feat: switch package manager to pnpm Refs: NS-211

[mikkojamG]

Switch package manager from Yarn Classic to pnpm.

Summary by CodeRabbit

• New Features

  • Added pnpm-based project setup and workflow support.
  • Updated compatibility guidance to target the newer HDS release.

• Documentation

  • Refreshed install and peer-dependency instructions to match the latest setup.

• Chores

  • Updated CI, formatting, and pre-commit automation to use pnpm.
  • Broadened ignored files and directories for common Yarn and build artifacts.
  • Bumped several development and linting tool versions.

[coderabbitai]

📝 Walkthrough

Walkthrough

CI and release workflows switch reusable workflow references from ci-node.yml to ci-pnpm-node.yml. Git hooks, ignore files, and package.json/pnpm-workspace.yaml migrate tooling from yarn to pnpm. Separately, hds-react is upgraded to v5 across peer/dev dependencies, type stubs, and README instructions.

Changes

Yarn to pnpm migration

Layer / File(s)	Summary
CI workflow references .github/workflows/ci.yaml, .github/workflows/release-please.yml	Reusable workflow references changed from ci-node.yml@main to ci-pnpm-node.yml@main.
Local tooling and pnpm config .husky/pre-commit, .gitignore, .prettierignore, package.json, pnpm-workspace.yaml	Pre-commit hook uses pnpm test, ignore files add yarn/pnpm artifacts, package.json adds a packageManager field, and pnpm-workspace.yaml adds release-age, hoisting, build script, and override settings.

Estimated code review effort: 2 (Simple) | ~10 minutes

hds-react v5 dependency upgrade

Layer / File(s)	Summary
Dependency and type declaration updates package.json, lib/types.d.ts	hds-react peer/dev dependency bumped to v5, related ESLint/TypeScript tooling versions updated, and hds-react module declaration removed from type stubs.
Installation docs README.md	README updates HDS4 to HDS5 reference, switches install commands to pnpm, and bumps hds-react version in peer dependency install instructions.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: migrating the repository from Yarn to pnpm.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/NS-211-pnpm

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

The following issues were found:

• ❌ 6 vulnerable package(s)
• ⚠️ 67 packages with OpenSSF Scorecard issues.

View full job summary

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

🧹 Nitpick comments (2)

.husky/pre-commit (1)

2-2: 📐 Maintainability & Code Quality | 🔵 Trivial

Consider using --run for consistency with the project convention.

The test:coverage script in package.json uses vitest --run, while the pre-commit hook uses --no-watch. Both are functionally equivalent in vitest, but --run is more idiomatic and consistent with the existing project convention.

♻️ Suggested consistency fix

-pnpm test --no-watch
+pnpm test --run

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.husky/pre-commit at line 2, The pre-commit hook uses a nonstandard Vitest
flag, so update the command in the pre-commit script to match the project’s
existing convention used by the test:coverage script. Locate the test invocation
in the pre-commit hook and replace the current Vitest option with the more
idiomatic run mode so the hook stays consistent with the rest of the repository.

pnpm-workspace.yaml (1)

10-11: 📐 Maintainability & Code Quality | 🔵 Trivial

Track shamefullyHoist: true for future removal.

shamefullyHoist flattens node_modules to mimic npm/yarn behavior, which is useful during migration but masks real peer dependency issues and defeats pnpm's strict isolation. Consider tracking its removal once the codebase is stable on pnpm.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pnpm-workspace.yaml` around lines 10 - 11, The workspace is still relying on
shamefullyHoist in the pnpm configuration, so add a clear removal plan for this
compatibility workaround and track it for cleanup once the codebase is stable on
pnpm. Update the pnpm-workspace setup around shamefullyHoist so it is treated as
a temporary migration aid, and ensure the relevant workspace/package management
config notes the future removal target.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.husky/pre-commit:
- Line 2: The pre-commit hook uses a nonstandard Vitest flag, so update the
command in the pre-commit script to match the project’s existing convention used
by the test:coverage script. Locate the test invocation in the pre-commit hook
and replace the current Vitest option with the more idiomatic run mode so the
hook stays consistent with the rest of the repository.

In `@pnpm-workspace.yaml`:
- Around line 10-11: The workspace is still relying on shamefullyHoist in the
pnpm configuration, so add a clear removal plan for this compatibility
workaround and track it for cleanup once the codebase is stable on pnpm. Update
the pnpm-workspace setup around shamefullyHoist so it is treated as a temporary
migration aid, and ensure the relevant workspace/package management config notes
the future removal target.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 305b2cd3-7269-4a76-b495-3a5ba6cedf8a

📥 Commits

Reviewing files that changed from the base of the PR and between 7f6e9b3 and 191c7d5.

⛔ Files ignored due to path filters (2)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (9)

• .github/workflows/ci.yaml
• .github/workflows/release-please.yml
• .gitignore
• .husky/pre-commit
• .prettierignore
• README.md
• lib/types.d.ts
• package.json
• pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• lib/types.d.ts