Skip to content

SPIKE: replaced yarn with pnpm#756

Draft
troyciesco wants to merge 8 commits intomainfrom
pnpm-spike
Draft

SPIKE: replaced yarn with pnpm#756
troyciesco wants to merge 8 commits intomainfrom
pnpm-spike

Conversation

@troyciesco
Copy link
Copy Markdown
Contributor

TK

quick spike to see what it'd take to replace yarn with pnpm. it looks massive because it moves the gscan package and web app into their appropriate locations, but doesn't contain too many changes otherwise.

this will help significantly with decoupling the web app from gscan, meaning we don't have to ship unrelated packages with gscan. i think even if we move the web app out of here entirely later it's still worth doing if org-wide we're moving towards pnpm - though i think it's worth keeping the web app here so it's quick to iterate/verify when making changes to the package.

ref #730

The web app needs access to the versions list. Instead of reaching into
internal paths (lib/utils), expose it from the package entry point so
consumers can use require('gscan').versions.
Pure file moves, no content changes. Git will detect these as renames.

- lib/, bin/, test/, vitest.config.js, jsconfig.json -> packages/gscan/
- app/, k8s/, Dockerfile, nodemon.json, config.example.json, loggingrc.js -> apps/web/
- Delete .npmignore (files field in package.json handles this)
- pnpm-workspace.yaml defining packages/* and apps/*
- .npmrc with auto-install-peers
- Root package.json (private workspace root with shared devDeps)
- packages/gscan/package.json (published npm package, web-only deps removed)
- apps/web/package.json (private, depends on gscan via workspace:*)

The packageManager field in root package.json enables corepack to block
yarn/npm usage automatically.
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 30, 2026

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 34aa968a-5e86-46ed-8fe0-4e0bf2f1d884

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch pnpm-spike

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

- Web app imports: require('../lib') -> require('gscan')
- Sentry version: read from gscan/package.json
- eslint.config.js: update path globs for new locations
- Dockerfile: rewrite for pnpm workspace-aware multi-stage build
- nodemon.json: npm -> pnpm
- .dockerignore: update for monorepo paths
- .idea/justfile: update paths
- Add pnpm/action-setup@v4 (reads packageManager from package.json)
- Switch cache and install commands from yarn to pnpm
- Update test path in check-links workflow
- Point deploy workflow at apps/web/Dockerfile
- All yarn commands -> pnpm equivalents
- All file paths updated to packages/gscan/ and apps/web/ locations
- Add monorepo structure note to README
- Update logo image path in README
- Replace yarn.lock with pnpm-lock.yaml
- Update .gitignore: add .pnpm-store/, update upload paths
Align corepack prepare version (10.33.0) with the packageManager field
in package.json to avoid lockfile/resolve mismatches in container builds.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant