Switch to npm

[lucperkins]

Summary by CodeRabbit

• Chores
  • Project package workflows and build scripts now use npm instead of pnpm.
  • CI updated to use npm install commands and to cache the npm cache.
  • Repository now tracks a different lockfile pattern and ignore rules updated accordingly.
  • Workspace-level dependency override rules for a transitive package were removed.

[coderabbitai]

Warning

Rate limit exceeded

@lucperkins has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 4 minutes and 17 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 17 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8138ae8d-202a-47fe-9dea-a76c00cbc108

📥 Commits

Reviewing files that changed from the base of the PR and between aeddcfc and c5df096.

📒 Files selected for processing (1)

• .github/workflows/ci.yaml

📝 Walkthrough

Walkthrough

CI, tooling, and dev-shell configurations were changed to replace pnpm with npm: CI install/run commands and caching were updated, pnpm workspace overrides were removed, .prettierignore patterns adjusted, and the flake dev shell was altered to remove pnpm and add a failing pnpm shim.

Changes

Cohort / File(s)	Summary
CI & Build Pipeline .github/workflows/ci.yaml, package.json	Switched CI install from pnpm install to npm ci; replaced pnpm run <script> with npm run <script> across build steps; added explicit npm cache setup using npm config get cache + actions/cache@v4; changed post-build check to git diff --cached --exit-code.
Package Manager Configuration .prettierignore, pnpm-workspace.yaml	Stopped ignoring pnpm lock/workspace files, began ignoring package-lock.json; removed workspace brace-expansion overrides from pnpm-workspace.yaml.
Development Environment (Nix) flake.nix	Refactored flake input declaration, switched from pkgs.mkShell to pkgs.mkShellNoCC, removed nodePackages_latest.pnpm and added a pnpm shim via writeScriptBin that errors to prevent pnpm usage.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Actions as "GitHub Actions"
  participant Repo as "Repository (git)"
  participant Cache as "actions/cache@v4"
  participant npm as "npm"
  Actions->>Repo: checkout
  Actions->>npm: npm config get cache
  npm-->>Actions: path (npm cache dir)
  Actions->>Cache: restore cache (key: package-lock.json hash)
  Actions->>npm: npm ci
  Actions->>npm: npm run format / lint / build / package
  Actions->>Repo: git add / git commit (if any)
  Actions->>Repo: git diff --cached --exit-code
  Note over Actions,Repo: CI completes with cached npm artifacts and staged-change verification

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Fix brace-expansion vuln #112 — touches pnpm-workspace.yaml brace-expansion overrides and related flake/dev-shell inputs; likely directly related.

Suggested reviewers

• cole-h

Poem

"🐰 I swapped my pnpm hops for npm beats,
I cached my crumbs in neat little fleets,
Flakes trimmed the shell, the shim gave a thump,
CI ran clean while I munched on a stump. 🥕"

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Switch to npm' directly and accurately summarizes the main change: migrating the project's package manager from pnpm to npm across all configuration files and workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch switch-to-npm

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yaml:
- Line 25: The CI step uses the staged-only check "git diff --cached
--exit-code" which misses unstaged changes; update the step to run the full
working-tree diff command (replace "git diff --cached --exit-code" with "git
diff --exit-code") so the workflow fails when any unstaged or staged
modifications exist, ensuring the full working tree is validated.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 14d01048-14e8-458a-af8c-4c91beb4cc3a

📥 Commits

Reviewing files that changed from the base of the PR and between fd11c50 and ca4f167.

⛔ Files ignored due to path filters (4)

• dist/index.js is excluded by !**/dist/**
• flake.lock is excluded by !**/*.lock
• package-lock.json is excluded by !**/package-lock.json
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

• .github/workflows/ci.yaml
• .prettierignore
• flake.nix
• package.json
• pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• pnpm-workspace.yaml

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/ci.yaml (1)

39-39: ⚠️ Potential issue | 🟠 Major

Restore full working-tree diff check.

Line 39 validates only staged changes, so unstaged file modifications can slip through CI.

Suggested fix

-      - run: git diff --cached --exit-code
+      - run: git diff --exit-code && git diff --cached --exit-code

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yaml at line 39, The CI step currently runs the
staged-only check using the command string "git diff --cached --exit-code",
which misses unstaged changes; update that step to run the full working-tree
diff by replacing the command with "git diff --exit-code" so CI fails on any
uncommitted modifications (look for the workflow step that runs the git diff
command and replace the --cached flag with the full-tree invocation).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/ci.yaml:
- Line 39: The CI step currently runs the staged-only check using the command
string "git diff --cached --exit-code", which misses unstaged changes; update
that step to run the full working-tree diff by replacing the command with "git
diff --exit-code" so CI fails on any uncommitted modifications (look for the
workflow step that runs the git diff command and replace the --cached flag with
the full-tree invocation).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1b2271da-2800-4e75-a3e5-12bf2f31430c

📥 Commits

Reviewing files that changed from the base of the PR and between ca4f167 and aeddcfc.

📒 Files selected for processing (1)

• .github/workflows/ci.yaml