Migrate to pnpm, upgrade Changesets to v3, and gate the publish step

.github/workflows/ci.yml

@@ -19,22 +19,26 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # Reads the pinned version from package.json "packageManager".
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: yarn
+          cache: pnpm
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Typecheck
-        run: yarn typecheck
+        run: pnpm run typecheck
 
       - name: Run tests
-        run: yarn test
+        run: pnpm run test
 
       # prepack runs this on publish, so a build break would otherwise
       # only surface during the release run, after the merge has landed.
       - name: Build
-        run: yarn build
+        run: pnpm run build

.github/workflows/release.yml

@@ -19,18 +19,19 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Reads the pinned version from package.json "packageManager".
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: yarn
+          cache: pnpm
           registry-url: https://registry.npmjs.org
 
-      - name: Update npm for OIDC trusted publishing
-        run: npm install -g npm@latest
-
       - name: Verify toolchain versions
-        run: node -v && npm -v && yarn -v
+        run: node -v && npm -v && pnpm -v
 
       - name: Print GitHub OIDC identity context
         run: |
@@ -39,16 +40,55 @@ jobs:
           echo "ref=$GITHUB_REF"
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Run tests
-        run: yarn test
+        run: pnpm run test
+
+      # Without this gate, a push to main that carries no changeset still invokes
+      # changesets in publish mode. `npm info` can return stale data right after a
+      # release, so changesets concludes the current version is unpublished, retries
+      # the publish, and npm rejects it with "cannot publish over the previously
+      # published versions" -- failing every non-release merge.
+      - name: Decide whether changesets has work to do
+        id: check
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+
+          has_changeset=false
+          for f in .changeset/*.md; do
+            [ "$(basename "$f")" = "README.md" ] && continue
+            has_changeset=true
+            break
+          done
+
+          if [ "$has_changeset" = true ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "reason=Pending changesets found -> open/update the version PR." >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          name=$(node -p "require('./package.json').name")
+          version=$(node -p "require('./package.json').version")
+
+          if npm view "$name@$version" version >/dev/null 2>&1; then
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "reason=$name@$version is already on npm -> nothing to release." >> "$GITHUB_OUTPUT"
+          else
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "reason=$name@$version is not on npm -> publish." >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Report decision
+        run: echo "${{ steps.check.outputs.reason }}"
 
       - name: Create release PR or publish
+        if: steps.check.outputs.run == 'true'
         uses: changesets/action@v1
         with:
-          version: yarn version-packages
-          publish: yarn release
+          version: pnpm run version-packages
+          publish: pnpm run release
           commit: "chore: version packages"
           title: "chore: version packages"
         env:

.gitignore

@@ -1,11 +1,6 @@
 # Dependencies (if tooling installs locally)
 node_modules/
 
-# This is a yarn project; a pnpm-lock.yaml only appears when a host app runs
-# `pnpm link` inside this checkout. It must not be committed — changesets'
-# package-manager detection picks pnpm over yarn and breaks `release.yml`.
-pnpm-lock.yaml
-
 # Build / cache
 dist/
 build/

AGENTS.md

@@ -2,3 +2,4 @@
 
 - Always use the Changesets process for version bumps (create a changeset and run versioning via Changesets), never manual version edits.
 - Every releasable change must include a `.changeset/*.md` file; do not rely on version/package edits alone.
+- This repo uses **pnpm** (pinned via `packageManager` in `package.json`). Use `pnpm install --frozen-lockfile`, and commit `pnpm-lock.yaml`; do not add a `yarn.lock` or `package-lock.json`.

package.json

@@ -8,12 +8,13 @@
     "url": "https://github.com/ActivistChecklist/react-review-comments"
   },
   "type": "module",
+  "packageManager": "pnpm@10.34.5",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "scripts": {
     "clean": "rm -rf dist",
-    "build": "yarn clean && tsup src/index.ts src/highlightDom.ts server/handler.ts server/collections.ts server/db.ts --format esm --dts --out-dir dist && cp src/rrc.css dist/rrc.css",
-    "prepack": "yarn build",
+    "build": "pnpm run clean && tsup src/index.ts src/highlightDom.ts server/handler.ts server/collections.ts server/db.ts --format esm --dts --out-dir dist && cp src/rrc.css dist/rrc.css",
+    "prepack": "pnpm run build",
     "changeset": "changeset",
     "version-packages": "changeset version",
     "release": "changeset publish",
@@ -48,7 +49,7 @@
     "openseadragon": "^6.0.2"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.31.0",
+    "@changesets/cli": "^3.0.3",
     "@testing-library/dom": "^10.0.0",
     "@testing-library/react": "^16.0.0",
     "@types/node": "^22.10.0",
@@ -65,6 +66,11 @@
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },
+  "pnpm": {
+    "ignoredBuiltDependencies": [
+      "esbuild"
+    ]
+  },
   "sideEffects": [
     "**/*.css"
   ]