build: switch from yarn to pnpm with a 9-day package-age gate

Migrate the package manager from yarn@1 to pnpm@10, and enable pnpm's
minimumReleaseAge so newly published dependency versions are not
installed until they are at least 9 days (12960 minutes) old. This adds
a buffer between a version being published and us pulling it in, giving
the ecosystem more time to flag a bad release before it reaches the SDK.

pnpm 10 is used rather than 11 because pnpm 11 requires Node.js 22+,
while CI still tests against Node 20; minimumReleaseAge has been
available since pnpm 10.16.

- pnpm-workspace.yaml: minimumReleaseAge 12960; @swc/core build skipped
- replace yarn.lock with a policy-compliant pnpm-lock.yaml
- pin pnpm via the packageManager field (corepack)
- scripts/bootstrap, bin/publish-npm: use pnpm
- CI: add pnpm/action-setup before setup-node, cache: pnpm
- CONTRIBUTING.md, Brewfile, .gitignore: pnpm

Author: zachoverflow

.github/workflows/ci.yml

@@ -16,10 +16,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          cache: 'pnpm'
 
       - name: Bootstrap
         run: ./scripts/bootstrap
@@ -35,10 +39,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          cache: 'pnpm'
 
       - name: Bootstrap
         run: ./scripts/bootstrap
@@ -58,10 +66,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
+          cache: 'pnpm'
 
       - name: Bootstrap
         run: ./scripts/bootstrap

.github/workflows/publish-npm.yml

@@ -20,17 +20,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          cache: 'pnpm'
 
       - name: Upgrade npm to OIDC-capable version
         run: npm install -g npm@latest
 
       - name: Install dependencies
         run: |
-          yarn install
+          pnpm install
 
       - name: Publish to NPM
         run: |

.gitignore

@@ -1,6 +1,5 @@
 .prism.log
 node_modules
-yarn-error.log
 codegen.log
 Brewfile.lock.json
 dist

Brewfile

@@ -1 +1,2 @@
 brew "node"
+brew "pnpm"

CONTRIBUTING.md

@@ -1,13 +1,16 @@
 ## Setting up the environment
 
-This repository uses [`yarn@v1`](https://classic.yarnpkg.com/lang/en/docs/install).
-Other package managers may work but are not officially supported for development.
+This repository uses [`pnpm`](https://pnpm.io/installation). The pinned version
+is declared in the `packageManager` field of `package.json`, so running pnpm
+via [Corepack](https://nodejs.org/api/corepack.html) (`corepack enable pnpm`)
+will use the correct version automatically. Other package managers may work but
+are not officially supported for development.
 
 To set up the repository, run:
 
 ```sh
-$ yarn
-$ yarn build
+$ pnpm install
+$ pnpm build
 ```
 
 This will install all the required dependencies and build output files to `dist/`.
@@ -32,7 +35,7 @@ All files in the `examples/` directory are not modified by the generator and can
 ```sh
 $ chmod +x examples/<your-example>.ts
 # run the example against your api
-$ yarn tsn -T examples/<your-example>.ts
+$ pnpm tsn -T examples/<your-example>.ts
 ```
 
 ## Using the repository from source
@@ -52,15 +55,9 @@ Alternatively, to link a local copy of the repo:
 $ git clone https://www.github.com/lmnt-com/lmnt-node
 $ cd lmnt-node
 
-# With yarn
-$ yarn link
-$ cd ../my-package
-$ yarn link lmnt-node
-
-# With pnpm
 $ pnpm link --global
 $ cd ../my-package
-$ pnpm link -—global lmnt-node
+$ pnpm link --global lmnt-node
 ```
 
 ## Running tests
@@ -72,7 +69,7 @@ $ npx prism mock path/to/your/openapi.yml
 ```
 
 ```sh
-$ yarn run test
+$ pnpm test
 ```
 
 ## Linting and formatting
@@ -83,13 +80,13 @@ This repository uses [prettier](https://www.npmjs.com/package/prettier) and
 To lint:
 
 ```sh
-$ yarn lint
+$ pnpm lint
 ```
 
 To format and fix all lint issues automatically:
 
 ```sh
-$ yarn fix
+$ pnpm fix
 ```
 
 ## Publishing and releases

bin/publish-npm

@@ -2,7 +2,7 @@
 
 set -eux
 
-yarn build
+pnpm run build
 cd dist
 
 # Get package name and version from package.json

package.json

@@ -8,7 +8,7 @@
   "type": "commonjs",
   "repository": "github:lmnt-com/lmnt-node",
   "license": "Apache-2.0",
-  "packageManager": "yarn@1.22.22",
+  "packageManager": "pnpm@10.33.4+sha512.1c67b3b359b2d408119ba1ed289f34b8fc3c6873412bec6fd264fbdc82489e510fcbecb9ce9d22dae7f3b76269d8441046014bdca53b9979cd7a561ad631b800",
   "files": [
     "**/*"
   ],
@@ -20,7 +20,7 @@
   "scripts": {
     "test": "./scripts/test",
     "build": "./scripts/build",
-    "prepublishOnly": "echo 'to publish, run yarn build && (cd dist; yarn publish)' && exit 1",
+    "prepublishOnly": "echo 'to publish, run pnpm build && (cd dist; npm publish)' && exit 1",
     "format": "prettier --write --cache --cache-strategy metadata . !dist",
     "prepare": "if ./scripts/utils/check-is-in-git-install.sh; then ./scripts/build && ./scripts/utils/git-swap.sh; fi",
     "tsn": "ts-node -r tsconfig-paths/register",