[AAE-46514] - Migration to PNPM (#11926)

* [AAE-46514] - using by default ignore-scripts and have a trusted list for those who are trusted

* [AAE-46514] - Improved the checks to cover more cases

* [AAE-46514] - Fixed copilot comments

* [AAE-46514] - OTher fixes

* [AAE-46514] - Fixing other improvements and comments

* [AAE-46514] - npmrc should be versioned to enforce the audit

* [AAE-46514] - Improved code

* [AAE-46514] - Removed the check on CI as we have other tools

* [AAE-46514] - Improved check, updated descriptions, skip check on CI as there is already Sonar

* [AAE-46514] - Reduced functions in smaller pieces

* [AAE-46514] - Migrating to Pnpm to increase safety

* [ci:force] - Checking

* [ci:force] - Fixed complexity of the scripts

* [ci:force] - Fixed complexity of the scripts

* [ci:force] - Fixed wrong typing on yml

* [ci:force] - Fixed sonar comments and added correct version to sha pinned action

* [ci:force] - Fixed cache hit for npmn

* [ci:force] - Improved eslint plugin so it can be built with standard action

* [ci:force] - Improved eslint plugin so it can be built with standard action

* [ci:force] - Added minimatch

* [ci:force] - Fixing issues

* [ci:force] - Removed 'run' as it is not needed

* [ci:force] - Using audit in place of custom scripts

* [ci:force] - Fixed vulnerabilities and removed custom scripts in favor of audit --critical

* [ci:force] - Added minimum time for publishing to install

* [ci:force] - Address issue with too new packages

* [ci:force] - Address issue with too new packages

.github/actions/setup/action.yml

@@ -1,11 +1,6 @@
 name: 'Setup'
 description: 'Initialize cache, env var load'
 inputs:
-  enable-node-modules-cache:
-    description: 'enable caching for node modules'
-    required: false
-    type: boolean
-    default: 'true'
   cache-suffix:
     description: 'Suffix to make Nx cache key unique per job (e.g. matrix project name)'
     required: false
@@ -24,20 +19,19 @@ outputs:
   npm-tag:
     description: 'NPM tag'
     value: ${{ steps.set-npm-tag.outputs.npm-tag }}
-  node-modules-cache-hit:
-    description: 'Whether node_modules cache was hit'
-    value: ${{ steps.node-modules-cache.outputs.cache-hit }}
 runs:
   using: "composite"
   steps:
       - name: Set consistent machine ID for Nx cache
         shell: bash
         run: echo "nx-github-actions" | sudo tee /etc/machine-id > /dev/null
-      - name: install NPM
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+      - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache-dependency-path: package-lock.json
+          cache: 'pnpm'
       - name: get latest tag sha
         if: ${{ inputs.full-setup == 'true' }}
         id: tag-sha
@@ -46,15 +40,12 @@ runs:
         if: ${{ inputs.full-setup == 'true' }}
         id: set-npm-tag
         uses: ./.github/actions/set-npm-tag
-      - name: Cache node modules
-        id: node-modules-cache
-        if: ${{ inputs.enable-node-modules-cache == 'true' }}
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ hashFiles('.nvmrc') }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-modules-${{ hashFiles('.nvmrc') }}-
+      - name: Install dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile
+      - name: Security audit
+        shell: bash
+        run: pnpm audit --audit-level=critical
       - name: Restore nx cache
         uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with: