[ACS-12322] Migrate to pnpm

.github/actions/adf-linking/action.yml

@@ -20,7 +20,6 @@ runs:
           CWD=`pwd`
           cd ../alfresco-ng2-components
           if [ -f "pnpm-lock.yaml" ]; then
-            corepack enable pnpm
             pnpm add @angular/material
           else
             npm install @angular/material

.github/actions/before-e2e/action.yml

@@ -6,4 +6,4 @@ runs:
   steps:
     - name: Check content UP
       shell: bash
-      run: npm run ci:check-env || exit 1
+      run: pnpm run ci:check-env || exit 1

.github/actions/publish-image/action.yml

@@ -37,8 +37,8 @@ runs:
     - name: Install dependencies and build project
       shell: bash
       run: |
-        npm ci
+        pnpm install --frozen-lockfile
-        npm run build.release
+        pnpm run build.release
 
     - name: Build and push multi-platform image
       uses: docker/build-push-action@v7

.github/actions/publish-libs/action.yml

@@ -27,8 +27,8 @@ runs:
     - name: Build Libraries
       shell: bash
       run: |
-        npm ci
+        pnpm install --frozen-lockfile
-        npm run ci:build:many
+        pnpm run ci:build:many
 
     - uses: actions/setup-node@v7
       name: setup GH registry

.github/actions/run-e2e-playwright/action.yml

@@ -41,7 +41,7 @@ runs:
       run: |
         # Only start local server if using localhost
         if [[ "${PLAYWRIGHT_E2E_HOST}" == "http://localhost"* ]]; then
-          npm start > /dev/null &
+          pnpm start > /dev/null &
         fi
 
         printf "Waiting for the application to be ready..."
@@ -53,7 +53,7 @@ runs:
 
         for attempt in $(seq 1 "${SUITE_ATTEMPTS:-1}"); do
           echo "Running playwright tests with options $OPTIONS on browser ${PLAYWRIGHT_BROWSER} (suite attempt $attempt/${SUITE_ATTEMPTS:-1})"
-          if E2E_TARGET=$OPTIONS npm run ci:e2e; then
+          if E2E_TARGET=$OPTIONS pnpm run ci:e2e; then
             exit 0
           fi
           if [ "$attempt" -lt "${SUITE_ATTEMPTS:-1}" ]; then

.github/actions/setup/action.yml

@@ -50,8 +50,10 @@ runs:
         fi
         echo "TAG_NPM=${TAG_NPM}" >> $GITHUB_ENV
 
+    - name: Setup pnpm
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
     - name: node
       uses: actions/setup-node@v6
       with:
         node-version-file: '.nvmrc'
-        cache: 'npm'
+        cache: 'pnpm'

.github/workflows/pull-request.yml

@@ -34,7 +34,7 @@ jobs:
 
       - uses: ./.github/actions/setup
 
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
 
       - name: upload npm logs
         uses: actions/upload-artifact@v7
@@ -45,11 +45,11 @@ jobs:
 
       - name: lint affected
         if: ${{ github.event_name == 'pull_request' }}
-        run: npm run affected:lint -- --base=origin/develop
+        run: pnpm run affected:lint -- --base=origin/develop
       - name: lint all
         if: ${{ github.event_name != 'pull_request' }}
-        run: npm run ci:lint
+        run: pnpm run ci:lint
-      - run: npm run stylelint
+      - run: pnpm run stylelint
 
   detect-e2e-only-changes:
     name: 'Validate / Detect E2E Only Changes'
@@ -89,15 +89,15 @@ jobs:
           fetch-depth: 2
 
       - uses: ./.github/actions/before-install
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
       - name: upload npm logs
         uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: npm-logs
           path: /home/runner/.npm/_logs/
-      - run: npm run ci:build -- aca-playwright-shared
+      - run: pnpm run ci:build -- aca-playwright-shared
-      - run: npm run build -- $BUILD_OPTS
+      - run: pnpm run build -- $BUILD_OPTS
 
       - name: dist cache
         if: ${{ success() }}
@@ -117,7 +117,7 @@ jobs:
         with:
           fetch-depth: 0
       - uses: ./.github/actions/before-install
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
       - name: upload npm logs
         uses: actions/upload-artifact@v7
         if: failure()
@@ -127,11 +127,11 @@ jobs:
 
       - name: Test
         if: ${{ github.event_name == 'pull_request' }}
-        run: npm run affected:test -- --browsers=ChromeHeadless --watch=false $TEST_OPTS --base=origin/develop
+        run: pnpm run affected:test -- --browsers=ChromeHeadless --watch=false $TEST_OPTS --base=origin/develop
 
       - name: Test all
         if: ${{ github.event_name != 'pull_request' }}
-        run: npm run ci:test -- $TEST_OPTS
+        run: pnpm run ci:test -- $TEST_OPTS
 
   e2es-playwright:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'ci:skip-e2e') }}
@@ -219,7 +219,7 @@ jobs:
         uses: ./.github/actions/before-install
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Restore dist cache
         uses: actions/cache/restore@v6
@@ -233,12 +233,12 @@ jobs:
 
       - name: Check Search Indexing
         continue-on-error: true
-        run: npm run ci:check-search-indexing
+        run: pnpm run ci:check-search-indexing
         env:
           ADMIN_PASSWORD_SCRIPT: ${{ env.ADMIN_PASSWORD }}
 
       - name: Before playwright
-        run: npm run ci:playwright:install
+        run: pnpm run ci:playwright:install
 
       - name: Run e2e playwright
         uses: ./.github/actions/run-e2e-playwright

.github/workflows/release.yml

@@ -61,9 +61,9 @@ jobs:
           fetch-depth: 0
 
       - uses: ./.github/actions/setup
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
-      - run: npm run affected:lint -- --base=origin/develop
+      - run: pnpm run affected:lint -- --base=origin/develop
-      - run: npm run stylelint
+      - run: pnpm run stylelint
 
   unit-tests:
     if: github.event_name == 'workflow_dispatch'
@@ -83,8 +83,8 @@ jobs:
           fetch-depth: 0
 
       - uses: ./.github/actions/before-install
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
-      - run: npm run affected:test -- --browsers=ChromeHeadless --watch=false $TEST_OPTS --base=origin/develop
+      - run: pnpm run affected:test -- --browsers=ChromeHeadless --watch=false $TEST_OPTS --base=origin/develop
 
   publish-docker-registry:
     if: ${{ always() }}

.github/workflows/run-e2e-with-env.yml

@@ -38,15 +38,17 @@ jobs:
         with:
           fetch-depth: 2
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
       - name: node
         uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          cache: 'npm'
+          cache: 'pnpm'
       - uses: ./.github/actions/before-install
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
-      - run: npm run ci:build -- aca-playwright-shared
+      - run: pnpm run ci:build -- aca-playwright-shared
-      - run: npm run build -- $BUILD_OPTS
+      - run: pnpm run build -- $BUILD_OPTS
 
       - name: dist cache
         if: ${{ success() }}
@@ -117,10 +119,10 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          cache: 'npm'
+          cache: 'pnpm'
 
       - uses: ./.github/actions/before-install
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
 
       - uses: actions/cache/restore@v6
         id: cache
@@ -132,7 +134,7 @@ jobs:
         uses: ./.github/actions/before-e2e
 
       - name: Before playwright
-        run: npm run ci:playwright:install
+        run: pnpm run ci:playwright:install
 
       - uses: ./.github/actions/run-e2e-playwright
         with:

.github/workflows/supply-chain-pr-instructions.yml

@@ -0,0 +1,29 @@
+name: Supply Chain Review - PR Instructions
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+    paths:
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "**/package.json"
+
+jobs:
+  instructions:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: Alfresco/alfresco-build-tools/.github/actions/github-upsert-comment@44f603af32dc79129056a9e4246ab62f35987a2b # v18.21.1
+        with:
+          comment-identifier: supply-chain-review-instructions
+          comment-body: |
+            ## 🔒 Supply Chain Security
+
+            This PR modifies dependencies. To run a security analysis, comment:
+
+            ```
+            /supply-chain-review
+            ```
+
+            The analysis will check for vulnerabilities, typosquatting, maintainer takeovers, and other supply chain risks.

.github/workflows/upstream-adf.yml

@@ -120,11 +120,11 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 1
-      - name: setup NPM
+      - name: setup PNPM
         uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          cache: 'npm'
+          cache: 'pnpm'
       - name: Migration
         shell: bash
         env:
@@ -182,4 +182,4 @@ jobs:
           body: Automatic PR
           add-paths: |
             package.json
-            package-lock.json
+            pnpm-lock.yaml

.npmrc

@@ -0,0 +1,5 @@
+# Fail on high severity vulnerabilities during audit
+audit-level=high
+
+# Use exact versions to prevent unexpected updates
+save-exact=true

app/project.json

@@ -12,7 +12,7 @@
         "main": "app/src/main.ts",
         "tsConfig": "app/tsconfig.app.json",
         "polyfills": "app/src/polyfills.ts",
-        "preserveSymlinks": true,
+        "preserveSymlinks": false,
         "allowedCommonJsDependencies": ["minimatch", "cropperjs"],
         "stylePreprocessorOptions": {
           "includePaths": ["projects/aca-content/src/lib/ui", "node_modules", "node_modules/@alfresco/adf-core/lib"]

package.json

@@ -3,14 +3,15 @@
   "version": "8.1.0",
   "license": "LGPL-3.0",
   "scripts": {
+    "preinstall": "npx only-allow pnpm",
     "start": "nx serve content-ce",
     "start:prod": "node --max-old-space-size=8192 nx serve content-ce --configuration production",
     "build": "nx build content-ce",
-    "build.release": "npm run build -- --configuration=production,release",
+    "build.release": "pnpm build -- --configuration=production,release",
     "test": "nx test",
     "lint": "NODE_OPTIONS=--max_old_space_size=4096 nx run-many --all --target=lint",
     "inspect.bundle": "nx build content-ce --configuration production --stats-json && webpack-bundle-analyzer dist/content-ce/stats.json",
-    "prepare": "husky install",
+    "prepare": "husky && pnpm audit --audit-level=critical",
     "stylelint": "stylelint \"{app,projects}/**/*.scss\"",
     "affected:build": "nx affected:build",
     "affected:test": "nx affected:test",
@@ -58,6 +59,7 @@
     "@angular/platform-browser": "20.3.25",
     "@angular/platform-browser-dynamic": "20.3.25",
     "@angular/router": "20.3.25",
+    "@babel/runtime": "7.28.3",
     "@fontsource/open-sans": "^5.1.0",
     "@mat-datetimepicker/core": "16.0.1",
     "@ngrx/effects": "~20.1.0",
@@ -66,8 +68,12 @@
     "@ngrx/store": "~20.1.0",
     "@ngrx/store-devtools": "~20.1.0",
     "@ngx-translate/core": "^17.0.0",
+    "angular-oauth2-oidc": "19.0.0",
+    "cropperjs": "1.6.2",
     "date-fns": "^4.1.0",
+    "eventemitter3": "5.0.4",
     "material-icons": "^1.13.12",
+    "minimatch": "10.2.6",
     "pdfjs-dist": "5.1.91",
     "rxjs": "7.8.2",
     "tslib": "2.8.1",
@@ -104,6 +110,7 @@
     "@typescript-eslint/eslint-plugin": "8.55.0",
     "@typescript-eslint/parser": "8.55.0",
     "@typescript-eslint/utils": "8.55.0",
+    "buffer": "5.7.1",
     "eslint": "^8.57.0",
     "eslint-plugin-ban": "^2.0.0",
     "eslint-plugin-import": "2.32.0",
@@ -133,5 +140,9 @@
     "ts-node": "^10.9.2",
     "typescript": "5.9.3",
     "webpack-bundle-analyzer": "^5.3.0"
-  }
+  },
+  "engines": {
+    "node": ">=24.13.1"
+  },
+  "packageManager": "pnpm@11.17.0+sha512.cca3cea332ad254bb84145f966d19f4879615210346fc92c79a047f23a0d7b3cca3c3792f0076ba1f1831d277efbcf0a9119b31a9a60eca7fb3d6231f331ef72"
 }

pnpm-workspace.yaml

@@ -0,0 +1,52 @@
+# Block packages published less than 3 days ago (4320 minutes)
+minimumReleaseAge: 4320
+minimumReleaseAgeStrict: true
+
+overrides:
+  # Security fixes
+  fast-uri: 3.1.4
+  "js-yaml@4.2.0": "4.3.0"
+  "brace-expansion@5.0.6": "5.0.8"
+  "brace-expansion@<1.1.17": "1.1.17"
+  svgo: 4.0.2
+  shell-quote: 1.9.0
+  adm-zip: 0.6.0
+  axios: 1.18.0
+  serialize-javascript: '>=7.0.5'
+  picomatch: '>=4.0.4'
+  tmp: '>=0.2.6'
+  ws: '>=8.20.1'
+  postcss: '>=8.5.25'
+
+allowBuilds:
+  '@parcel/watcher': true
+  esbuild: true
+  lmdb: true
+  msgpackr-extract: true
+  nx: true
+  unrs-resolver: true
+  sharp: true
+  node-sass: true
+  sass: true
+  pdfjs-dist: true
+  canvas: true
+  bcrypt: true
+  sqlite3: true
+  better-sqlite3: true
+  puppeteer: true
+  playwright: true
+  fsevents: true
+  husky: true
+  core-js: true
+  core-js-pure: true
+  '@esbuild/darwin-arm64': true
+  '@esbuild/darwin-x64': true
+  '@esbuild/linux-x64': true
+  '@esbuild/win32-x64': true
+  '@nx/nx-darwin-arm64': true
+  '@nx/nx-darwin-x64': true
+  '@nx/nx-linux-x64-gnu': true
+  '@nx/nx-linux-x64-musl': true
+  '@nx/nx-win32-x64-msvc': true
+  '@swc/core': true
+  less: true