refactor: migrate from Bun to pnpm as package manager#224
Merged
pffigueiredo merged 2 commits intomainfrom Apr 14, 2026
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
pffigueiredo
force-pushed
the
refactor/bun-to-pnpm
branch
from
f83d628 to
166b1b0
Compare
pffigueiredo
force-pushed
the
refactor/bun-to-pnpm
branch
from
166b1b0 to
7b96a36
Compare
pffigueiredo
force-pushed
the
refactor/bun-to-pnpm
branch
3 times, most recently
from
d2f9519 to
24b125d
Compare
pffigueiredo
force-pushed
the
refactor/bun-to-pnpm
branch
3 times, most recently
from
2b0c9e8 to
b6c3931
Compare
4 tasks
pffigueiredo
force-pushed
the
refactor/bun-to-pnpm
branch
from
b6c3931 to
b5af7c9
Compare
Bun's lockfile embeds absolute registry URLs, breaking --frozen-lockfile across environments (dev proxy, CI JFrog, Vercel). pnpm stores only integrity hashes, restoring lockfile portability and satisfying supply chain hardening requirement R3. - Pin pnpm 10.33.0 via Corepack packageManager field - Add shamefully-hoist=true for Next.js compatibility - Add tsx for TS script execution (replaces bun runtime) - Create preinstall registry validation script for pnpm - Add JFrog OIDC to CI for npm registry access - Install pnpm via jf npm, matching neondatabase/serverless pattern - Update all CI workflows (pr.yml, claude.yml, claude-code-review.yml) - Update CLAUDE.md and README.md Co-authored-by: Isaac
pffigueiredo
force-pushed
the
refactor/bun-to-pnpm
branch
from
b5af7c9 to
4b26f02
Compare
- Remove preinstall registry guard that blocked Vercel builds and external contributors; add troubleshooting note to CLAUDE.md instead - Mask JFrog OIDC token in CI logs with ::add-mask:: - Scope id-token: write to job level instead of workflow level - Fix trailing newline in .npmrc - Update stale Bun reference in vercel-migration.md Co-authored-by: Isaac
andrelandgraf
pushed a commit
that referenced
this pull request
Apr 16, 2026
- **Replace Bun with pnpm** as the project's package manager. Bun's lockfile embeds 818 absolute registry URLs, breaking `--frozen-lockfile` across environments (dev proxy, CI JFrog, Vercel). pnpm stores only integrity hashes — no registry URLs — restoring lockfile portability. - **Add JFrog OIDC** to CI for npm registry access on protected runners (follows `neondatabase/serverless` pattern). - **Pin pnpm 10.33.0 via Corepack** `packageManager` field. CI installs pnpm via `jf npm install -g`. - **Update all CI workflows** (`pr.yml`, `claude.yml`, `claude-code-review.yml`): replace bun setup/cache/install/scripts with pnpm equivalents. - **Add `tsx`** as devDependency for TS script execution (replaces `bun run scripts/*.ts`). - **Rewrite preinstall registry validation script** for pnpm (validates `.npmrc` instead of generating `bunfig.toml`). - **Update docs** (CLAUDE.md, README.md) to reflect pnpm workflow. - [ ] CI passes: `pnpm install --frozen-lockfile`, fmt, lint, knip, typecheck, test, build - [ ] `pnpm-lock.yaml` contains zero registry URLs - [ ] Verify Vercel preview deployment auto-detects pnpm from `pnpm-lock.yaml` - [ ] No `bun` references remain in workflows or docs This pull request was AI-assisted by Isaac.
andrelandgraf
pushed a commit
that referenced
this pull request
Apr 16, 2026
- **Replace Bun with pnpm** as the project's package manager. Bun's lockfile embeds 818 absolute registry URLs, breaking `--frozen-lockfile` across environments (dev proxy, CI JFrog, Vercel). pnpm stores only integrity hashes — no registry URLs — restoring lockfile portability. - **Add JFrog OIDC** to CI for npm registry access on protected runners (follows `neondatabase/serverless` pattern). - **Pin pnpm 10.33.0 via Corepack** `packageManager` field. CI installs pnpm via `jf npm install -g`. - **Update all CI workflows** (`pr.yml`, `claude.yml`, `claude-code-review.yml`): replace bun setup/cache/install/scripts with pnpm equivalents. - **Add `tsx`** as devDependency for TS script execution (replaces `bun run scripts/*.ts`). - **Rewrite preinstall registry validation script** for pnpm (validates `.npmrc` instead of generating `bunfig.toml`). - **Update docs** (CLAUDE.md, README.md) to reflect pnpm workflow. - [ ] CI passes: `pnpm install --frozen-lockfile`, fmt, lint, knip, typecheck, test, build - [ ] `pnpm-lock.yaml` contains zero registry URLs - [ ] Verify Vercel preview deployment auto-detects pnpm from `pnpm-lock.yaml` - [ ] No `bun` references remain in workflows or docs This pull request was AI-assisted by Isaac.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--frozen-lockfileacross environments (dev proxy, CI JFrog, Vercel). pnpm stores only integrity hashes — no registry URLs — restoring lockfile portability.neondatabase/serverlesspattern).packageManagerfield. CI installs pnpm viajf npm install -g.pr.yml,claude.yml,claude-code-review.yml): replace bun setup/cache/install/scripts with pnpm equivalents.tsxas devDependency for TS script execution (replacesbun run scripts/*.ts)..npmrcinstead of generatingbunfig.toml).Test plan
pnpm install --frozen-lockfile, fmt, lint, knip, typecheck, test, buildpnpm-lock.yamlcontains zero registry URLspnpm-lock.yamlbunreferences remain in workflows or docsThis pull request was AI-assisted by Isaac.