Migrated SDK workspace to pnpm (PLA-322)

.github/CONTRIBUTING.md

@@ -52,7 +52,7 @@ Good commit message examples: [one](https://github.com/TryGhost/Ghost/commit/61d
 
 ### Submitting Pull Requests
 
-We aim to merge any straightforward, well-understood bug fixes or improvements immediately, as long as they pass our tests (run `yarn test` to check locally). We generally don’t merge new features and larger changes without prior discussion with the core product team for tech/design specification.
+We aim to merge any straightforward, well-understood bug fixes or improvements immediately, as long as they pass our tests (run `pnpm test` to check locally). We generally don’t merge new features and larger changes without prior discussion with the core product team for tech/design specification.
 
 Please provide plenty of context and reasoning around your changes, to help us merge quickly. Closing an already open issue is our preferred workflow. If your PR gets out of date, we may ask you to rebase as you are more familiar with your changes than we will be.
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,6 +4,6 @@ Please include a description of your change & check your PR against this list, t
 
 - [ ] There's a clear use-case for this code change
 - [ ] Commit message has a short title & references relevant issues
-- [ ] The build will pass (run `yarn test` and `yarn lint`)
+- [ ] The build will pass (run `pnpm test` and `pnpm lint`)
 
 More info can be found by clicking the "guidelines for contributing" link above.

.github/workflows/publish.yml

@@ -37,16 +37,20 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install dependencies
-        run: yarn --prefer-offline --ignore-scripts --frozen-lockfile
+        run: pnpm install --prefer-offline --ignore-scripts --frozen-lockfile
 
       - name: Build all packages
-        run: lerna run build
+        run: pnpm build
 
       - name: Commit build artifacts
         run: |
@@ -55,13 +59,13 @@ jobs:
 
       - name: Publish to npm (dry run)
         if: github.event.inputs['dry-run'] == 'true'
-        run: yarn ship:ci
+        run: pnpm ship:ci
         env:
           NPM_CONFIG_DRY_RUN: true
 
       - name: Publish to npm
         if: github.event.inputs['dry-run'] != 'true'
-        run: yarn ship:ci
+        run: pnpm ship:ci
 
       - uses: tryghost/actions/actions/slack-build@0204421bd3b15725e5b8c606d5d671e9674707ea
         if: failure()

.github/workflows/test.yml

@@ -1,12 +1,50 @@
 name: Test
+
 on:
   pull_request:
   push:
     branches:
       - main
       - 'renovate/*'
+
+permissions:
+  contents: read
+
 jobs:
-  test:
-    uses: tryghost/actions/.github/workflows/test.yml@22030a4f6255c29d15cb420287e68454a010e926 # main
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  build:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && !startsWith(github.head_ref, 'renovate/'))
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [20, 22]
+    env:
+      FORCE_COLOR: 1
+    name: Node ${{ matrix.node }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        env:
+          FORCE_COLOR: 0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile --prefer-offline
+      - run: pnpm test
+
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+      - uses: tryghost/actions/actions/slack-build@22030a4f6255c29d15cb420287e68454a010e926 # main
+        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        with:
+          status: ${{ job.status }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

.gitignore

@@ -4,8 +4,7 @@
 logs
 *.log
 npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
+pnpm-debug.log*
 
 # Runtime data
 pids
@@ -53,9 +52,6 @@ typings/
 # Output of 'npm pack'
 *.tgz
 
-# Yarn Integrity file
-.yarn-integrity
-
 # dotenv environment variables file
 .env
 

CLAUDE.md

@@ -4,39 +4,39 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Repository Overview
 
-The Ghost SDK is a monorepo containing a collection of JavaScript/TypeScript packages for interacting with Ghost's APIs. It uses Lerna for monorepo management and Yarn workspaces.
+The Ghost SDK is a monorepo containing a collection of JavaScript/TypeScript packages for interacting with Ghost's APIs. It uses Lerna for monorepo management and pnpm workspaces.
 
 ## Common Development Commands
 
 ### Setup & Installation
-- **Initial setup**: `yarn setup` (mapped to `lerna bootstrap`)
+- **Initial setup**: `corepack enable && pnpm setup`
   - Installs all external dependencies
   - Links all internal dependencies
-- **Install dependencies**: `yarn`
+- **Install dependencies**: `pnpm install`
 
 ### Testing
-- **Run all tests**: `yarn test` (runs `lerna run test`)
+- **Run all tests**: `pnpm test` (runs `lerna run test`)
   - This runs tests in all packages
-- **Run tests in specific package**: `cd packages/<package-name> && yarn test`
+- **Run tests in specific package**: `pnpm --dir packages/<package-name> test`
 - **Run tests with coverage**: Most packages use `NODE_ENV=testing c8 --all --reporter text --reporter cobertura mocha './test/**/*.test.js'`
 - **Run specific test file**: `NODE_ENV=testing mocha './test/specific.test.js'`
 - **Run tests matching pattern**: `NODE_ENV=testing mocha './test/**/*.test.js' --grep "pattern"`
 
 ### Linting
-- **Run all linters**: `yarn lint` (runs `lerna run lint`)
-- **Run linter in specific package**: `cd packages/<package-name> && yarn lint`
-- **Fix linting issues**: `yarn lint -- --fix`
+- **Run all linters**: `pnpm lint` (runs `lerna run lint`)
+- **Run linter in specific package**: `pnpm --dir packages/<package-name> lint`
+- **Fix linting issues**: `pnpm lint -- --fix`
 
 ### Building
 - **Build packages with build scripts**: Individual packages have their own build commands
-  - For packages with Rollup: `yarn build`
+  - For packages with Rollup: `pnpm build`
   - TypeScript packages: Check for `tsconfig.json` and build scripts
 
 ### Publishing
-- **Version packages**: `yarn ship` (runs `lerna version`) — runs tests, prompts for version bumps, and pushes the version commit to `main`
+- **Version packages**: `pnpm ship` (runs `lerna version`) — runs tests, prompts for version bumps, and pushes the version commit to `main`
   - CI automatically publishes the updated packages to npm via the `publish.yml` workflow
-  - Use `yarn ship --git-remote upstream` when `origin` points to a fork and `upstream` points to the original TryGhost/SDK repo
-- **CI publish** (used by CI only): `yarn ship:ci` (runs `lerna publish from-package`)
+  - Use `GHOST_UPSTREAM=upstream pnpm ship` when `origin` points to a fork and `upstream` points to the original TryGhost/SDK repo
+- **CI publish** (used by CI only): `pnpm ship:ci` (runs `lerna publish from-package`)
 
 ## Package Structure
 
@@ -101,7 +101,7 @@ Different packages use different build systems:
 
 ### Rollup-based packages
 - **content-api**, **timezone-data**, **helpers**, **color-utils**
-- Build command: `yarn build`
+- Build command: `pnpm build`
 - Configuration: `rollup.config.js`
 - Outputs: `cjs/`, `es/`, `umd/` directories
 
@@ -116,7 +116,8 @@ Different packages use different build systems:
 
 ## Important Notes
 
-- This is a Yarn workspaces monorepo - always use `yarn`, not `npm`
+- This is a pnpm workspaces monorepo. Use the exact pnpm version declared in `packageManager` via Corepack.
+- Dependency install scripts are denied unless reviewed in the root `pnpm.allowBuilds` map. Any `true` approval must be security-reviewed and scoped to the exact package version.
 - The main branch is `main` for pull requests
 - All packages are published under the `@tryghost` scope
 - Packages have independent versioning
@@ -150,7 +151,7 @@ Different packages use different build systems:
 ## Development Tips
 
 1. Run tests before committing
-2. Use `yarn lint` to check code style
+2. Use `pnpm lint` to check code style
 3. Follow existing patterns in the codebase
 4. Add tests for new functionality
 5. Update README.md in package directory for significant changes

README.md

@@ -4,10 +4,11 @@ A collection of tools for interacting with Ghost's APIs.
 
 ## Develop
 
-This is a mono repository, managed with [lerna](https://lerna.js.org/).
+This is a monorepo managed with [Lerna](https://lerna.js.org/) and pnpm workspaces.
 
 1. `git clone` this repo & `cd` into it as usual
-2. `yarn setup` is mapped to `lerna bootstrap`
+2. Enable Corepack with `corepack enable`
+3. Run `pnpm setup`
    - installs all external dependencies
    - links all internal dependencies
 
@@ -16,22 +17,22 @@ To add a new package to the repo:
 
 ## Run
 
-- `yarn dev`
+- `pnpm dev`
 
 ## Test
 
-- `yarn lint` run just eslint
-- `yarn test` run lint and tests
+- `pnpm lint` runs just ESLint
+- `pnpm test` runs lint and tests
 
 
 ## Publish
 
 Ghost core team only.
 
-1. Run `yarn ship` in the top-level SDK directory — this runs tests, prompts for version bumps, and pushes the version commit to `main`
+1. Run `pnpm ship` in the top-level SDK directory — this runs tests, prompts for version bumps, and pushes the version commit to `main`
 2. CI automatically publishes the updated packages to npm via the `publish.yml` workflow
 
-NOTE: use `yarn ship --git-remote upstream` to correctly update tags and version commits, when your remote `origin` is set up to a fork of TryGhost/SDK and original repository is set to `upstream`.
+NOTE: use `GHOST_UPSTREAM=upstream pnpm ship` to correctly update tags and version commits when your remote `origin` is set up to a fork of TryGhost/SDK and the original repository is set to `upstream`.
 
 # Copyright & License
 

lerna.json

@@ -1,6 +1,6 @@
 {
     "version": "independent",
-    "npmClient": "yarn",
+    "npmClient": "pnpm",
     "packages": ["packages/*"],
     "command": {
         "version": {

package.json

@@ -1,5 +1,6 @@
 {
   "private": true,
+  "packageManager": "pnpm@10.34.5+sha512.a4ee05f2f73658255bd6a89859c065a45c28a57daefae2c893a168ee2b73168c37b91e83e57ea67654ad03f03031746430e8bce38e362e042605fb8abc80192e",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/TryGhost/SDK.git"
@@ -14,13 +15,22 @@
   ],
   "scripts": {
     "dev": "echo \"Implement me!\"",
-    "setup": "yarn install",
+    "setup": "pnpm install",
+    "build": "lerna run build",
     "test": "lerna run lint && lerna run test",
     "lint": "lerna run lint",
-    "preship": "yarn test",
+    "preship": "pnpm test",
     "ship": "lerna version --git-remote ${GHOST_UPSTREAM:-origin}",
     "ship:ci": "lerna publish from-package --yes --no-private"
   },
+  "pnpm": {
+    "allowBuilds": {
+      "core-js": false,
+      "lmdb": false,
+      "msgpackr-extract": false,
+      "nx": false
+    }
+  },
   "devDependencies": {
     "eslint": "8.57.1",
     "eslint-plugin-ghost": "3.5.0",

packages/admin-api/README.md

@@ -22,18 +22,18 @@ This is a mono repository, managed with [lerna](https://lerna.js.org/).
 
 Follow the instructions for the top-level repo.
 1. `git clone` this repo & `cd` into it as usual
-2. Run `yarn` to install top-level dependencies.
+2. Run `pnpm install` to install top-level dependencies.
 
 
 ## Run
 
-- `yarn dev`
+- `pnpm dev`
 
 
 ## Test
 
-- `yarn lint` run just eslint
-- `yarn test` run lint and tests
+- `pnpm lint` run just eslint
+- `pnpm test` run lint and tests
 
 
 

packages/admin-api/package.json

@@ -20,7 +20,7 @@
     "dev": "echo \"Implement me!\"",
     "test": "NODE_ENV=testing c8 --reporter text --reporter cobertura mocha './test/**/*.test.js'",
     "lint": "eslint . --ext .js --cache",
-    "posttest": "yarn lint"
+    "posttest": "pnpm lint"
   },
   "publishConfig": {
     "access": "public"

packages/color-utils/README.md

@@ -18,18 +18,18 @@ This is a mono repository, managed with [lerna](https://lernajs.io/).
 
 Follow the instructions for the top-level repo.
 1. `git clone` this repo & `cd` into it as usual
-2. Run `yarn` to install top-level dependencies.
+2. Run `pnpm install` to install top-level dependencies.
 
 
 ## Run
 
-- `yarn dev`
+- `pnpm dev`
 
 
 ## Test
 
-- `yarn lint` run just eslint
-- `yarn test` run lint and tests
+- `pnpm lint` run just eslint
+- `pnpm test` run lint and tests
 
 
 

packages/color-utils/package.json

@@ -19,8 +19,8 @@
     "test": "NODE_ENV=testing c8 --src cjs --reporter text --reporter cobertura mocha './test/**/*.test.js'",
     "build": "rollup -c && tsc --declaration --emitDeclarationOnly --declarationDir ./types",
     "lint": "eslint . --ext .js --cache",
-    "prepare": "NODE_ENV=production yarn build",
-    "posttest": "yarn lint"
+    "prepare": "NODE_ENV=production pnpm build",
+    "posttest": "pnpm lint"
   },
   "files": [
     "LICENSE",

packages/config-url-helpers/README.md

@@ -18,18 +18,18 @@ This is a mono repository, managed with [lerna](https://lernajs.io/).
 
 Follow the instructions for the top-level repo.
 1. `git clone` this repo & `cd` into it as usual
-2. Run `yarn` to install top-level dependencies.
+2. Run `pnpm install` to install top-level dependencies.
 
 
 ## Run
 
-- `yarn dev`
+- `pnpm dev`
 
 
 ## Test
 
-- `yarn lint` run just eslint
-- `yarn test` run lint and tests
+- `pnpm lint` run just eslint
+- `pnpm test` run lint and tests
 
 
 

packages/config-url-helpers/package.json

@@ -15,7 +15,7 @@
     "test": "NODE_ENV=testing c8 --reporter text --reporter cobertura mocha './test/**/*.test.js'",
     "coverage": "c8 report -r html",
     "lint": "eslint . --ext .js --cache",
-    "posttest": "yarn lint"
+    "posttest": "pnpm lint"
   },
   "files": [
     "index.js",

packages/content-api/README.md

@@ -13,7 +13,7 @@ This is a mono repository, managed with [lerna](https://lernajs.io/).
 
 Follow the instructions for the top-level repo.
 1. `git clone` this repo & `cd` into it as usual
-2. Run `yarn` to install top-level dependencies.
+2. Run `pnpm install` to install top-level dependencies.
 
 
 # Copyright & License