Zoltan KochanandClaude Opus 5.5
82e235bacf
* chore: move supply-chain settings to a protected config file Use the `include` setting from pnpm 12.15 to move the settings that decide what gets installed and what may run into .config/pnpm/security.yaml: allowBuilds, auditConfig, the minimumReleaseAge and trustPolicy settings, overrides, packageExtensions, patchedDependencies, patchesDir, and registries. pnpm-workspace.yaml delegates exactly that list, so no other file can define those settings. Patch paths are relative to the included file. pnpm 12.14 ignores `include` and would drop every moved setting, so the packageManager pin moves to 12.15.0. CODEOWNERS now names both workspace files, the pnpmfile, and the patches explicitly, and the CI path filters watch the new file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move routine settings to a file without a code owner The catalog, the update settings, and the task-runner settings (pipelines, tasks, concurrencyGroups) move to .config/pnpm/routine.yaml, which CODEOWNERS leaves unowned. Because pnpm-workspace.yaml delegates only that list to the file, any other setting defined there fails with ERR_PNPM_SETTING_NOT_DELEGATED, so the file cannot be used to change the protected settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move the catalogs to their own file .config/pnpm/catalog.yaml owns `catalogs`, which covers the default catalog and any named catalog added later. Like routine.yaml, it has no code owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: name the protected file policies.yaml and give tasks their own file security.yaml becomes policies.yaml. The task-runner settings (pipelines, tasks, concurrencyGroups) move to tasks.yaml, and `update` joins the catalogs in catalog.yaml, since its ignoreDeps list holds back catalog entries. routine.yaml is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move catalogMode and catalogPrune to catalog.yaml Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: keep the patch list next to the patches patchedDependencies and patchesDir move to __patches__/patches.yaml, so the entries name the patch files without a directory prefix and patchesDir is `.`. CODEOWNERS already covers __patches__/. The CI path filters that did not watch __patches__/ now watch patches.yaml, since they watched the patch list when it lived in pnpm-workspace.yaml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move the patches to .config/pnpm/patches Every pnpm configuration file now lives under .config/pnpm, so each CI path filter watches `.config/pnpm/**` instead of listing the files. CODEOWNERS keeps the patches protected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
160 lines
4.4 KiB
YAML
160 lines
4.4 KiB
YAML
packages:
|
|
- .meta-updater
|
|
- pnpm11/__typecheck__
|
|
- pnpm11/__typings__
|
|
- pnpm11/__utils__/*
|
|
- '!pnpm11/__utils__/build-artifacts'
|
|
- pnpm11/auth/*
|
|
- pnpm11/building/*
|
|
- pnpm11/cache/*
|
|
- pnpm11/catalogs/*
|
|
- pnpm11/cli/*
|
|
- pnpm11/config/*
|
|
- pnpm11/crypto/*
|
|
- pnpm11/installing/dedupe/*
|
|
- pnpm11/deps/*
|
|
- pnpm11/deps/compliance/*
|
|
- pnpm11/deps/inspection/*
|
|
- pnpm11/deps/security/*
|
|
- pnpm11/engine/*
|
|
- pnpm11/engine/pm/*
|
|
- pnpm11/engine/runtime/*
|
|
- pnpm11/exec/*
|
|
- pnpm11/fetching/*
|
|
- pnpm11/fs/*
|
|
- pnpm11/global/*
|
|
- pnpm11/hooks/*
|
|
- pnpm11/lockfile/*
|
|
- pnpm11/log/*
|
|
- pnpm11/network/*
|
|
- pnpm11/modules-mounter/*
|
|
- pnpm11/object/*
|
|
- pnpm11/os/env/*
|
|
- pnpm11/core/*
|
|
- pnpm11/bins/*
|
|
- pnpm11/installing/*
|
|
- pnpm11/installing/linking/*
|
|
- pnpm11/pkg-manifest/*
|
|
- pnpm11/patching/*
|
|
- pnpm11/pnpm
|
|
- pnpm11/pnpm/dev
|
|
- pnpm11/testing/*
|
|
- pnpm11/worker
|
|
- pnpm11/pnpm/artifacts/*
|
|
- pnpr/client
|
|
- pnpm11/registry-access/*
|
|
- pnpm11/releasing/*
|
|
- pnpm11/resolving/*
|
|
- pnpm11/resolving/registry/*
|
|
- pnpm11/shell/*
|
|
- pnpm11/store/*
|
|
- pnpm11/text/*
|
|
- pnpm11/workspace/*
|
|
- pnpm11/yaml/*
|
|
- pnpm/npm/napi
|
|
- pnpm/esm-loader
|
|
- pnpm/npm/pnpm
|
|
- pnpm/tasks/registry-mock
|
|
- pnpm/tasks/ecosystem-e2e/webcontainer
|
|
- pnpm/wasm
|
|
- pnpr/npm/pnpr
|
|
- pnpr/npm/pnpr-ui
|
|
- '!vendor/**'
|
|
- '!bench-work-env/**'
|
|
- '!**/example/**'
|
|
- '!**/test/**'
|
|
- '!pnpm11/resolving/local-resolver/example-package/**'
|
|
|
|
include:
|
|
./.config/pnpm/policies.yaml:
|
|
- allowBuilds
|
|
- auditConfig
|
|
- minimumReleaseAge
|
|
- minimumReleaseAgeExclude
|
|
- minimumReleaseAgeExcludePrune
|
|
- overrides
|
|
- packageExtensions
|
|
- registries
|
|
- trustPolicy
|
|
- trustPolicyExclude
|
|
- trustPolicyExcludePrune
|
|
- trustPolicyIgnoreAfter
|
|
./.config/pnpm/patches/patches.yaml:
|
|
- patchedDependencies
|
|
- patchesDir
|
|
./.config/pnpm/catalog.yaml:
|
|
- catalogMode
|
|
- catalogPrune
|
|
- catalogs
|
|
- update
|
|
./.config/pnpm/tasks.yaml:
|
|
- concurrencyGroups
|
|
- pipelines
|
|
- tasks
|
|
|
|
# Native workspace release management (consumed by `pnpm change` / `pnpm version -r`).
|
|
# The Rust CLI wrapper is the workspace package `pacquet` (published to npm as
|
|
# `pnpm`); generate-packages.mjs rewrites the name at pack time.
|
|
versioning:
|
|
# @pnpm/logger is a workspace package, but every consumer depends on the
|
|
# published one through the `^1100.0.0` catalog entry (a `catalog:` peer, kept
|
|
# deliberately so Jest loads the published CJS-bole logger — see the `bole`
|
|
# note in the catalog). The release engine would otherwise reject those
|
|
# catalog: peers as internal ranges that must use the workspace: protocol, so
|
|
# freeze @pnpm/logger from the automated release: it is bumped out of band.
|
|
ignore:
|
|
- '@pnpm/logger'
|
|
# Groups that always release together at one shared version:
|
|
# - the Rust CLI wrapper and its NAPI addon;
|
|
# - the pnpr wrapper and the web UI it serves;
|
|
# - the pnpm CLI with its prebuilt executable (@pnpm/exe) and the
|
|
# per-platform binary packages under pnpm11/pnpm/artifacts/. Those ship the
|
|
# same build and must carry the CLI's exact version.
|
|
fixed:
|
|
- [ 'pacquet', '@pnpm/napi' ]
|
|
- [ '@pnpm/pnpr', '@pnpm/pnpr-ui' ]
|
|
- [ 'pnpm', '@pnpm/exe', '@pnpm/macos-arm64', '@pnpm/linux-arm64', '@pnpm/linux-x64', '@pnpm/linuxstatic-x64', '@pnpm/win-arm64', '@pnpm/win-x64' ]
|
|
# The TypeScript CLI (`pnpm`) leads an epic that bands every library package
|
|
# under pnpm11/ to the CLI's major: while `pnpm` is on major 11 the libraries
|
|
# live in majors 1100-1199. Members move independently inside the band (patch,
|
|
# minor, and an in-band major); the release engine rejects a bump that would
|
|
# carry one past the band ceiling, and re-bases every member to the next band
|
|
# floor when the CLI crosses to a new stable major. The built release
|
|
# artifacts under pnpm11/pnpm/artifacts/ are excluded from the band — they ride
|
|
# the CLI's exact version through the fixed group above.
|
|
epics:
|
|
- lead: pnpm
|
|
packages:
|
|
- './pnpm11/**'
|
|
- '!./pnpm11/pnpm/artifacts/**'
|
|
lanes:
|
|
'@pnpm/pnpr': alpha
|
|
'@pnpm/pnpr-ui': alpha
|
|
|
|
cargo:
|
|
enabled: true
|
|
|
|
enablePrePostScripts: false
|
|
|
|
engineStrict: false
|
|
|
|
gitChecks: false
|
|
|
|
hoistPattern:
|
|
- jest-runner
|
|
|
|
lockfile:
|
|
includeResolutionSettings: true
|
|
|
|
nodeVersion: 22.13.0
|
|
|
|
publishBranch: main
|
|
|
|
resolutionMode: lowest-direct
|
|
|
|
savePrefix: ''
|
|
|
|
virtualStoreType: global
|
|
|
|
autoDedupe: true
|