[CI] Replace Corepack with pnpm/setup

.github/workflows/ci.yml

@@ -25,15 +25,9 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-            - name: Set node
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+            - uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
               with:
-                  node-version-file: .nvmrc
-                  cache: pnpm
-                  cache-dependency-path: pnpm-lock.yaml
-            - name: Install
-              run: pnpm install --frozen-lockfile
+                  cache: true
             - name: Lint
               run: pnpm run lint
             - name: Format check
@@ -55,15 +49,10 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-            - name: Set node
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+            - uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
               with:
-                  node-version: ${{ matrix.node-version }}
-                  cache: pnpm
-                  cache-dependency-path: pnpm-lock.yaml
-            - name: Install
-              run: pnpm install --frozen-lockfile
+                  runtime: node@${{ matrix.node-version }}
+                  cache: true
             - name: Build
               run: pnpm build
             - name: Test
@@ -93,15 +82,9 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-            - name: Set node
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+            - uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
               with:
-                  node-version-file: .nvmrc
-                  cache: pnpm
-                  cache-dependency-path: pnpm-lock.yaml
-            - name: Install
-              run: pnpm install --frozen-lockfile
+                  cache: true
             - name: Pin ${{ matrix.name }}
               run: pnpm --filter @symfony/reprise add -D ${{ matrix.add }}
             - name: Build
@@ -218,15 +201,9 @@ jobs:
                   dependency-versions: highest
                   composer-options: --prefer-dist
                   custom-cache-suffix: ${{ matrix.symfony-version }}
-            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-            - name: Set node
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+            - uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
               with:
-                  node-version-file: .nvmrc
-                  cache: pnpm
-                  cache-dependency-path: pnpm-lock.yaml
-            - name: Install JS dependencies
-              run: pnpm install --frozen-lockfile
+                  cache: true
             - name: Pin ${{ matrix.name }}
               if: matrix.add
               run: pnpm -C playground add -D ${{ matrix.add }}

.github/workflows/release-on-npm.yaml

@@ -33,8 +33,9 @@ jobs:
                   fi
                   echo "Tag ${GITHUB_REF_NAME} verified as ancestor of main."
 
-            # Pinned explicitly to avoid pulling a compromised "latest" at release time; bump via dedicated PR.
-            - run: npm i -g corepack@0.35.0 && corepack enable
+            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+              # setup-node is kept here (instead of pnpm/setup) because its `registry-url` input is
+              # what wires npm OIDC trusted publishing.
               # setup-node does not enable any package-manager cache here (no `cache:` input),
               # so cache poisoning is not a concern on this release workflow.
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # zizmor: ignore[cache-poisoning] v7.0.0

CONTRIBUTING.md

@@ -34,12 +34,11 @@ $ git remote add upstream git@github.com:symfony/reprise.git
 - **PHP 8.4 or higher**
 - **Composer**
 - **Node.js 22 or higher**
-- **Corepack**
-- **pnpm 11.10 or higher**
+- **[pnpm](https://pnpm.io/installation) 11.10 or higher**
 
 ```shell
 $ composer install
-$ corepack enable && pnpm install
+$ pnpm install
 ```
 
 > [!IMPORTANT]

package.json

@@ -6,6 +6,13 @@
   "engines": {
     "node": "^22.18.0 || ^24.11.0 || >=26.0"
   },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "^22.18.0",
+      "onFail": "warn"
+    }
+  },
   "scripts": {
     "build": "pnpm -C assets run build",
     "dev": "pnpm -C assets run dev",