build: install pnpm via npm instead of corepack - #4948
Conversation
Corepack is no longer distributed with Node.js 25+ and cannot install pnpm >= 12, so install the version pinned in the `packageManager` field via npm instead — the same approach CI.yml already uses. Also drop the corepack suggestion from CONTRIBUTING.md; any installed pnpm >= 10 switches to the pinned version on its own. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Confidence Score: 4/5The PR appears safe to merge, with a non-blocking supply-chain hardening concern because Docker builds no longer enforce the pnpm integrity hash pinned in package.json. The changed commands install the intended exact pnpm version, but they strip its pinned SHA-512 value and therefore no longer enforce the repository’s explicit artifact-integrity constraint. Files Needing Attention: Dockerfile.ci and Dockerfile.dev
|
| Filename | Overview |
|---|---|
| Dockerfile.ci | Replaces Corepack with an npm global install that selects the correct pnpm version but omits the packageManager integrity pin. |
| Dockerfile.dev | Applies the same npm bootstrap to the legacy development image; its pre-existing obsolete-base build failure is explicitly outside this PR. |
| .github/CONTRIBUTING.md | Removes the Corepack recommendation while retaining mise and direct-install guidance. |
Reviews (1): Last reviewed commit: "build: install pnpm via npm instead of c..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| RUN corepack enable && \ | ||
| # Install the pnpm version pinned in package.json `packageManager` via npm; | ||
| # corepack was removed from Node 25+ and cannot install pnpm >= 12. | ||
| RUN npm install --global pnpm@$(node -p "require('./package.json').packageManager.split('@')[1].split('+')[0]") && \ |
There was a problem hiding this comment.
The new parser strips the +sha512 value from packageManager, so Docker builds enforce only the pnpm version and no longer validate the repository's pinned artifact integrity, weakening reproducibility and supply-chain verification. The same pattern is also present in Dockerfile.dev.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
…ventional-changelog#4952) The corepack replacement in conventional-changelog#4948 installed pnpm by version only, dropping the integrity check corepack performed against the +sha512 suffix of the `packageManager` field. Download the tarball with `npm pack`, check it against the pin (the pin is the sha512 hex digest of the npm tarball), and install from the verified file. The tarball is removed after install so the final stage's *.tgz glob keeps matching only the packed commitlint packages. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 participant
Description
Replace
corepack enablewith an explicit npm install of the pnpm version pinned in thepackageManagerfield, in both Dockerfiles, and drop the corepack suggestion from CONTRIBUTING.md (mise and direct install remain).Motivation and Context
pnpm now explicitly discourages installing via corepack — the "Using Corepack" section was removed from pnpm.io/installation (pnpm/pnpm.io#862):
MODULE_NOT_FOUNDwithcorepack use pnpm@next-12pnpm/pnpm#13018, closed "not planned"). Without this change the container builds would break on the next pnpm major bump.pnpm/action-setup, plus the explicit npm install in the stock-Ubuntu job); this brings the Dockerfiles and contributor docs in line.Usage examples
Not applicable — no runtime behavior changes; the published image contents are identical.
How Has This Been Tested?
Built
Dockerfile.cifrom a pristine clone of this branch (the same conditionscontainer-build.ymlruns under): image builds green end-to-end, including the final-stage self-test (TypeScript config loads, over-length header correctly rejected).Note:
Dockerfile.devis unbuildable before and after this change — itsbrainpower/node-cubiclebase image predates corepack entirely (exit 127 on master). A follow-up PR retires it.Types of changes
Checklist:
🤖 Generated with Claude Code