build: share worktree dependencies with pnpm

.github/workflows/ci.yml

@@ -20,23 +20,28 @@ jobs:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+        with:
+          version: 10.34.9
+          run_install: false
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
-          cache: npm
+          cache: pnpm
 
       - name: Install
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Validate workflows offline
-        run: npm run verify:workflows
+        run: pnpm run verify:workflows
 
       - name: Typecheck, test with coverage, and verify release metadata
-        run: npm run verify
+        run: pnpm run verify
 
       - name: Audit dependency tree
-        run: npm audit --audit-level=high
+        run: pnpm audit --audit-level=high
 
       - name: Inspect publish contents
         run: npm pack --dry-run
@@ -49,20 +54,25 @@ jobs:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+        with:
+          version: 10.34.9
+          run_install: false
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
-          cache: npm
+          cache: pnpm
 
       - name: Install
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Measure guarded pagination
-        run: npm run benchmark:pagination
+        run: pnpm run benchmark:pagination
 
       - name: Enforce pagination regression budget
-        run: npm run benchmark:pagination:enforce
+        run: pnpm run benchmark:pagination:enforce
 
       - name: Upload machine-readable evidence
         if: always()

.github/workflows/release.yml

@@ -22,26 +22,31 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+        with:
+          version: 10.34.9
+          run_install: false
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
-          cache: npm
+          cache: pnpm
 
       - name: Install exact dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Verify version, lockfile, tag, changelog, types, tests, and coverage
         env:
           EXPECTED_RELEASE_TAG: ${{ github.ref_name }}
           VERIFY_RELEASE_TAG: "1"
-        run: npm run verify
+        run: pnpm run verify
 
       - name: Audit production dependency tree
-        run: npm audit --audit-level=high
+        run: pnpm audit --audit-level=high
 
       - name: Enforce benchmark policy
-        run: npm run benchmark
+        run: pnpm run benchmark
 
       - name: Build and inspect package tarball
         id: pack

CONTRIBUTING.md

@@ -15,12 +15,12 @@ mutate live repositories.
 ```bash
 git clone https://github.com/T50-Systems/pi-github-admin.git
 cd pi-github-admin
-npm ci
-npm run typecheck
-npm test
+pnpm install --frozen-lockfile
+pnpm run typecheck
+pnpm test
 ```
 
-Use `npm ci`, rather than `npm install`, when verifying a clean checkout so the
+Use `pnpm install --frozen-lockfile`, rather than `pnpm install --frozen-lockfile`, when verifying a clean checkout so the
 committed lockfile is honored exactly.
 
 ## Development workflow
@@ -34,17 +34,17 @@ committed lockfile is honored exactly.
    and Pi tool registration/schema code in `src/tools.ts`.
 4. Add or update tests under `tests/`.
 5. Run the same checks as CI before committing. Workflow validation is offline
-   after `npm ci`; provenance and pin review are documented in
+   after `pnpm install --frozen-lockfile`; provenance and pin review are documented in
    [`docs/WORKFLOW_VALIDATION.md`](docs/WORKFLOW_VALIDATION.md):
 
    ```bash
-   npm run verify:workflows
-   npm run verify
-   npm audit --audit-level=high
+   pnpm run verify:workflows
+   pnpm run verify
+   pnpm audit --audit-level=high
    npm pack --dry-run
    ```
 
-6. Run `npm run benchmark` for changes to parsing, matching, response shaping, or
+6. Run `pnpm run benchmark` for changes to parsing, matching, response shaping, or
    composite planning and report any material median change.
 7. Follow [`docs/RELEASING.md`](docs/RELEASING.md) for version, changelog, tag,
    and upgrade requirements.
@@ -83,8 +83,8 @@ do not paste `gh auth token` output into an issue or pull request.
 - [ ] The change is linked to an existing issue when one applies.
 - [ ] Mutating behavior supports and tests `dryRun`.
 - [ ] No credentials or sensitive response data are logged or committed.
-- [ ] `npm run verify` passes, beginning with offline workflow validation and then coverage and release metadata checks.
-- [ ] `npm audit --audit-level=high` passes.
+- [ ] `pnpm run verify` passes, beginning with offline workflow validation and then coverage and release metadata checks.
+- [ ] `pnpm audit --audit-level=high` passes.
 - [ ] `npm pack --dry-run` contains only intended publish files.
 - [ ] Performance-sensitive changes include benchmark evidence.
 - [ ] Documentation and examples match the implemented behavior.

README.md

@@ -39,8 +39,8 @@ least-privileged GitHub token.
 ```bash
 git clone https://github.com/T50-Systems/pi-github-admin.git
 cd pi-github-admin
-npm ci
-npm run verify
+pnpm install --frozen-lockfile
+pnpm run verify
 pi install "$(pwd)"
 ```
 
@@ -259,14 +259,14 @@ github_delete_comment({
 ## Development
 
 ```bash
-npm ci
-npm run verify
-npm run benchmark
-npm audit --audit-level=high
+pnpm install --frozen-lockfile
+pnpm run verify
+pnpm run benchmark
+pnpm audit --audit-level=high
 npm pack --dry-run
 ```
 
-`npm run verify` starts with the same offline workflow schema/semantic validation
-available as `npm run verify:workflows`, then runs type checking, tests with coverage
+`pnpm run verify` starts with the same offline workflow schema/semantic validation
+available as `pnpm run verify:workflows`, then runs type checking, tests with coverage
 thresholds, and release metadata validation. See [CONTRIBUTING.md](CONTRIBUTING.md)
 before changing the tool surface.

docs/RELEASING.md

@@ -10,10 +10,10 @@ The project follows semantic versioning and records user-visible changes in `CHA
 4. Run:
 
    ```bash
-   npm ci
-   npm run verify
-   npm run benchmark
-   npm audit --audit-level=high
+   pnpm install --frozen-lockfile
+   pnpm run verify
+   pnpm run benchmark
+   pnpm audit --audit-level=high
    npm pack --dry-run
    node scripts/extract-release-notes.mjs vX.Y.Z
    ```
@@ -44,7 +44,7 @@ The workflow has no npm token and no `npm publish` command. npm publication, if
 ## Manual verification
 
 ```bash
-EXPECTED_RELEASE_TAG=vX.Y.Z VERIFY_RELEASE_TAG=1 npm run verify:release
+EXPECTED_RELEASE_TAG=vX.Y.Z VERIFY_RELEASE_TAG=1 pnpm run verify:release
 node scripts/extract-release-notes.mjs vX.Y.Z release-notes.md
 npm pack --json
 ```