ci: use pnpm/setup for pnpm and Node setup, pin Node in package.json

[sebdanielsson]

Description

This replaces the hand-rolled pnpm bootstrap in the workflows with the official pnpm/setup action, and moves the Node version out of the workflow files and into package.json.

Every workflow currently repeats this block:

- run: |
    echo "Before: corepack version => $(corepack --version || echo 'not installed')"
    npm install -g corepack@latest
    echo "After : corepack version => $(corepack --version)"
    corepack enable
    pnpm --version
- uses: actions/setup-node@v6.4.0
  with:
    node-version: 24
    cache: 'pnpm'
- name: Install dependencies
  run: pnpm i --ignore-scripts

It becomes a single step:

- name: Setup pnpm and install dependencies
  uses: pnpm/setup@v2.0.2
  with:
    cache: true

pnpm/setup installs pnpm (reading the version from packageManager), installs the Node runtime, caches the pnpm store, and runs pnpm install — so the corepack bootstrap, actions/setup-node and the separate install step are all no longer needed.

Changes in detail:

• 7 workflow files, 8 jobs migrated: sharevb-ci, sharevb-e2e-tests, sharevb-docker-nightly-release (×2 jobs), sharevb-docker-realease-latest, sharevb-docker-realease-baseurl-it-tools, sharevb-releases, sharevb-github-pages-publish. Net −96/+32 lines in the workflows.
• sharevb-github-pages-publish also drops pnpm/action-setup@v6.0.9 for the same step, and gains pnpm store caching it did not have before.
• Node version pinned in package.json via engines.node and devEngines.runtime instead of being repeated as node-version: 24 in every workflow.
• pnpm bumped from 11.11.0 to 11.22.0 (latest 11.x) in packageManager.
• .nvmrc bumped from 22.19.0 to 24.19.0, which was out of step with the rest of the repo.
• pnpm-lock.yaml regenerated (see below — this is required, not cosmetic).

The sharevb-vercel-* and sharevb-codeql-analysis workflows never set up pnpm, so they are untouched.

Additional context

A few points reviewers may want to look at:

Why devEngines and not just engines. pnpm/setup reads devEngines.runtime to choose the runtime; it ignores engines.node. With only engines, the action silently falls back to Node LTS. Both fields are set here, pinned to Node 24:

"engines": { "node": "24.x" },
"devEngines": {
  "runtime": { "name": "node", "version": "24.x", "onFail": "download" }
}

engines.node also affects Vercel. Per Vercel's docs, engines.node in package.json overrides the Node version selected in project settings. Since sharevb-vercel-preview and sharevb-vercel-prod run vercel build, this pins those builds to Node 24 as well. That matches what CI and the Dockerfile already used, but it is a behaviour change worth being aware of. If you would rather leave Vercel on the dashboard setting, engines can be dropped — devEngines.runtime alone is enough for CI and local pnpm.

Why the lockfile diff is large (+753/−614). Two causes, neither of which changes any dependency version:

1. pnpm 11 treats the runtime as a real dependency, so node@runtime:24.19.0 is now an entry in the lockfile. Without regenerating, pnpm install --frozen-lockfile fails with ERR_PNPM_OUTDATED_LOCKFILE, so this part is mandatory.
2. The 11.22.0 resolver writes peer-dependency suffixes differently from 11.11.0 (e.g. (supports-color@8.1.1), (csso@5.0.5)(lightningcss@1.32.0)), which accounts for most of the churn.

Node version sources are now consistent. .nvmrc (24.19.0), engines.node (24.x), devEngines.runtime (24.x), the lockfile (node@runtime:24.19.0) and the Dockerfile (node:24-alpine) all agree. .nvmrc previously said 22.19.0 while CI and Docker were already on 24.

--ignore-scripts is no longer passed. pnpm/setup runs a plain pnpm install and has no input for extra install args. This looks low risk here: package.json has no preinstall/install/postinstall/prepare scripts, and pnpm 10+ blocks dependency build scripts by default unless allowlisted via onlyBuiltDependencies, which this repo does not set.

Action pinned to v2.0.2 rather than the floating v2, to match how every other action in this repo is pinned (actions/checkout@v7.0.0, github/codeql-action/init@v4.36.3) and the helpers:pinGitHubActionDigests preset in renovate.json.

Verification. Run locally against the regenerated lockfile, all passing: pnpm lint, pnpm lint:fix (no changes), pnpm typecheck, pnpm test (128 files, 1035 tests) and pnpm build. The workflows themselves have not been executed yet, so the action's behaviour on real runners is unverified until CI runs on this PR.

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other — CI / toolchain configuration

Before submitting the PR, please make sure you do the following

• Submit the PR against the chore/all-my-stuffs branch.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate. (Related but not duplicate: chore(deps): update pnpm to v11.21.0 #527, chore(deps): update pnpm/action-setup action to v6 - abandoned #385 — see above.)
• Provide a description, in PLAIN ENGLISH ONLY, in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Run pnpm install --ignore-scripts && pnpm lint:fix && pnpm typecheck to ensure pnpm lock, oxlint and typecheck are ok
• Ideally, include relevant tests that fail without this PR but pass with it. — Not applicable: this changes CI configuration only. The existing suite (1035 tests) passes, and the workflows themselves are the test.

---

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR modernizes the repository’s CI/toolchain setup by switching GitHub Actions workflows to the pnpm/setup action for consistent pnpm + Node provisioning, and centralizes the Node version pin in package.json (instead of duplicating it across workflows). It also aligns local development (.nvmrc) and regenerates the lockfile to reflect the updated pnpm/runtime metadata.

Changes:

• Replace hand-rolled Corepack + actions/setup-node + explicit pnpm install steps with pnpm/setup@v2.0.2 across the affected workflows.
• Pin Node 24 in package.json (engines.node + devEngines.runtime) and update .nvmrc to 24.19.0.
• Bump pnpm to 11.22.0 and regenerate pnpm-lock.yaml accordingly.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pnpm-lock.yaml	Regenerated lockfile for pnpm 11.22.0 and Node runtime metadata (includes node@runtime:* entries and resolver output changes).
package.json	Bumps packageManager pnpm version and centralizes Node version via engines + devEngines.runtime.
.nvmrc	Aligns local Node version with CI/toolchain (24.19.0).
.github/workflows/sharevb-releases.yml	Switches dependency setup to pnpm/setup with caching.
.github/workflows/sharevb-github-pages-publish.yml	Switches Node + pnpm setup to pnpm/setup with caching.
.github/workflows/sharevb-e2e-tests.yml	Switches dependency setup to pnpm/setup; keeps Playwright cache/install flow.
.github/workflows/sharevb-docker-realease-latest.yml	Switches dependency setup to pnpm/setup with caching.
.github/workflows/sharevb-docker-realease-baseurl-it-tools.yml	Switches dependency setup to pnpm/setup with caching.
.github/workflows/sharevb-docker-nightly-release.yml	Switches both jobs’ dependency setup to pnpm/setup with caching.
.github/workflows/sharevb-ci.yml	Switches dependency setup to pnpm/setup with caching.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sharevb]

Hi @sebdanielsson thanks for this PR now merged