[PF-1993] Migrate from Yarn 1 to pnpm 10

.eslintrc.js

@@ -40,7 +40,7 @@ const generateSameSettingRules = (ruleNames, setting) => {
 
 module.exports = {
   extends: [
-    './node_modules/@toptal/davinci-syntax/src/configs/.eslintrc.cjs',
+    require.resolve('@toptal/davinci-syntax/src/configs/.eslintrc.cjs'),
     'plugin:ssr-friendly/recommended',
   ],
   plugins: ['ssr-friendly', 'eslint-plugin-local-rules'],

.github/actions/build-publish-alpha-package/action.yml

@@ -27,11 +27,11 @@ runs:
         registry-url: 'https://registry.npmjs.org'
 
     - name: Install dependencies
-      uses: ./.github/actions/yarn-install
+      uses: ./.github/actions/pnpm-install
 
     - name: Build package
       shell: bash
-      run: yarn build:package
+      run: pnpm build:package
 
     - name: Publish packages
       id: publish-package
@@ -41,7 +41,7 @@ runs:
         ROOT_FOLDER: ${{ inputs.root-folder }}
         NPM_CONFIG_PROVENANCE: true
       run: |
-        npx davinci-engine publish-package \
+        pnpm exec davinci-engine publish-package \
           --alpha \
           --outputVersion .version \
           --useNxForAlphaPublishing \

.github/actions/build-publish-updated-package/action.yml

@@ -17,12 +17,12 @@ runs:
         registry-url: 'https://registry.npmjs.org'
 
     - name: Install dependencies
-      uses: ./.github/actions/yarn-install
+      uses: ./.github/actions/pnpm-install
 
     - name: Publish to npm
       # Same as changesets/action@v1.5.3
       uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba
       with:
-        publish: yarn release
+        publish: pnpm release
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}

.github/actions/danger/action.yml

@@ -20,4 +20,4 @@ runs:
         # for other purposes beyond communicating with the GitHub API. 
         # The DANGER_GITHUB_API_BASE_URL env variable takes higher priority 
         DANGER_GITHUB_API_BASE_URL: https://api.github.com
-      run: yarn davinci-ci danger
+      run: pnpm davinci-ci danger

.github/actions/get-changeset-info/README.md

@@ -47,10 +47,10 @@ bash .github/build-actions.sh
 - Build this action only:
 
 ```bash
-yarn ncc build .github/actions/get-changeset-info/index.js -o .github/actions/get-changeset-info/dist
+pnpm exec ncc build .github/actions/get-changeset-info/index.js -o .github/actions/get-changeset-info/dist
 git add .github/actions/get-changeset-info/dist
 ```
 
 Notes:
-- Ensure dependencies are installed at repo root (`yarn install`).
-- `@vercel/ncc` is available via `yarn ncc` (declared in root devDependencies).
+- Ensure dependencies are installed at repo root (`pnpm install`).
+- `@vercel/ncc` is available via `pnpm exec ncc` (declared in root devDependencies).

.github/actions/integration-tests/README.md

@@ -6,7 +6,7 @@ Action to conduct integration tests in a project using Cypress.
 
 Action to conduct integration tests in a project using Cypress.
 
-By default it executes `yarn test:integration:ci` command.
+By default it executes `pnpm test:integration:ci` command.
 
 ### Inputs
 

.github/actions/integration-tests/action.yml

@@ -15,7 +15,7 @@ runs:
       uses: actions/cache@v4
       with:
         path: '~/.cache/Cypress'
-        key: cypress-${{ hashFiles('**/yarn.lock') }}
+        key: cypress-${{ hashFiles('**/pnpm-lock.yaml') }}
 
     - name: Find Cypress cache folder
       id: cypress
@@ -27,13 +27,13 @@ runs:
     - name: Get Cypress binary
       if: ${{ steps.cache.outputs.cache-hit != 'true' && steps.cypress.outputs.exists != 'true' }}
       shell: bash
-      run: npx cypress install
+      run: pnpm exec cypress install
 
     - name: Run Cypress tests
       shell: bash
       env:
         COMMAND: ${{ inputs.command }}
-      run: yarn $COMMAND
+      run: pnpm $COMMAND
 
     - name: Store Cypress Screenshots Artifact
       uses: actions/upload-artifact@v4

.github/actions/pnpm-install/action.yml

@@ -0,0 +1,77 @@
+name: Install dependencies
+description: Install and cache node modules with pnpm
+inputs:
+  npm-token:
+    description: Access token type **Read-only**. Required for repository with private dependencies. If undefined, `env.NPM_TOKEN` is used
+    required: false
+  cache-version:
+    description: "Cache version"
+    default: "0.0"
+    required: false
+  path:
+    description: Relative path under $GITHUB_WORKSPACE where to run `pnpm install` command
+    default: .
+    required: false
+  max-attempts:
+    description: How many times to retry installing. Useful when package builds fail due to flaky network connections
+    default: "1"
+    required: false
+  pnpm-version:
+    description: Explicit pnpm version to install via corepack. If omitted, corepack reads the `packageManager` field from `package.json`
+    required: false
+outputs:
+  cache-hit:
+    description: "Indicates an exact match was found for the pnpm store || boolean"
+    value: ${{ steps.pnpm-store-cache.outputs.cache-hit }}
+runs:
+  using: composite
+  steps:
+    - name: Set node version
+      id: set-node-version
+      run: echo version=$(node -v) >> $GITHUB_OUTPUT
+      shell: bash
+
+    - name: Enable corepack and activate pnpm
+      shell: bash
+      working-directory: ${{ inputs.path }}
+      run: |
+        corepack enable
+        if [ -n "${{ inputs.pnpm-version }}" ]; then
+          corepack prepare pnpm@${{ inputs.pnpm-version }} --activate
+        elif ! grep -q '"packageManager"' package.json 2>/dev/null; then
+          echo "::error::Neither pnpm-version input nor packageManager field in package.json is set."
+          exit 1
+        fi
+
+    - name: Get pnpm store path
+      id: pnpm-store
+      shell: bash
+      working-directory: ${{ inputs.path }}
+      run: echo "path=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+    - name: Cache pnpm store
+      uses: actions/cache@v4
+      id: pnpm-store-cache
+      with:
+        path: ${{ steps.pnpm-store.outputs.path }}
+        key: ${{ runner.os }}-${{ runner.arch }}-node-${{ steps.set-node-version.outputs.version }}-pnpm-store-${{ hashFiles(format('{0}/pnpm-lock.yaml', inputs.path)) }}-${{ inputs.cache-version }}
+        restore-keys: |
+          ${{ runner.os }}-${{ runner.arch }}-node-${{ steps.set-node-version.outputs.version }}-pnpm-store-
+
+    - name: pnpm install
+      shell: bash
+      working-directory: ${{ inputs.path }}
+      env:
+        NPM_TOKEN: ${{ inputs.npm-token || env.NPM_TOKEN }}
+        MAX_ATTEMPTS: ${{ inputs.max-attempts }}
+      run: |
+        for ((i=1; i<=MAX_ATTEMPTS; i++)); do
+          echo "Trying to install (${i}/${MAX_ATTEMPTS})..."
+          if pnpm install --frozen-lockfile; then
+            echo "pnpm install succeeded on attempt ${i}."
+            exit 0
+          fi
+          sleep 10
+        done
+        echo "All installation attempts failed. Exiting with error."
+        exit 1

.github/actions/report-missing-changeset/README.md

@@ -49,10 +49,10 @@ bash .github/build-actions.sh
 - Build this action only:
 
 ```bash
-yarn ncc build .github/actions/report-missing-changeset/index.js -o .github/actions/report-missing-changeset/dist
+pnpm exec ncc build .github/actions/report-missing-changeset/index.js -o .github/actions/report-missing-changeset/dist
 git add .github/actions/report-missing-changeset/dist
 ```
 
 Notes:
-- Ensure dependencies are installed at repo root (`yarn install`).
-- `@vercel/ncc` is available via `yarn ncc` (declared in root devDependencies).
+- Ensure dependencies are installed at repo root (`pnpm install`).
+- `@vercel/ncc` is available via `pnpm exec ncc` (declared in root devDependencies).

.github/build-actions.sh

@@ -4,8 +4,8 @@ set -euo pipefail
 
 ACTIONS_DIR=".github/actions"
 
-if ! command -v yarn >/dev/null 2>&1; then
-  echo "yarn is required but not found in PATH" >&2
+if ! command -v pnpm >/dev/null 2>&1; then
+  echo "pnpm is required but not found in PATH" >&2
   exit 1
 fi
 
@@ -14,7 +14,7 @@ find "$ACTIONS_DIR" -mindepth 2 -maxdepth 2 -type f -name index.js | while read
   out_dir="$action_root/dist"
   echo "Building Node action at $action_root"
   rm -rf "$out_dir"
-  yarn ncc build "$entry" -o "$out_dir"
+  pnpm exec ncc build "$entry" -o "$out_dir"
   git add "$out_dir"
 done
 

.github/workflows/ci.yaml

@@ -52,30 +52,35 @@ jobs:
       # Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable
       # packages will be blocked from merging.
       - name: Dependency Review
+        # Skip on the pnpm migration PR: GitHub's dependency-graph compare
+        # API returns 502 when diffing yarn.lock <-> pnpm-lock.yaml. Once
+        # this branch lands, master will have pnpm-lock.yaml and subsequent
+        # PRs will diff cleanly. Tracked in actions/dependency-review-action#398.
+        if: ${{ github.head_ref != 'bill-migrate-to-pnpm' }}
         uses: actions/dependency-review-action@v4
 
       - name: Install Dependencies
-        uses: ./.github/actions/yarn-install
+        uses: ./.github/actions/pnpm-install
 
       - name: Update PR Body
         run: node ./.github/actions/update-body.js
         env:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Syncpack check
-        run: yarn syncpack:list
+        run: pnpm syncpack:list
 
       - name: Circularity Check
-        run: yarn circularity
+        run: pnpm circularity
 
       - name: Lint
-        run: yarn lint
+        run: pnpm lint
 
       - name: Type Check
-        run: yarn typecheck
+        run: pnpm typecheck
 
       - name: Jest Tests
-        run: yarn test:unit:ci
+        run: pnpm test:unit:ci
 
   storybook-visual-tests:
     if: ${{ github.event.pull_request.head.ref != 'changeset-release/master' }}
@@ -96,10 +101,10 @@ jobs:
           node-version: 22.20.0
 
       - name: Install dependencies from cache
-        uses: ./.github/actions/yarn-install
+        uses: ./.github/actions/pnpm-install
 
       - name: Visual Tests
-        run: yarn happo:storybook
+        run: pnpm happo:storybook
         env:
           HAPPO_PROJECT: Picasso/Storybook
           HAPPO_API_KEY: ${{ secrets.HAPPO_API_KEY }}
@@ -137,19 +142,19 @@ jobs:
           node-version: 22.20.0
 
       - name: Install dependencies from cache
-        uses: ./.github/actions/yarn-install
+        uses: ./.github/actions/pnpm-install
 
       - name: Setup GitHub Pages content
         uses: ./.github/actions/setup-gh-pages
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build Storybook
-        run: yarn build:storybook
+        run: pnpm build:storybook
 
       - name: Generate LLM docs
         run: |
-          yarn generate:llm-docs
+          pnpm generate:llm-docs
           cp -r llm-docs build/storybook/llm-docs
 
       - name: Prepare PR preview deployment

.github/workflows/danger.yaml

@@ -34,6 +34,6 @@ jobs:
         with:
           node-version: 22.20.0
 
-      - uses: ./.github/actions/yarn-install
+      - uses: ./.github/actions/pnpm-install
 
       - uses: ./.github/actions/danger