Migrate from Yarn 1 to pnpm

.changeset/lucky-pears-wander.md

@@ -0,0 +1,9 @@
+---
+'@signalwire/docusaurus-theme-llms-txt': patch
+---
+
+Fix the theme failing to type-check under React 18. `useDropdownState` declared its ref as
+`RefObject<HTMLDivElement | null>` — the React 19 `@types/react` shape — which React 18 rejects when
+assigned to a `ref` prop, so a site on React 18 that type-checks a swizzled `CopyPageContent` hit
+TS2322. The package advertises `react: ^18.0.0 || ^19.0.0`, so the ref type is now inferred and
+correct under either major.

.github/actions/setup/action.yml

@@ -1,5 +1,5 @@
 name: 'Setup Node.js and Dependencies'
-description: 'Setup Node.js with yarn cache and install dependencies'
+description: 'Setup pnpm and Node.js with a dependency cache, then install'
 
 inputs:
   node-version:
@@ -10,12 +10,17 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    # Must precede setup-node: the pnpm cache key needs a resolvable store path.
+    # Version comes from packageManager in package.json.
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
+
     - name: Setup Node.js
       uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node-version }}
-        cache: 'yarn'
+        cache: 'pnpm'
 
     - name: Install dependencies
-      run: yarn install --frozen-lockfile
+      run: pnpm install --frozen-lockfile
       shell: bash

.github/workflows/ci.yml

@@ -3,8 +3,8 @@ name: CI
 on:
   push:
     branches: [main, develop]
+  # No branch filter: a PR stacked on another feature branch still needs CI.
   pull_request:
-    branches: [main, develop]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -22,16 +22,16 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Build packages
-        run: yarn run build:packages
+        run: pnpm run build:packages
 
       - name: Check code formatting
-        run: yarn run format:check
+        run: pnpm run format:check
 
       - name: Lint
-        run: yarn run lint
+        run: pnpm run lint
 
       - name: Type check
-        run: yarn run type-check
+        run: pnpm run type-check
 
   # Both published packages declare `react: ^18.0.0 || ^19.0.0`. Docusaurus v4
   # will require React 19, but v3 sites are still on 18, so both legs have to
@@ -50,55 +50,27 @@ jobs:
       - name: Setup Node.js and Dependencies
         uses: ./.github/actions/setup
 
-      # The website pins its own React range, so swapping only the root would
-      # leave a nested copy behind and the build would not actually exercise
-      # the matrix version.
+      # pnpm overrides apply tree-wide, so nested copies move too. Adding at
+      # the root instead would leave the packages' own @types/react ^19 in
+      # place and the React 18 leg would type-check against React 19.
       - name: Pin React ${{ matrix.react }}
         run: |
-          yarn add -W --dev \
-            react@^${{ matrix.react }} \
-            react-dom@^${{ matrix.react }} \
-            @types/react@^${{ matrix.react }} \
-            @types/react-dom@^${{ matrix.react }}
-          yarn workspace website add \
-            react@^${{ matrix.react }} \
-            react-dom@^${{ matrix.react }}
-          # Yarn 1.22 `workspace <name> add` drops hoisted root devDependencies
-          # from node_modules (@testing-library/*, rimraf) while leaving them in
-          # package.json. This restores them; the pinned React is unaffected.
-          yarn install
-
-      # Guards against the leg silently testing the wrong version: if the
-      # website kept a nested copy, root and site would resolve different
-      # files and the build below would not be exercising matrix.react at all.
-      - name: Verify the whole workspace resolves one React ${{ matrix.react }}
-        run: |
-          node -e "
-            const path = require('path');
-            const resolve = (from) =>
-              require.resolve('react/package.json', { paths: [from] });
-            const root = resolve(process.cwd());
-            const site = resolve(path.join(process.cwd(), 'website'));
-            const version = require(root).version;
-            console.log('root   ->', root);
-            console.log('site   ->', site);
-            console.log('version->', version);
-            if (root !== site) {
-              throw new Error('website resolves a different React copy');
-            }
-            if (!version.startsWith('${{ matrix.react }}.')) {
-              throw new Error('expected React ${{ matrix.react }}.x, got ' + version);
-            }
-          "
+          node scripts/pinReact.js ${{ matrix.react }}
+          pnpm install --no-frozen-lockfile
+
+      # Guards against the leg silently testing the wrong version. Checks the
+      # types too: a runtime-only pin would leave tsc on the other major.
+      - name: Verify React ${{ matrix.react }} everywhere
+        run: node scripts/checkReactVersions.js ${{ matrix.react }}
 
       - name: Build packages
-        run: yarn run build:packages
+        run: pnpm run build:packages
 
       - name: Type check
-        run: yarn run type-check
+        run: pnpm run type-check
 
       - name: Test packages
-        run: yarn run test:ci
+        run: pnpm run test:ci
 
       - name: Build website
-        run: yarn run build:website
+        run: pnpm run build:website

.github/workflows/dependency-review.yml

@@ -42,15 +42,12 @@ jobs:
           comment-summary-in-pr: on-failure
           show-patched-versions: true
 
-          # Dev-only DoS advisories in versions lerna/nx pin exactly. All three
-          # are dev-time only: `yarn audit --groups dependencies` is clean.
+          # Only advisories with no patch at any version belong here. The
+          # dev-only ones lerna and nx pin are handled by pnpm.overrides in
+          # package.json instead -- see there.
           #
-          #   js-yaml@4.1.1        (x2) pinned by lerna, patched in 4.3.1
-          #   brace-expansion@5.0.8      pinned by nx,    patched in 5.0.9
-          #
-          # Not fixable by `resolutions`: Yarn 1.22 ignores the scoped
-          # `lerna/js-yaml` form, and an unscoped entry rewrites every range for
-          # the name -- forcing read-yaml-file (used by @changesets/cli) onto
-          # js-yaml 4.x, where the `safeLoad` it calls no longer exists.
-          # Removing lerna is the real fix; see issue for tracking.
-          allow-ghsas: GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m, GHSA-rgw5-rvv9-x895
+          # Both below are image-size 2.0.2, reached through @docusaurus/core.
+          # Neither has a patched release (verified via the GitHub advisory
+          # API), and both are parser DoS in a build-time image reader that
+          # never runs in a deployed site. Drop them if a fix ever ships.
+          allow-ghsas: GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq

.npmrc

@@ -0,0 +1,3 @@
+# yarn ran pre/post scripts automatically; pnpm does not since v7. Keeps
+# prebuild:website wired to build:packages.
+enable-pre-post-scripts=true