Repository navigation
Migrate from npm to pnpm workspaces with catalogs - #43922
Merged
Timothee Guerin (timotheeguerin) merged 84 commits intoSep 16, 2026
Merged
Conversation
- Add pnpm-workspace.yaml defining 15 workspace packages and a catalog with 21 shared dependency versions - Replace file: references with workspace:* protocol - Replace hardcoded versions with catalog: for shared deps - Move overrides from package.json to pnpm-workspace.yaml - Update all GitHub workflows and actions to use pnpm - Add pnpm/action-setup@v4 to CI setup action - Delete package-lock.json, generate pnpm-lock.yaml - Add packageManager field to root package.json
Next Steps to MergeNext steps that must be taken to merge this PR:
Comment generated by summarize-checks workflow run. |
Timothee Guerin (timotheeguerin)
force-pushed
the
timotheeguerin/pnpm-workspaces
branch
from
June 11, 2026 20:24
ac12b63 to
6748add
Compare
pnpm/action-setup runs before actions/setup-node, so it would try to install pnpm using the runner's default Node 20 which is too old for pnpm 11. Using standalone mode downloads a self-contained binary.
Timothee Guerin (timotheeguerin)
force-pushed
the
timotheeguerin/pnpm-workspaces
branch
from
June 11, 2026 20:26
6748add to
48b012d
Compare
…orkspaces # Conflicts: # eng/tools/typespec-validation/package.json # eng/tools/typespec-validation/src/rules/npm-prefix.ts # eng/tools/typespec-validation/test/npm-prefix.test.ts # package-lock.json
…orkspaces # Conflicts: # eng/tools/lint-diff/package.json # package-lock.json
…into timotheeguerin/pnpm-workspaces # Conflicts: # .github/package-lock.json # .github/package.json
…ification The real speedup came from package-manager-cache: false (no ~3s pnpm probe) and switching to 'pnpm install --frozen-lockfile'. Removing --config.trust-lockfile=true restores pnpm's per-install supply-chain (minimumReleaseAge) verification on this step too, for full defense-in-depth at a small time cost.
…hain verification" This reverts commit 50fce90.
…orkspaces # Conflicts: # eng/tools/package.json # package-lock.json
…orkspaces # Conflicts: # package-lock.json # package.json
…orkspaces # Conflicts: # package-lock.json # package.json
…orkspaces # Conflicts: # package-lock.json # package.json
…orkspaces # Conflicts: # .devcontainer/devcontainer.json # .github/package-lock.json # .github/shared/package-lock.json # eng/tools/lint-diff/package.json # eng/tools/package.json # eng/tools/spec-gen-sdk-runner/package.json # eng/tools/typespec-requirement/package.json # package-lock.json # package.json
Timothee Guerin (timotheeguerin)
requested review from
a team,
catalinaperalta,
iscai-msft and
Mark Cowlishaw (markcowl)
as code owners
August 27, 2026 18:30
| # to this command: pnpm does not read trustLockfile from the npm_config_* env, and | ||
| # the full installs in other workflows should keep verifying. | ||
| install-command: "pnpm install --frozen-lockfile --prod --prefer-offline --config.trust-lockfile=true --filter=azure-rest-api-specs-github..." | ||
| # Minimal prod-only install (~22 packages). Skip the pnpm store cache: in CI |
Contributor
There was a problem hiding this comment.
This is fine for now, but another factor is reliability. If the cache is more reliable, it might be better overall, even if slower (and how much slower?).
Mike Harder (mikeharder)
approved these changes
Sep 15, 2026
Timothee Guerin (timotheeguerin)
merged commit Sep 16, 2026
98a8465
into
main
87 of 89 checks passed
Timothee Guerin (timotheeguerin)
deleted the
timotheeguerin/pnpm-workspaces
branch
September 16, 2026 14:25
This was referenced Sep 16, 2026
This was referenced Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converts the repository from npm to pnpm workspaces with catalogs for shared dependency version management.
Changes
New files
pnpm-workspace.yaml— defines workspace packages,allowBuilds,overrides, and a catalog with 21 shared dependency versionspnpm-lock.yaml— replacespackage-lock.jsonPackage management
file:references replaced withworkspace:*protocolcatalog:instead of hardcoded versionsoverridesmoved from rootpackage.jsontopnpm-workspace.yaml(pnpm 11 requirement)packageManager: "pnpm@11.5.1"to rootpackage.jsonCI/CD
pnpm/action-setup@v6to the setup actionnpmtopnpmnpm ci→pnpm install --frozen-lockfilenpm exec --no --→pnpm execnpm run→pnpm runin workflowsWorkspace packages (15 total)
.github/,.github/shared/,eng/tools/, and all 11 sub-packages undereng/tools/Verification
pnpm install✅eng/toolsTypeScript build ✅.github/sharedbuild + tests (100% coverage) ✅tsp compileon sample spec ✅Notes
lint-diff'smarkedbumped from^17→^18(unified via catalog)@types/js-yamlto packages that relied on npm's flat hoistingeng/common/tsp-clientandeng/common/spellingremain independent (not workspace packages)