fix: move pnpm workspace into frontend

[kyscott18]

Greptile Summary

The PR relocates the pnpm package boundary into frontend and updates CI to install, lint, type-check, and build from that directory.

• Moves the Biome dependency and lockfile entries into the frontend package.
• Splits frontend and backend CI checks into explicitly named jobs.
• Pins the updated CI actions to immutable commit SHAs.
• Adds separate backend type-check and build jobs.

Confidence Score: 4/5

The PR is not yet safe to merge because the frontend lint job still omits the framework-specific checks identified in the existing review thread.

The mutable CI action references were corrected with immutable SHAs, but pnpm lint still invokes only Biome while exhaustive React Hook dependency checking is disabled and no Next.js-specific lint tooling is installed.

Files Needing Attention: frontend/package.json, biome.json

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Runs frontend jobs from the relocated pnpm package, expands backend checks, and pins CI actions to immutable revisions.
frontend/package.json	Adds the frontend-local Biome dependency and lint script, but the previously reported framework-specific lint coverage remains absent.
frontend/pnpm-lock.yaml	Incorporates the pinned Biome package and platform-specific CLI artifacts into the frontend lockfile.
package.json	Removes the obsolete repository-root package manifest after moving its tooling dependency into the frontend package.
pnpm-lock.yaml	Removes the obsolete repository-root lockfile after relocating the pnpm package boundary.
.github/workflows/publish-backend.yml	Pins the checkout action to an immutable revision without changing publication behavior.

_{Reviews (4): Last reviewed commit: "ci: pin checkout and Rust cache actions" | Re-trigger Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
monode	Ready	Preview	Aug 6, 2026 1:40pm