build: migrate JavaScript tooling to pnpm 11 (#1792)

Part of #1732.

I used https://github.com/oxc-project/oxc-vscode as a reference.

## Why

Before updating the dependency backlog, we need a safer baseline for installing and running JavaScript tools. pnpm 11 denies dependency build scripts unless they are explicitly reviewed, applies a default cooldown to newly published packages, and exposes undeclared dependency assumptions through its isolated node_modules layout. This PR keeps those protections enabled.

The value here is combining an exact package-manager pin, pnpm's installation safeguards, and project-declared CLI tools. Release jobs should not fetch executables through npx at execution time.

## Changes

- Pin pnpm exactly to 11.27.1 in package.json and replace package-lock.json with pnpm-lock.yaml.
- Use pnpm and explicit frozen-lockfile installs in the main, pre-release, and release workflows.
- Declare `@vscode/vsce` and `ovsx` as devDependencies; use project-local binaries for them and `git-cliff`.
- Allow only `esbuild`'s dependency build script, which prepares its platform-specific binary. Explicitly deny vsce-sign and keytar because these workflows do not sign VSIX files or use vsce's credential store.
- Package the bundled extension with `vsce --no-dependencies`, and include only required files in the VSIX.
- Update VS Code tasks, launch configuration, and contributor commands.

Author: eitsupi

.github/workflows/main.yml

@@ -23,37 +23,39 @@ jobs:
       - uses: r-lib/actions/setup-r@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2
         with:
           use-public-rspm: true
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: 'npm'
-      - run: npm install
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
       - name: Install remotes
         run: install.packages("remotes")
         shell: Rscript {0}
-      - run: npm run build
+      - run: pnpm run build
       - name: Run sess tests
         run: tinytest::test_package("sess")
         shell: Rscript {0}
       - name: Run tests (Linux)
         if: runner.os == 'Linux'
-        run: xvfb-run -a npm run test
+        run: xvfb-run -a pnpm run test
       - name: Run tests
         if: runner.os != 'Linux'
-        run: npm run test
+        run: pnpm run test
   build:
     runs-on: ubuntu-latest
     env:
       VSIX_FILE: vscode-R.vsix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: 'npm'
-      - run: npm install
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
       - name: Package extension
-        run: npx @vscode/vsce package -o $VSIX_FILE
+        run: pnpm exec vsce package --no-dependencies -o $VSIX_FILE
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ env.VSIX_FILE }}
@@ -71,14 +73,15 @@ jobs:
         run: install.packages("lintr")
         shell: Rscript {0}
 
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: 'pnpm'
 
-      - run: npm install
+      - run: pnpm install --frozen-lockfile
       - name: eslint
-        run: npx eslint src --ext ts  
+        run: pnpm exec eslint src --ext ts
 
       - name: Lint R directory
         run: lintr::lint_dir("./R")

.github/workflows/pre-release.yml

@@ -18,13 +18,14 @@ jobs:
       VSIX_FILE: vscode-R.vsix    
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: 'npm'
-      - run: npm install
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
       - name: Package extension
-        run: npx @vscode/vsce package -o $VSIX_FILE
+        run: pnpm exec vsce package --no-dependencies -o $VSIX_FILE
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: "${{ env.VSIX_FILE }}"

.github/workflows/release.yml

@@ -15,15 +15,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: 'npm'
-      - run: npm install
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
       - name: Package extension
         id: package
         run: |
-          npx @vscode/vsce package
+          pnpm exec vsce package --no-dependencies
           echo "VSIX_FILE=$(ls *.vsix)" >> $GITHUB_OUTPUT
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -59,17 +60,18 @@ jobs:
     needs: build
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: 'npm'
-      - run: npm install
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vsix-artifact
           path: artifacts/
       - name: Publish to Visual Studio Marketplace
-        run: npx @vscode/vsce publish -p ${{ secrets.VSCE_TOKEN }} --packagePath artifacts/*.vsix
+        run: pnpm exec vsce publish -p ${{ secrets.VSCE_TOKEN }} --packagePath artifacts/*.vsix
       - name: Publish to Open VSX Registry
-        run: npx ovsx publish -p ${{ secrets.OPEN_VSX_TOKEN }} --packagePath artifacts/*.vsix
+        run: pnpm exec ovsx publish -p ${{ secrets.OPEN_VSX_TOKEN }} --packagePath artifacts/*.vsix

.vscode/launch.json

@@ -17,7 +17,7 @@
         "${workspaceFolder}/dist/**/*.js"
       ],
       "sourceMaps": true,
-      "preLaunchTask": "npm: compile"
+      "preLaunchTask": "compile"
     },
     {
       "name": "Launch Extension (--disable-extensions)",
@@ -32,7 +32,7 @@
         "${workspaceFolder}/dist/**/*.js"
       ],
       "sourceMaps": true,
-      "preLaunchTask": "npm: compile"
+      "preLaunchTask": "compile"
     },
     {
       "name": "Extension Tests",
@@ -47,7 +47,7 @@
         "${workspaceFolder}/dist/**/*.js",
         "${workspaceFolder}/out/**/*.js"
       ],
-      "preLaunchTask": "npm: pretest"
+      "preLaunchTask": "pretest"
     }
   ]
 }

.vscode/tasks.json

@@ -7,9 +7,12 @@
       "label": "Package Extension",
       "type": "shell",
       "problemMatcher": [],
-      "command": "vsce",
+      "command": "pnpm",
       "args": [
+        "exec",
+        "vsce",
         "package",
+        "--no-dependencies",
         "-o",
         "${workspaceFolderBasename}.vsix"
       ]
@@ -31,49 +34,41 @@
       }
     },
     {
-      "type": "npm",
-      "script": "compile",
+      "label": "compile",
+      "type": "shell",
+      "command": "pnpm",
+      "args": ["run", "compile"],
       "problemMatcher": []
     },
     {
-      "type": "npm",
-      "script": "build",
+      "label": "build",
+      "type": "shell",
+      "command": "pnpm",
+      "args": ["run", "build"],
       "problemMatcher": "$tsc"
     },
 		{
-      "type": "npm",
-      "script": "watch",
+      "label": "watch",
+      "type": "shell",
+      "command": "pnpm",
+      "args": ["run", "watch"],
       "group": "build",
       // install https://marketplace.visualstudio.com/items?itemName=eamodio.tsl-problem-matcher
       "problemMatcher": ["$ts-webpack-watch"],
       "isBackground": true
 		},
-    {
-      "type": "npm",
-      "script": "watchHelp",
-      "group": "build",
-      "problemMatcher": "$tsc-watch",
-      "isBackground": true
-    },
-    {
-      "type": "npm",
-      "script": "watchHttpgd",
-      "group": "build",
-      "problemMatcher": "$tsc-watch",
-      "isBackground": true
-    },
     {
       "label": "watchAll",
       "dependsOn": [
-        "npm: watch",
-        "npm: watchHelp",
-        "npm: watchHttpgd"
+        "watch"
       ],
       "problemMatcher": []
     },
     {
-      "type": "npm",
-      "script": "pretest",
+      "label": "pretest",
+      "type": "shell",
+      "command": "pnpm",
+      "args": ["run", "pretest"],
       "problemMatcher": "$tsc",
       "presentation": {
         "reveal": "never"

.vscodeignore

@@ -1,21 +1,17 @@
-.csv
-.github/**
-.gitignore
-.vscode
-.vscode-test/**
-.vscode/**
-.xls
-.xlsx
-cliff.toml
-**/*.map
-html/**/*.ts
-out/test/**
-src/
-src/**
-test/**
-**/tsconfig.json
-esbuild.js
-.markdownlint.json
-.eslintignore
-node_modules 
-out/ 
+**
+!package.json
+!README.md
+!CHANGELOG.md
+!LICENSE
+!R/**
+!sess/**
+!html/**/*.ejs
+!html/**/*.css
+!html/**/*.js
+!images/**
+!language-configuration/**
+!snippets/**
+!syntaxes/**
+!dist/**/*.js
+!dist/**/*.css
+!dist/**/*.ejs

CONTRIBUTING.md

@@ -4,10 +4,10 @@ If you are interested in writing code to fix issues, please see [How to Contribu
 
 ## Debugging the extension
 
-1. Run `npm install` and open this repository in VS Code.
-2. Select **Launch Extension** in Run and Debug, then press **F5**. The pre-launch task runs `npm run compile` to build the extension and webviews in `dist`, including source maps for TypeScript breakpoints.
+1. Run `pnpm install` and open this repository in VS Code.
+2. Select **Launch Extension** in Run and Debug, then press **F5**. The pre-launch task runs `pnpm run compile` to build the extension and webviews in `dist`, including source maps for TypeScript breakpoints.
 3. Open an R file or run an R command in the Extension Development Host to activate vscode-R. Ensure the **R Syntax** extension (`REditorSupport.r-syntax`) is installed and enabled there.
 
-For continuous rebuilding, run `npm run watch`. `npm run build` additionally installs the bundled `sess` R package; this is not required just to launch the extension debugger. **Extension Tests** builds both the bundle and the TypeScript test files before launching.
+For continuous rebuilding, run `pnpm run watch`. `pnpm run build` additionally installs the bundled `sess` R package; this is not required just to launch the extension debugger. **Extension Tests** builds both the bundle and the TypeScript test files before launching.
 
 VS Code 1.139 has a [JavaScript debugger regression](https://github.com/microsoft/vscode-js-debug/issues/2420) that can leave the development host paused before any extension activates. The launching window's extension host log shows `ECONNREFUSED ::1` and `Could not find any debuggable target`. The fix is included in [JavaScript Debugger 1.140](https://github.com/microsoft/vscode-js-debug/releases/tag/v1.140.0). Until your VS Code version includes it, use Microsoft's [JavaScript Debugger Nightly](https://marketplace.visualstudio.com/items?itemName=ms-vscode.js-debug-nightly): disable the built-in **JavaScript Debugger**, install Nightly, and reload VS Code. Switch back to the built-in debugger once VS Code includes the fix.