[ClaudiaFang]

Closes #163 · Part of firstsun-dev/.github#38

Changes

• npm -> pnpm: packageManager: pnpm@12.14.0; pnpm-lock.yaml created with pnpm import from package-lock.json (resolved versions preserved); package-lock.json removed after validation.
• package.json#overrides (all security overrides kept, incl. npm, undici, sigstore, tar, ...) moved verbatim to pnpm-workspace.yaml#overrides.
• allowBuilds: { esbuild: true }.
• Phantom dependency fixed properly: eslint.config.mts imports eslint/config but eslint was not declared (npm hoisting hid it; pnpm lint failed). Added eslint@9.39.4 (devDependency, same version npm had resolved). No other upgrades.
• Engines unchanged (none declared; Obsidian plugin runtime minimum not raised).
• .npmrc (tag-version-prefix) kept: npm-version-only setting, not a pnpm setting.
• scripts/typecheck-compat.mjs still uses npm install --prefix into a cache dir (isolated, npm ships with Node).
• ci.yml: Node 22 -> 24 (unit-test matrix keeps [22, 24] to cover the plugin runtime floor), pnpm/action-setup@v6 (SHA-pinned like other actions, reads packageManager), cache: pnpm, pnpm install --frozen-lockfile (existing --ignore-scripts kept), pnpm exec semantic-release, paths-filter uses pnpm-lock.yaml/pnpm-workspace.yaml. All jobs (lint, unit, build, E2E, package, publish, attestations) preserved.
• Scripts/husky/docs: npm/npx -> pnpm.

Validation evidence

• rm -rf node_modules && pnpm install --frozen-lockfile (pnpm 12.14.0, Node 24.18): OK
• pnpm run lint: 0 errors; pnpm run build (tsc + Obsidian 1.11.0 compat + esbuild): OK
• pnpm run test: 76 files / 953 tests passed (4 consecutive runs; see note below); with --coverage OK
• pnpm run test:e2e -- --provider gitea (real Gitea in Docker): 36 passed, 18 skipped
• Release artifacts: main.js/manifest.json/styles.css sha256 are byte-identical to a build from the npm baseline (main.js 239643 bytes, 31cb7c6d...); file set unchanged.
• Workflow YAML parse: OK.
• Docker: no Dockerfile. No npm publish (npmPublish false).
• Note: one local full-suite run showed 2 failures in 1 test file; 4 later runs were 953/953 green. Not reproduced; cause not identified (possibly load from concurrent commit hook). Watch CI.

Lockfile refresh

Separate commit chore(deps): refresh lockfile within existing ranges (pnpm update --no-save; git diff package.json empty, overrides untouched; revert that commit alone to undo). Notable bumps: vitest/@vitest/* 4.1.11->4.1.12, typescript-eslint 8.68.0->8.71.2, eslint-plugin-sonarjs 4.2.0->4.2.2, @types/node 24.13.2->24.19.2, @semantic-release/github ->12.0.10, obsidian typings 1.13.1->1.14.4, ignore 7.0.6->7.0.12.
Re-validated: frozen clean install, lint, build (incl. Obsidian 1.11.0 compat), 953/953 tests. manifest.json/styles.css hashes unchanged. main.js changed (239643 -> 243397 bytes, sha256 b88b1b25...) because the bundled runtime dependency ignore moved 7.0.6 -> 7.0.12 (the baseline-identical hash above applies to the pre-refresh commit b79061f).

Risks / interactions

• Provider E2E (github/gitlab) needs secrets/self-hosted runner.
• Not run locally: semantic-release (needs tokens; a local dry-run failed only on tag clobbering in a shared clone).
• This repo's ci.yml is self-contained, but CI of repos using the shared Obsidian workflows depends on firstsun-dev/.github PR feat: add ignore sync setting #40 (pnpm-aware) being merged first.
• Conflicts with open PRs: chore(ci): migrate actions to Node 24 runtime #160 (one-line ci.yml change, Node 24 action runtime) and Fix release provenance, E2E cleanup race, and stale docs #157 (renames publish job to release-metadata, adds release-build.yml; its npm ci/npx semantic-release lines will conflict with mine). Resolution when the later one merges: keep the pnpm setup steps/commands and apply the other PR's structure; release-build.yml from Fix release provenance, E2E cleanup race, and stale docs #157 will also need the same pnpm/action-setup + pnpm install --frozen-lockfile + Node 24 treatment.

Post-merge status (checked 2026-10-20 02:26 UTC)

• Merged into main at 2026-10-20T02:17:46Z as 665c839.

• Push CI on the merge commit: CI/CD: in_progress/null.

• Tracking: chore(toolchain): standardize Node.js 24 and pnpm 12 across active repositories .github#38.

🤖 Generated with Claude Code

CI note

Self-hosted provider-e2e legs intermittently failed in pnpm/action-setup (Cannot find module .../@pnpm/exe.linux-x64/bin/pnpm.mjs): the runners share a persistent pnpm 11 store (/cache/pnpm-store) and the two parallel legs race while switching to 12.14.0 (infra interaction, first run's gitlab leg hung ~30m, second run both legs failed at setup). Fixed on the branch (commit "fix(ci): isolate pnpm store per self-hosted E2E leg"): each leg uses pnpm_config_store_dir=$RUNNER_TEMP/pnpm-store-<provider>. Latest run: all checks green incl. github/gitlab/gitea E2E, Required Checks, Release/Package (Publish skipped on PR).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ClaudiaFang]

🎉 This PR is included in version 1.6.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀