[AAE-46514] - Migration to PNPM (#11926)

* [AAE-46514] - using by default ignore-scripts and have a trusted list for those who are trusted

* [AAE-46514] - Improved the checks to cover more cases

* [AAE-46514] - Fixed copilot comments

* [AAE-46514] - OTher fixes

* [AAE-46514] - Fixing other improvements and comments

* [AAE-46514] - npmrc should be versioned to enforce the audit

* [AAE-46514] - Improved code

* [AAE-46514] - Removed the check on CI as we have other tools

* [AAE-46514] - Improved check, updated descriptions, skip check on CI as there is already Sonar

* [AAE-46514] - Reduced functions in smaller pieces

* [AAE-46514] - Migrating to Pnpm to increase safety

* [ci:force] - Checking

* [ci:force] - Fixed complexity of the scripts

* [ci:force] - Fixed complexity of the scripts

* [ci:force] - Fixed wrong typing on yml

* [ci:force] - Fixed sonar comments and added correct version to sha pinned action

* [ci:force] - Fixed cache hit for npmn

* [ci:force] - Improved eslint plugin so it can be built with standard action

* [ci:force] - Improved eslint plugin so it can be built with standard action

* [ci:force] - Added minimatch

* [ci:force] - Fixing issues

* [ci:force] - Removed 'run' as it is not needed

* [ci:force] - Using audit in place of custom scripts

* [ci:force] - Fixed vulnerabilities and removed custom scripts in favor of audit --critical

* [ci:force] - Added minimum time for publishing to install

* [ci:force] - Address issue with too new packages

* [ci:force] - Address issue with too new packages

.github/workflows/build-lib-workflow.yml

@@ -28,13 +28,10 @@ jobs:
         with:
           cache-suffix: build
           full-setup: 'false'
-      - name: Install dependencies
-        if: ${{ steps.setup-env.outputs.node-modules-cache-hit != 'true' }}
-        run: npm ci
       - name: Build affected libs
         env:
           BASE_REF: ${{ inputs.base_ref }}
-        run: npx nx affected --target=build --base=origin/$BASE_REF --head=HEAD --configuration=production --exclude=stories
+        run: pnpm nx affected --target=build --base=origin/$BASE_REF --head=HEAD --configuration=production --exclude=stories
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache

.github/workflows/pull-request.yml

@@ -46,12 +46,18 @@ jobs:
       - name: Ensure SHA pinned actions
         uses: hyland/github-actions-ensure-sha-pinned-actions@7d494b6b53e71f75194d74b4dd890a2266d060b5 # v2.0.0
 
-      - name: Check package-lock.json version
+      - name: Check pnpm-lock.yaml version
         run: |
-          if [[ $(jq '.lockfileVersion == 3' package-lock.json) == "true" ]] ; then
-            echo "package-lock.json has a correct version"
+          if [[ -f "pnpm-lock.yaml" ]]; then
+            LOCKFILE_VERSION=$(grep "^lockfileVersion:" pnpm-lock.yaml | cut -d"'" -f2)
+            if [[ "$LOCKFILE_VERSION" == "9.0" ]]; then
+              echo "pnpm-lock.yaml has correct version: $LOCKFILE_VERSION"
+            else
+              echo "pnpm-lock.yaml must be version 9.0, found: $LOCKFILE_VERSION"
+              exit 1
+            fi
           else
-            echo "package-lock must be version 3"
+            echo "pnpm-lock.yaml is missing"
             exit 1
           fi
 
@@ -174,13 +180,10 @@ jobs:
         uses: ./.github/actions/setup
         with:
           cache-suffix: setup
-      - name: Install dependencies
-        if: ${{ steps.setup-env.outputs.node-modules-cache-hit != 'true' }}
-        run: npm ci
       - name: Bundle
         run: |
-          npm run bundle:js-api
-          npm run bundle:cli
+          pnpm bundle:js-api
+          pnpm bundle:cli
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache
@@ -203,13 +206,10 @@ jobs:
         with:
           cache-suffix: lint
           full-setup: 'false'
-      - name: Install dependencies
-        if: ${{ steps.setup-env.outputs.node-modules-cache-hit != 'true' }}
-        run: npm ci
       - name: Run lint
         env:
           BASE_REF: ${{ github.base_ref || 'develop' }}
-        run: npx nx affected --target=lint --base=origin/$BASE_REF --head=HEAD
+        run: pnpm nx affected --target=lint --base=origin/$BASE_REF --head=HEAD
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache
@@ -239,14 +239,11 @@ jobs:
         with:
           cache-suffix: storybook
           full-setup: 'false'
-      - name: Install dependencies
-        if: ${{ steps.setup-env.outputs.node-modules-cache-hit != 'true' }}
-        run: npm ci
       - name: Build Storybook
         env:
           BASE_REF: ${{ github.base_ref || 'develop' }}
         run: |
-          npx nx affected --target=build-storybook --base=origin/$BASE_REF --head=HEAD --configuration=ci
+          pnpm nx affected --target=build-storybook --base=origin/$BASE_REF --head=HEAD --configuration=ci
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache

.github/workflows/release.yml

@@ -57,9 +57,9 @@ jobs:
           enable-node-modules-cache: false
       - name: install
         run: |
-          npm ci
-          npm run bundle:js-api
-          npm run bundle:cli
+          pnpm install --frozen-lockfile
+          pnpm bundle:js-api
+          pnpm bundle:cli
       - uses: ./.github/actions/upload-node-modules-and-artifacts
 
   release-npm:
@@ -100,15 +100,15 @@ jobs:
             setMigrations();
       - name: build libraries
         run: |
-          npm run build:libs
-          npm run build:schematics
+          pnpm build:libs
+          pnpm build:schematics
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         name: release libraries GH registry
         with:
           node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@alfresco'
-      - run: npm run publish -- --tag=${{ steps.setup.outputs.npm-tag }}
+      - run: pnpm publish -- --tag=${{ steps.setup.outputs.npm-tag }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -117,7 +117,7 @@ jobs:
           node-version-file: '.nvmrc'
           registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
           scope: '@alfresco'
-      - run: npm run publish -- --tag=${{ steps.setup.outputs.npm-tag }}
+      - run: pnpm publish -- --tag=${{ steps.setup.outputs.npm-tag }}
 
   create-git-tag:
     runs-on: ubuntu-latest

.github/workflows/supply-chain-pr-instructions.yml

@@ -5,9 +5,8 @@ on:
     types: [opened, reopened, synchronize]
     paths:
       - "package.json"
-      - "package-lock.json"
+      - "pnpm-lock.yaml"
       - "**/package.json"
-      - "**/package-lock.json"
       - "pom.xml"
       - "**/pom.xml"
 

.github/workflows/unit-test-workflow.yml

@@ -26,16 +26,13 @@ jobs:
         uses: ./.github/actions/setup
         with:
           cache-suffix: test-matrix
-      - name: Install dependencies
-        if: ${{ steps.setup-env.outputs.node-modules-cache-hit != 'true' }}
-        run: npm ci
       - name: Generate affected projects matrix
         id: set-matrix
         env:
           BASE_REF: ${{ inputs.base_ref }}
         run: |
           echo "Base ref is $BASE_REF"
-          AFFECTED_UNIT=$(npx nx show projects --affected --target=test --base=origin/$BASE_REF --head=HEAD --select=projects --plain --exclude=cli,stories,eslint-angular)
+          AFFECTED_UNIT=$(pnpm nx show projects --affected --target=test --base=origin/$BASE_REF --head=HEAD --select=projects --plain --exclude=cli,stories,eslint-angular)
           echo "Affected projects for UNIT: $AFFECTED_UNIT"
 
           if [ -z "$AFFECTED_UNIT" ]; then
@@ -72,14 +69,11 @@ jobs:
         with:
           cache-suffix: test-${{ matrix.project }}
           full-setup: 'false'
-      - name: Install dependencies
-        if: ${{ steps.setup-env.outputs.node-modules-cache-hit != 'true' }}
-        run: npm ci
       - name: Run unit tests for ${{ matrix.project }}
         env:
           NODE_OPTIONS: "--max-old-space-size=5120"
         run: |
-          xvfb-run --auto-servernum npx nx run ${{ matrix.project }}:test
+          xvfb-run --auto-servernum pnpm nx run ${{ matrix.project }}:test
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache