chore: standardise website/ on npm and delete the duplicate lockfiles

.github/workflows/pr-build-website.yml

@@ -11,6 +11,10 @@ on:
       - main
     paths:
       - "website/**"
+      - "package-lock.json"
+      - "yarn.lock"
+      - "**/yarn.lock"
+      - "**/pnpm-lock.yaml"
       - ".github/workflows/pr-build-website.yml"
 
 permissions:
@@ -30,6 +34,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Guard against duplicate lockfiles
+        working-directory: ${{ github.workspace }}
+        run: |
+          extra=$(git ls-files | grep -E '(^|/)(yarn\.lock|pnpm-lock\.yaml)$|^package-lock\.json$' || true)
+          if [ -n "$extra" ]; then
+            echo "::error::website/package-lock.json is the only lockfile that may be tracked. Found: $extra"
+            exit 1
+          fi
+          echo "Only website/package-lock.json is tracked."
+
       - uses: actions/setup-node@v6
         with:
           cache-dependency-path: ./website/package-lock.json

CONTRIBUTING.md

@@ -33,7 +33,7 @@ Thank you for your interest in contributing to the Cardano Developer Experience
 
 ### Prerequisites
 - Node.js 22 (v22.12.0 or higher, matching `engines` in `website/package.json`). The repository root carries an `.nvmrc` pinned to `22`, so `nvm use` (or `fnm use`) selects the right runtime automatically — the same major version the workflows run.
-- npm or yarn
+- npm
 - Git
 - Basic understanding of Markdown
 
@@ -52,7 +52,7 @@ Thank you for your interest in contributing to the Cardano Developer Experience
 
 3. **Start Local Server**
    ```bash
-   npm start
+   npm run start:dev
    ```
 
 4. **Make Changes**

website/README.md

@@ -2,44 +2,36 @@
 
 This website is built using [Docusaurus](https://docusaurus.io/), a modern static website generator.
 
+The website standardises on **npm** — it is the only package manager CI installs with (`npm ci` from `website/package-lock.json`, the only tracked lockfile).
+
 ### Installation
 
 ```
-$ yarn
+$ npm install
 ```
 
 ### Local Development
 
 ```
-$ yarn start
+$ npm run start:dev
 ```
 
+Note: `npm start` is not the dev server — it runs a full production build and serves that, so use `start:dev` while developing.
+
 This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
 
 ### Build
 
 ```
-$ yarn build
+$ npm run build
 ```
 
 This command generates static content into the `build` directory and can be served using any static contents hosting service.
 
 ### Deployment
 
-Using SSH:
-
-```
-$ USE_SSH=true yarn deploy
-```
-
-Not using SSH:
-
-```
-$ GIT_USER=<Your GitHub username> yarn deploy
-```
-
-If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch.
+Deployment is handled by the Deploy to GitHub Pages workflow (`.github/workflows/deploy.yml`), which runs on every push to `main` that touches `website/`. There is no manual deploy step — do not push to `gh-pages` by hand, as that bypasses the workflow.
 
 ### Security
 
-Run dependency audits with `yarn audit` or `npm run audit`. See [SECURITY.md](./SECURITY.md) for how we verify and fix dependency security issues.
+Run dependency audits with `npm run audit`. See [SECURITY.md](./SECURITY.md) for how we verify and fix dependency security issues.

website/SECURITY.md

@@ -54,4 +54,4 @@ npm install
 npm run build
 ```
 
-Commit `package.json`, `package-lock.json`, and `yarn.lock` together so the two lockfiles do not drift.
+Commit `package.json` and `package-lock.json` together — `website/package-lock.json` is the only tracked lockfile, so the two cannot drift apart.

website/package.json

@@ -60,41 +60,6 @@
   "engines": {
     "node": ">=22.12.0"
   },
-  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e",
-  "resolutions": {
-    "@babel/core": "7.29.7",
-    "@babel/plugin-transform-modules-systemjs": "7.29.7",
-    "ajv": "8.20.0",
-    "ajv-keywords": "5.1.0",
-    "body-parser": "1.20.6",
-    "brace-expansion": "5.0.12",
-    "browserslist": "4.28.7",
-    "colord": "2.9.4",
-    "dompurify": "3.4.17",
-    "fast-uri": "4.2.2",
-    "http-proxy-middleware": "2.0.10",
-    "image-size": "file:vendor/image-size",
-    "joi": "18.2.9",
-    "katex": "0.19.0",
-    "js-yaml": "4.3.2",
-    "launch-editor": "2.14.1",
-    "minimatch": "10.2.6",
-    "nanoid": "3.3.18",
-    "node-forge": "1.4.0",
-    "postcss": "8.5.25",
-    "postcss-selector-parser": "7.1.6",
-    "qs": "6.16.0",
-    "schema-utils": "4.3.3",
-    "serialize-javascript": "7.0.7",
-    "shell-quote": "1.12.0",
-    "svgo": "3.3.5",
-    "tinypool": "2.2.0",
-    "undici": "7.30.0",
-    "uuid": "11.1.1",
-    "webpack-dev-server": "5.2.6",
-    "websocket-driver": "0.7.5",
-    "ws": "8.21.1"
-  },
   "overrides": {
     "@babel/core": "7.29.7",
     "@babel/plugin-transform-modules-systemjs": "7.29.7",