[FE-3214] chore: migrate from npm to pnpm with supply chain hardening

.github/workflows-disabled/fern_check.yml

@@ -13,8 +13,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Install Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Check API is valid
         run: fern check

.github/workflows-disabled/generate_postman_collection.yml

@@ -12,16 +12,18 @@ jobs:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 2
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: "pnpm"
       - name: "Create env file"
         run: |
           touch .env
           echo POSTMAN_API_KEY=${{  secrets.POSTMAN_API_KEY }} >> .env
           echo POSTMAN_WORKSPACE_ID=${{  secrets.POSTMAN_WORKSPACE_ID }} >> .env
           echo ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true >> .env
-      - run: npm install
+      - run: pnpm install --frozen-lockfile
       - name: Changed Files
         id: changed-files
         uses: step-security/changed-files@v45

.github/workflows-disabled/java-sdk.yml

@@ -18,8 +18,11 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v4
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Release SDKs
         env:

.github/workflows-disabled/php-sdk.yml

@@ -18,8 +18,11 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v4
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Release SDKs
         env:

.github/workflows-disabled/preview_sdks.yml

@@ -15,8 +15,11 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v6
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Generate Preview
         env:
@@ -50,8 +53,11 @@ jobs:
           java-version: "11"
           architecture: x64
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Generate Preview
         env:
@@ -81,8 +87,11 @@ jobs:
         run: |
           curl -sSL https://install.python-poetry.org | python - -y --version 1.5.1
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Generate Preview
         env:
@@ -110,8 +119,11 @@ jobs:
         with:
           php-version: "8.1"
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Generate Preview
         env:

.github/workflows-disabled/python-sdk.yml

@@ -18,8 +18,11 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v4
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Release SDKs
         env:

.github/workflows-disabled/ts-sdk.yml

@@ -18,8 +18,11 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v4
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0
+
       - name: Download Fern
-        run: npm install -g fern-api
+        run: pnpm add -g fern-api@5.65.3
 
       - name: Release SDKs
         env:

CLAUDE.md

@@ -31,17 +31,19 @@ postman/                     # Postman collection outputs
 ## Development
 
 ```bash
-npm install
+pnpm install
 ```
 
 No dev server, no test suite, no linting commands. Validation is done via Fern:
 
 ```bash
-npm install -g fern-api
+pnpm add -g fern-api@5.65.3
 fern check                              # Validate spec
 fern generate --preview --group ts-sdk  # Preview SDK generation
 ```
 
+> The `fern-api` version is pinned because Intercom's Socket Firewall registry serves the `fern-api` manifest without a `dist-tags` block, and pnpm has no fallback resolver for a missing `latest` tag ([pnpm/pnpm#5564](https://github.com/pnpm/pnpm/issues/5564), [pnpm/pnpm#9944](https://github.com/pnpm/pnpm/issues/9944)). Bump the version here when a new Fern release is needed.
+
 ## CI/CD (GitHub Actions)
 
 | Workflow | Trigger | What it does |

CONTRIBUTING.md

@@ -23,7 +23,7 @@ If you're making changes to the OpenAPI spec, you can use the Fern CLI to valida
 #### Installation
 
 ```bash
-npm install -g fern-api
+pnpm add -g fern-api@5.65.3
 ```
 
 #### Common Commands