chore: migrate npm to pnpm across CI, Docker, and scripts by Anshumancanrock · Pull Request #555 · cameri/nostream

Anshumancanrock · 2026-04-21T01:14:34Z

Migrates the package manager from npm to pnpm to improve install times, enforce strict dependency resolution, and reduce disk space usage.

Changes

Replaced package-lock.json with pnpm-lock.yaml (using pnpm@10.33.0).
Updated GitHub Actions to use pnpm/action-setup and pnpm install --frozen-lockfile.
Updated Dockerfile and docker-compose configuration to use pnpm.
Fixed Husky pre-commit/pre-push hooks to use pnpm exec.
Updated command references in README.md, CONTRIBUTING.md, and CONFIGURATION.md.
Added patch changeset to satisfy CI dependency constraint.

Closes#434

npm vs pnpm benchmark (cold install, 3 runs each)

run	npm install	pnpm install --frozen-lockfile
1	78.64s	13.78s
2	47.86s	28.72s
3	66.91s	29.12s

Installation is ~2.5× faster

Testing

Install and script flows run with pnpm locally.
CI workflow steps are updated for pnpm.
Docker-related command paths are updated to pnpm.

socket-security · 2026-04-21T01:15:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	zod@3.25.76
	axios@1.15.0 ⏵ 1.15.1	^-1			⁺¹

View full report

coveralls · 2026-04-21T01:18:36Z

coverage: 74.929% (-0.02%) from 74.946% — Anshumancanrock:chore/pnpm-migration into cameri:main

Copilot

Pull request overview

Migrates the project’s tooling and documentation from npm to pnpm across local scripts, CI workflows, and Docker-based environments.

Changes:

Switch CI workflows to install/cache dependencies with pnpm and frozen lockfile installs.
Update Dockerfiles/docker-compose migration steps and Husky hooks to use pnpm/pnpm exec.
Refresh docs and script usage text to reference pnpm commands; add a changeset for CI requirements.

Reviewed changes

Copilot reviewed 27 out of 30 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`test/integration/docker-compose.yml`	Updates DB migration step to use `corepack` + `pnpm dlx` during integration tests.
`docker-compose.yml`	Updates DB migration step to use `corepack` + `pnpm dlx` in local compose setup.
`src/scripts/export-events.ts`	Updates CLI usage output from `npm run` to `pnpm run`.
`src/scripts/benchmark-queries.ts`	Updates docstring/usage output from `npm run` to `pnpm run`.
`src/import-events.ts`	Updates CLI usage output from `npm run` to `pnpm run`.
`src/clean-db.ts`	Updates help text examples from `npm run` to `pnpm run`.
`scripts/verify-index-impact.ts`	Updates usage doc comment to `pnpm run`.
`scripts/smoke-nip03.ts`	Updates usage doc comment to `pnpm exec`.
`scripts/smoke-nip03.md`	Updates instructions to `pnpm run` / `pnpm exec`.
`scripts/security-load-test.ts`	Updates usage doc comment to `pnpm exec` / `pnpm run`.
`package.json`	Adds `packageManager` pin and updates scripts to use `pnpm`.
`Dockerfile.test`	Switches dependency install to `pnpm` with frozen lockfile.
`Dockerfile.railwayapp`	Switches build/runtime installs and migration invocation to `pnpm`.
`Dockerfile`	Switches build/runtime installs and build step to `pnpm`.
`README.md`	Updates developer/user commands to `pnpm`.
`CONTRIBUTING.md`	Updates contributor commands to `pnpm` / `pnpm exec`.
`CONFIGURATION.md`	Updates benchmarking commands to `pnpm`.
`.husky/pre-commit`	Updates hook commands to `pnpm run`.
`.husky/commit-msg`	Updates hook to use `pnpm exec commitlint`.
`.gitignore`	Ignores `package-lock.json` and pnpm cache artifacts.
`.github/workflows/checks.yml`	Updates CI jobs to use `pnpm/action-setup`, pnpm cache, and frozen installs.
`.github/workflows/changesets.yml`	Updates release workflow to use pnpm install and pnpm-based changeset commands.
`.changeset/bright-clocks-jam.md`	Adds a patch changeset documenting the migration.
`src/routes/index.ts`	Adds explicit `Router` typing and import adjustments.
`src/routes/invoices/index.ts`	Adds explicit `Router` typing for router instance.
`src/routes/callbacks/index.ts`	Adds explicit `Router` typing for router instance.
`src/routes/admissions/index.ts`	Adds explicit `Router` typing for router instance.
`src/factories/web-app-factory.ts`	Adds explicit `Express` return type for `createWebApp`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-22T00:10:20Z

 - sh
 - -c
- - 'cd code && npm install --no-save --quiet knex@2.4.0 pg@8.8.0 && npx knex migrate:latest'
+ - 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'


This migration container runs corepack enable && pnpm dlx ... in /code without a package.json, so Corepack can’t read the repo’s packageManager pin and may pick a different pnpm version over time. To keep CI/integration tests reproducible, explicitly prepare/activate the pnpm version you expect (e.g., corepack prepare pnpm@10.33.0 --activate) before invoking pnpm dlx.
Suggested change
- 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'
- 'cd code && corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

Copilot · 2026-04-22T00:10:21Z

 - sh
 - -c
- - 'cd code && npm install --no-save --quiet knex@2.4.0 pg@8.8.0 && npx knex migrate:latest'
+ - 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'


corepack enable && pnpm dlx ... is executed in /code, which doesn’t include this repo’s package.json (and therefore doesn’t provide the packageManager: pnpm@10.33.0 pin). That makes the pnpm version selected by Corepack non-deterministic and could break migrations if Corepack defaults change. Consider explicitly preparing/activating the intended pnpm version here (e.g., corepack prepare pnpm@10.33.0 --activate) before running pnpm dlx.
Suggested change
- 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'
- 'cd code && corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

…oint

changeset-bot · 2026-04-23T02:36:31Z

🦋 Changeset detected

Latest commit: aafcfcb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Anshumancanrock · 2026-04-23T07:55:07Z

hii @cameri , could you please review this pr when you have time? Thanks !

cameri · 2026-04-23T10:11:47Z

+COPY --from=build /build/package.json /build/pnpm-lock.yaml ./

-RUN npm install --omit=dev --quiet
+RUN corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm install --prod --frozen-lockfile --silent


Can we make PNMP_VERSION an ARG and ENV var?

Done ! Added ARG PNPM_VERSION=10.33.0 at the top of all three Dockerfiles and replaced every hardcoded reference with$PNPM_VERSION

cameri · 2026-04-23T10:14:12Z


 ```
- NODE_OPTIONS="-r dotenv/config" npm run db:migrate
+ NODE_OPTIONS="-r dotenv/config" pnpm run db:migrate


Let's check if this NODE_OPTIONS can be removed and use node owns env file loading mechanism.

…on containers, drop redundant 'run' keyword

…files

cameri · 2026-04-25T12:40:30Z


 ```
-npm run dev
+pnpm run dev


Shall we remove run from commands in this file as well?

…m docs

…files

… migration

Anshumancanrock added 3 commits April 20, 2026 22:36

chore: migrate npm tooling to pnpm
673c7f6

docs: update commands for pnpm migration
ee28793

chore: add changeset for pnpm migration
e9daf93

Anshumancanrock marked this pull request as draft April 21, 2026 01:22

cameri requested a review from Copilot April 22, 2026 00:06

cameri self-assigned this Apr 22, 2026

Copilotstarted reviewing on behalf of cameri April 22, 2026 00:06 View session

CopilotAI reviewed Apr 22, 2026
View reviewed changes

Anshumancanrock added 5 commits April 23, 2026 08:05

fix(docker-compose): pin pnpm@10.33.0 in prod migration entrypoint
62c3b86

fix(docker-compose): pin pnpm@10.33.0 in integration migration entryp…
a641fc9
…oint

chore(docker): pin pnpm@10.33.0 via corepack prepare in Dockerfiles
e387a2c

chore(ci): drop redundant pnpm version pin in checks workflow
e39f3b1

chore(ci): drop redundant pnpm version pin in changesets workflow
04cb64c

Anshumancanrock force-pushed the chore/pnpm-migration branch from c8996be to 04cb64cCompare April 23, 2026 02:39

Anshumancanrock added 2 commits April 23, 2026 09:02

chore: merge upstream/main into chore/pnpm-migration
770eea2

chore(deps): regenerate pnpm-lock.yaml for @changesets/changelog-github
5ccfb8e

Anshumancanrock force-pushed the chore/pnpm-migration branch from 71db1c1 to 5ccfb8eCompare April 23, 2026 03:33

Anshumancanrock marked this pull request as ready for review April 23, 2026 07:54

Anshumancanrock force-pushed the chore/pnpm-migration branch from f0be329 to 5ccfb8eCompare April 23, 2026 07:55

cameri reviewed Apr 23, 2026
View reviewed changes

fix: drop obsolete dotenv NODE_OPTIONS, use npm for ephemeral migrati…
82b564a
…on containers, drop redundant 'run' keyword

Anshumancanrock marked this pull request as draft April 23, 2026 16:56

refactor(docker): extract PNPM_VERSION as build ARG across all Docker…
188c9e4
…files

Anshumancanrock marked this pull request as ready for review April 23, 2026 17:31

Merge branch 'main' into chore/pnpm-migration
ae62fa7

cameri reviewed Apr 25, 2026
View reviewed changes

Anshumancanrock added 3 commits April 25, 2026 19:28

refactor: rename knip to check:deps, drop redundant 'run' keyword fro…
a822aff
…m docs

refactor: rename format:check to check:format, drop 'run' from Docker…
d8566cd
…files

revert: restore scripts/ to upstream to avoid conflicts with CLI tool…
aafcfcb
… migration

Anshumancanrock requested a review from cameri April 25, 2026 14:24

cameri approved these changes Apr 25, 2026
View reviewed changes

cameri merged commit ddc811d into cameri:mainApr 25, 2026
11 of 13 checks passed

cameri mentioned this pull request Apr 25, 2026
chore: release new version 🚀 #560
Merged

	- 'cd code && corepack enable && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'
	- 'cd code && corepack enable && corepack prepare pnpm@10.33.0 --activate && pnpm dlx --package=knex@2.4.0 --package=pg@8.8.0 knex migrate:latest'

Conversation

Anshumancanrock commented Apr 21, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

npm vs pnpm benchmark (cold install, 3 runs each)

Testing

Uh oh!

socket-securityBot commented Apr 21, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Apr 21, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

CopilotAIApr 22, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAIApr 22, 2026

Choose a reason for hiding this comment

Uh oh!

changeset-botBot commented Apr 23, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Anshumancanrock commented Apr 23, 2026

Uh oh!

Uh oh!

Uh oh!

cameriApr 23, 2026

Choose a reason for hiding this comment

Uh oh!

AnshumancanrockApr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cameriApr 23, 2026

Choose a reason for hiding this comment

Uh oh!

cameriApr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Anshumancanrock commented Apr 21, 2026•
edited
Loading

socket-securityBot commented Apr 21, 2026•
edited
Loading

coveralls commented Apr 21, 2026•
edited
Loading

changeset-botBot commented Apr 23, 2026•
edited
Loading