🐋🔧：install pnpm without corepack - #1823
Merged
Merged
Conversation
Node is unbundling corepack, and pnpm no longer needs it: since pnpm 11 the `pmOnFail` setting defaults to `download`, which reads `packageManager` and fetches that version itself. Verified in the container -- the feature installs 11.17.0, and running it here reports 11.20.0. The container loses two lines and gains nothing: the pnpm feature already installs a real pnpm, into a directory not tied to a node version, so `nvm use` cannot lose it the way it could lose a corepack shim. The workflows install the version `packageManager` names rather than the newest, which saves fetching pnpm twice. One consequence had to be dealt with: corepack kept its copy of pnpm outside the project, and self-management writes one into `.pnpm-store/`, where four checks then read someone else's changelog. The store is excluded now -- in the glob helper, and in the three tools that find their own files rather than being handed a list. Signed-off-by: Derek Lewis <DerekNonGeneric@inf.is> Assisted-by: Claude-Code:claude-opus-5
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
DerekNonGeneric
added
the
commit-queue
openinf-commit-queue
Bot
removed
the
commit-queue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Node is unbundling corepack, and pnpm no longer needs it.
Why this is mostly deletion
Corepack appeared in three places and did one job in each: switch pnpm to the version in
packageManager. Since pnpm 11, pnpm does that itself — from its changelog:Verified in the container rather than taken on faith:
The container
Two lines removed, nothing added. The pnpm feature already installs a real pnpm — and into
/usr/local/share/npm-global/bin, which is not tied to a node version. The corepack shim was the one living inside a node version's directory, so this makes pnpm less vulnerable tonvm usein fish, not more.The workflows
npm install --global "pnpm@$(node -p "require('./package.json').packageManager.replace('pnpm@','').split('+')[0]")" pnpm --version pnpm installnpm ships with node, so nothing new is introduced, and the version still comes from
packageManager— no third place to keep in step. Installing the named version rather than the newest saves fetching pnpm twice.pnpm --versionis there so the log shows the handoff actually happened.I skipped
pnpm/action-setup: these workflows do not use pnpm caching, so its main advantage does not apply, and it would add a third-party action to pin and audit.The consequence worth knowing about
Corepack kept its copy of pnpm in
~/.cache/node/corepack. Self-management writes one into.pnpm-store/, which is inside the project because hard links cannot cross a filesystem — so four checks started reading pnpm's own changelog and reporting 764 markdown problems in it.Excluded in four places, because our checks find files two different ways:
build/utils.mts— the glob helper, alongside.git/, so every task that asks it for files is covered.markdownlint-cli2.jsonc,cspell.json,.remarkignore— the three tools that discover files themselves rather than being handed a listMarkdown files linted: 28 → 26, both of the two removed being pnpm's.
Verification
run:block extracted from the YAML and executed with npm stubbed: resolves tonpm install --global pnpm@11.20.0, andpnpm --versionprints11.20.0bash -nonpost-create.sh; both workflows parse as YAMLnps test— 16/16 tasks, 72/72 testsNote
The devcontainer build itself is unverified, as always from inside it. Existing containers keep their corepack shims until rebuilt; they will carry on working, since the shim still resolves
packageManager.One thing genuinely lost: corepack verified the package manager against a hash it shipped with. pnpm's self-download does not.