chore: migrate from yarn 1 to pnpm with supply chain hardening (#182)

* chore: migrate from yarn 1 to pnpm with supply chain hardening

- Pin packageManager to pnpm@10.23.0
- Migrate resolutions -> pnpm.overrides
- Add pnpm-workspace.yaml with minimumReleaseAge (7d) and trustPolicy=no-downgrade
- Record husky in ignoredBuiltDependencies (git-hooks only; safe to block in CI)
- Add explicit tslib devDep (previously phantom via yarn hoisting)
- Update CircleCI: bump to cimg/node:22.14.0, corepack bootstrap, cache pnpm store
- Update publish workflow: pnpm/action-setup + pnpm install/build
- Update CONTRIBUTING (pnpm) and README (npm install for consumers)
- Delete yarn.lock; commit pnpm-lock.yaml (versions preserved via pnpm import)

Published package: intentionally no preinstall guard.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: raise Node heap for jest --coverage test step

The Node 22 container exposes a jest-worker OOM on render.test.ts —
that suite instantiates every renderer, and --coverage adds ts-jest
instrumentation on top, blowing past Node's default old-space around
2 GB. Bumping to 4 GB fits the worker; scoped to the CI step so it
does not affect local runs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(readme): list npm, yarn, and pnpm install commands

Avoid constraining consumers to a single package manager. The library
is installable identically under any of them; documenting all three
removes the mental translation step for yarn/pnpm consumers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: pin pnpm binary integrity hash in packageManager

Corepack accepts a "<manager>@<version>+<algo>.<hash>" form. Without
the hash, corepack downloads whatever the registry serves for
pnpm@10.23.0; with it, any tarball that does not hash-match is
refused. Zero-cost tightening of the supply-chain surface — same
version, now cryptographically pinned. Frozen install verified.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Kabidoye-17

.circleci/config.yml

@@ -3,7 +3,7 @@ version: 2
 defaults: &defaults
   working_directory: ~/repo
   docker:
-    - image: circleci/node:12.21
+    - image: cimg/node:22.14.0
 
 jobs:
   test:
@@ -13,34 +13,47 @@ jobs:
 
       - restore_cache:
           keys:
-            - v1-dependencies-{{arch}}-{{ checksum "package.json" }}
-            - v1-dependencies-{{arch}}-
+            - v2-pnpm-{{arch}}-{{ checksum "pnpm-lock.yaml" }}
+            - v2-pnpm-{{arch}}-
+
+      - run:
+          name: Install pnpm via corepack
+          command: |
+            command -v corepack >/dev/null 2>&1 || sudo npm install -g corepack
+            sudo corepack enable
+            sudo corepack prepare --activate
 
       - run:
           name: Verify Socket Firewall registry is active
           command: |
-            REGISTRY=$(npm config get registry)
-            echo "npm registry: $REGISTRY"
-            echo "$REGISTRY" | grep -q socket-firewall-registry || { echo "FAIL: npm not routed through Socket Firewall"; exit 1; }
+            REGISTRY=$(pnpm config get registry)
+            echo "pnpm registry: $REGISTRY"
+            echo "$REGISTRY" | grep -q socket-firewall-registry || { echo "FAIL: pnpm not routed through Socket Firewall"; exit 1; }
 
-      - run: yarn install
+      - run: pnpm install --frozen-lockfile
 
       - save_cache:
-          key: v1-dependencies-{{arch}}-{{ checksum "package.json" }}
+          key: v2-pnpm-{{arch}}-{{ checksum "pnpm-lock.yaml" }}
           paths:
             - node_modules
+            - ~/.local/share/pnpm/store
 
       - run:
           name: Check format
-          command: yarn format:check
+          command: pnpm run format:check
 
       - run:
           name: Run linter
-          command: yarn lint
+          command: pnpm run lint
 
       - run:
           name: Run tests
-          command: yarn test:ci
+          command: pnpm run test:ci
+          environment:
+            # Node 22 exposes a jest+ts-jest+coverage OOM on the render.test.ts
+            # entry point (all renderers instantiated with instrumentation).
+            # Raise old-space from the default so the worker fits.
+            NODE_OPTIONS: --max-old-space-size=4096
 
 workflows:
   version: 2

.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-# CAVEAT: This repo currently publishes via semantic-release (see `npm run semantic-release`
+# CAVEAT: This repo currently publishes via semantic-release (see `pnpm run semantic-release`
 # in package.json and the `release` job in .circleci/config.yml). semantic-release cannot emit
 # `npm stage publish`, so this staged-publishing workflow is NOT yet wired into the live release
 # path. Before adopting it, the semantic-release flow must be reconciled with OIDC staged
@@ -48,13 +48,14 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
         with: { persist-credentials: false }
+      - uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1.0
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
           package-manager-cache: false
-      - run: yarn install --frozen-lockfile
-      - run: yarn build
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
       - run: npm install -g npm@11.15.0    # npm CLI: staged publishing needs npm >= 11.15.0
       - name: Resolve dist-tag (a prerelease must never go to `latest`)
         id: disttag

CONTRIBUTING.md

@@ -24,13 +24,13 @@ This project is a Rollup-based TypeScript NodeJS library. To get the source and
 ```bash
 git clone git@github.com:intercom/contentful-typescript-codegen.git
 cd contentful-typescript-codegen
-yarn install
+pnpm install
 ```
 
 To ensure everything is set up correctly:
 
 ```bash
-yarn test
+pnpm test
 ```
 
 ### Project structure

README.md

@@ -14,7 +14,14 @@ ensure that breaking changes to our Content Types don't cause an outage, and bec
 ## Usage
 
 ```sh
+# npm
+npm install --save-dev contentful-typescript-codegen
+
+# yarn
 yarn add --dev contentful-typescript-codegen
+
+# pnpm
+pnpm add --save-dev contentful-typescript-codegen
 ```
 
 Then, add the following to your `package.json`:

package.json

@@ -7,12 +7,18 @@
     "type": "git",
     "url": "https://github.com/intercom/contentful-typescript-codegen"
   },
-  "resolutions": {
-    "braces": "3.0.3",
-    "ansi-regex": "3.0.1",
-    "minimist": "1.2.6",
-    "micromatch": "4.0.8",
-    "cross-spawn": "7.0.6"
+  "packageManager": "pnpm@10.23.0+sha512.21c4e5698002ade97e4efe8b8b4a89a8de3c85a37919f957e7a0f30f38fbc5bbdd05980ffe29179b2fb6e6e691242e098d945d1601772cad0fef5fb6411e2a4b",
+  "pnpm": {
+    "overrides": {
+      "braces": "3.0.3",
+      "ansi-regex": "3.0.1",
+      "minimist": "1.2.6",
+      "micromatch": "4.0.8",
+      "cross-spawn": "7.0.6"
+    },
+    "ignoredBuiltDependencies": [
+      "husky"
+    ]
   },
   "version": "0.0.1-development",
   "main": "dist/contentful-typescript-codegen.js",
@@ -25,12 +31,12 @@
     "build": "tsc --module commonjs && rollup -c rollup.config.ts && chmod +x dist/contentful-typescript-codegen.js",
     "commit": "git-cz",
     "format": "prettier --write \"**/*.ts\"",
-    "format:check": "npm run format -- --check",
+    "format:check": "pnpm run format -- --check",
     "lint": "tslint --project tsconfig.json -t codeFrame 'src/**/*.ts' 'test/**/*.ts'",
     "start": "rollup -c rollup.config.ts -w",
     "test": "jest --coverage",
     "test:ci": "jest --coverage --max-workers=2 --ci",
-    "test:prod": "npm run lint && npm run test -- --no-cache",
+    "test:prod": "pnpm run lint && pnpm run test -- --no-cache",
     "test:watch": "jest --coverage --watch",
     "semantic-release": "semantic-release"
   },
@@ -73,6 +79,7 @@
     "semantic-release": "^17.4.7",
     "ts-jest": "^26.0.0",
     "ts-node": "^10.6.0",
+    "tslib": "^2.8.1",
     "tslint": "^5.18.0",
     "tslint-config-prettier": "^1.18.0",
     "tslint-config-standard": "^8.0.1",