpm@10.33.0 --activate) before invoking pnpm dlx.

Suggested change

- 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

- 'cd code && corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

Copilot · 2026-04-22T00:10:21Z

      - sh
      - -c
-      - 'cd code && npm install --no-save --quiet knex@2.4.0 pg@8.8.0 && npx knex migrate:latest'
+      - 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'


corepack enable && pnpm dlx ... is executed in /code, which doesn’t include this repo’s package.json (and therefore doesn’t provide the packageManager: pnpm@10.33.0 pin). That makes the pnpm version selected by Corepack non-deterministic and could break migrations if Corepack defaults change. Consider explicitly preparing/activating the intended pnpm version here (e.g., corepack prepare pnpm@10.33.0 --activate) before running pnpm dlx.

Suggested change

- 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

- 'cd code && corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

…oint

changeset-bot · 2026-04-23T02:36:31Z

🦋 Changeset detected

Latest commit: ae62fa7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Anshumancanrock · 2026-04-23T07:55:07Z

hii @cameri , could you please review this pr when you have time? Thanks !

cameri · 2026-04-23T10:11:47Z

+COPY --from=build /build/package.json /build/pnpm-lock.yaml ./

-RUN npm install --omit=dev --quiet
+RUN corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm install --prod --frozen-lockfile --silent


Can we make PNMP_VERSION an ARG and ENV var?

Done ! Added ARG PNPM_VERSION=10.33.0 at the top of all three Dockerfiles and replaced every hardcoded reference with$PNPM_VERSION

cameri · 2026-04-23T10:14:12Z


  ```
-  NODE_OPTIONS="-r dotenv/config" npm run db:migrate
+  NODE_OPTIONS="-r dotenv/config" pnpm run db:migrate


Let's check if this NODE_OPTIONS can be removed and use node owns env file loading mechanism.

…on containers, drop redundant 'run' keyword

…files

cameri · 2026-04-25T12:40:30Z


 ```
-npm run dev
+pnpm run dev


Shall we remove run from commands in this file as well?

cameri · 2026-04-25T12:41:35Z


 ```
-npm run knip
+pnpm run knip


Can we rename knip script in package json to check:dependencies or check:deps?

cameri · 2026-04-25T12:42:15Z

-npm run lint
-npm run format:check
+pnpm run lint
+pnpm run format:check


Can we rename format:check to check:format?

cameri · 2026-04-25T12:43:07Z

 COPY . .

-RUN npm run build
+RUN pnpm run build


Can we drop run here as well?

cameri · 2026-04-25T12:43:37Z

 COPY . .

-RUN npm run build
+RUN pnpm run build


Can we drop run?

cameri · 2026-04-25T12:43:53Z

 Basic import:
  ```
-  npm run import -- ./events.jsonl
+  pnpm run import ./events.jsonl


Can we drop run in this file?

Anshumancanrock added 3 commits April 20, 2026 22:36

chore: migrate npm tooling to pnpm

673c7f6

docs: update commands for pnpm migration

ee28793

chore: add changeset for pnpm migration

e9daf93

Anshumancanrock marked this pull request as draft April 21, 2026 01:22

cameri requested a review from Copilot April 22, 2026 00:06

cameri self-assigned this Apr 22, 2026

Copilot started reviewing on behalf of cameri April 22, 2026 00:06 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

Anshumancanrock added 5 commits April 23, 2026 08:05

fix(docker-compose): pin pnpm@10.33.0 in prod migration entrypoint

62c3b86

fix(docker-compose): pin pnpm@10.33.0 in integration migration entryp…

a641fc9

…oint

chore(docker): pin pnpm@10.33.0 via corepack prepare in Dockerfiles

e387a2c

chore(ci): drop redundant pnpm version pin in checks workflow

e39f3b1

chore(ci): drop redundant pnpm version pin in changesets workflow

04cb64c

Anshumancanrock force-pushed the chore/pnpm-migration branch from c8996be to 04cb64c Compare April 23, 2026 02:39

Anshumancanrock added 2 commits April 23, 2026 09:02

chore: merge upstream/main into chore/pnpm-migration

770eea2

chore(deps): regenerate pnpm-lock.yaml for @changesets/changelog-github

5ccfb8e

Anshumancanrock force-pushed the chore/pnpm-migration branch from 71db1c1 to 5ccfb8e Compare April 23, 2026 03:33

Anshumancanrock marked this pull request as ready for review April 23, 2026 07:54

Anshumancanrock force-pushed the chore/pnpm-migration branch from f0be329 to 5ccfb8e Compare April 23, 2026 07:55

cameri reviewed Apr 23, 2026

View reviewed changes

fix: drop obsolete dotenv NODE_OPTIONS, use npm for ephemeral migrati…

82b564a

…on containers, drop redundant 'run' keyword

Anshumancanrock marked this pull request as draft April 23, 2026 16:56

refactor(docker): extract PNPM_VERSION as build ARG across all Docker…

188c9e4

…files

Anshumancanrock marked this pull request as ready for review April 23, 2026 17:31

Merge branch 'main' into chore/pnpm-migration

ae62fa7

cameri reviewed Apr 25, 2026

View reviewed changes

	- 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'
	- 'cd code && corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

Conversation

Anshumancanrock commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

npm vs pnpm benchmark (cold install, 3 runs each)

Testing

Uh oh!

socket-security Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

changeset-bot Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Anshumancanrock commented Apr 23, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Anshumancanrock commented Apr 21, 2026 •

edited

Loading

socket-security Bot commented Apr 21, 2026 •

edited

Loading

coveralls commented Apr 21, 2026 •

edited

Loading

changeset-bot Bot commented Apr 23, 2026 •

edited

Loading