refactor: Use pnpm with supply chain attack resistant config.

.github/workflows/pre-release.yml

@@ -2,61 +2,68 @@ name: Pre Release library
 on:
   push:
     branches:
-        - '*'         # matches every branch that doesn't contain a '/'
-        - '*/*'       # matches every branch containing a single '/'
-        - '**'        # matches every branch
-        - '!main'   # excludes main
+      - "**" # matches every branch
+      - "!main" # excludes main
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - uses: actions/setup-node@v6
         with:
-            node-version: 22
-            cache: 'npm'
-            # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
-            cache-dependency-path: 'documentation-ui/package-lock.json'
+          node-version: 22
+          cache: "pnpm"
+          # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
+          cache-dependency-path: "pnpm-lock.yaml"
       - name: Lint documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm run lint
+          pnpm i --frozen-lockfile
+          pnpm run lint
 
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - uses: actions/setup-node@v6
         with:
-            node-version: 22
-            cache: 'npm'
-            cache-dependency-path: 'documentation-ui/package-lock.json'
+          node-version: 22
+          cache: "pnpm"
+          cache-dependency-path: "pnpm-lock.yaml"
       - name: Test documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm test -- --run
+          pnpm i --frozen-lockfile
+          pnpm test -- --run
 
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - uses: actions/setup-node@v6
         with:
-            node-version: 22
-            cache: 'npm'
-            # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
-            cache-dependency-path: 'documentation-ui/package-lock.json'
+          node-version: 22
+          cache: "pnpm"
+          # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
+          cache-dependency-path: "pnpm-lock.yaml"
       - name: Build documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm run build
+          pnpm i --frozen-lockfile
+          pnpm run build
       - name: Build storybook site
         working-directory: documentation-ui
-        run: npm run build-storybook
+        run: pnpm run build-storybook
 
   build_sphinx:
     runs-on: ubuntu-latest
@@ -70,28 +77,29 @@ jobs:
           python-version: "3.12"
       - name: Install UV
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - name: Set up Node.js for UI Assets
         uses: actions/setup-node@v6
         with:
           node-version: 22
-          cache: 'npm'
-          cache-dependency-path: 'sphinx-ui/react/package-lock.json'
       - name: Build documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm run build
+          pnpm i --frozen-lockfile
+          pnpm run build
       - name: Generate UI Assets
         working-directory: sphinx-ui/react
         run: |
           echo "🔨 Generating UI assets..."
-          npm ci
-          npm run lint
-          npm run build
+          pnpm i --frozen-lockfile
+          pnpm run lint
+          pnpm run build
           cp ./build/injectNav.iife.js ../quantinuum_sphinx/static/injectNav.iife.js
           cp ./build/syncTheme.iife.js ../quantinuum_sphinx/static/syncTheme.iife.js
           cp ./node_modules/@quantinuum/documentation-ui/dist/tokens.css ../quantinuum_sphinx/static/styles/quantinuum-ui-tokens.css
-          npx tailwindcss --postcss ./postcss.config.mjs -i ./index.css -o ../quantinuum_sphinx/static/styles/quantinuum-ui-tailwind.css
+          pnpm exec tailwindcss --postcss ./postcss.config.mjs -i ./index.css -o ../quantinuum_sphinx/static/styles/quantinuum-ui-tailwind.css
           echo ✅ "Done. Generated UI assets."
       - name: Build
         working-directory: sphinx-ui

.github/workflows/release.yml

@@ -16,32 +16,38 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - uses: actions/setup-node@v6
         with:
-            node-version: 22
-            cache: 'npm'
-            # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
-            cache-dependency-path: 'documentation-ui/package-lock.json'
+          node-version: 22
+          cache: "pnpm"
+          # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
+          cache-dependency-path: "pnpm-lock.yaml"
       - name: Lint documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm run lint
+          pnpm i --frozen-lockfile
+          pnpm run lint
 
   test_node:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - uses: actions/setup-node@v6
         with:
-            node-version: 22
-            cache: 'npm'
-            cache-dependency-path: 'documentation-ui/package-lock.json'
+          node-version: 22
+          cache: "pnpm"
+          cache-dependency-path: "pnpm-lock.yaml"
       - name: Test documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm test -- --run
+          pnpm i --frozen-lockfile
+          pnpm test -- --run
 
   build_and_release_node:
     runs-on: ubuntu-latest
@@ -53,12 +59,15 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - uses: actions/setup-node@v6
         with:
-            node-version: 22
-            cache: 'npm'
-            # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
-            cache-dependency-path: 'documentation-ui/package-lock.json'
+          node-version: 22
+          cache: "pnpm"
+          # Path to the lock file needs to be specified explicitly as it is not in the root of the repository
+          cache-dependency-path: "pnpm-lock.yaml"
       - name: Capture latest tag before release
         id: before_release
         run: |
@@ -68,12 +77,12 @@ jobs:
       - name: Build documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm run build
+          pnpm i --frozen-lockfile
+          pnpm run build
       - name: Release documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npx semantic-release
+          pnpm exec semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -96,7 +105,7 @@ jobs:
 
       - name: Build storybook site
         working-directory: documentation-ui
-        run: npm run build-storybook
+        run: pnpm run build-storybook
 
       - name: Upload static files as artifact
         id: deployment
@@ -129,30 +138,31 @@ jobs:
           python-version: "3.12"
       - name: Install UV
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
       - name: Set up Node.js for UI Assets
         uses: actions/setup-node@v6
         with:
           node-version: 22
-          cache: 'npm'
-          cache-dependency-path: 'sphinx-ui/react/package-lock.json'
       - name: Build documentation UI JS package
         working-directory: documentation-ui
         run: |
-          npm ci
-          npm run build
+          pnpm i --frozen-lockfile
+          pnpm run build
       - name: Generate UI Assets
         working-directory: sphinx-ui/react
         env:
           NEXT_PUBLIC_GA_ID: "G-YPQ1FTGDL3"
         run: |
           echo "🔨 Generating UI assets..."
-          npm ci
-          npm run lint
-          npm run build
+          pnpm i --frozen-lockfile
+          pnpm run lint
+          pnpm run build
           cp ./build/injectNav.iife.js ../quantinuum_sphinx/static/injectNav.iife.js
           cp ./build/syncTheme.iife.js ../quantinuum_sphinx/static/syncTheme.iife.js
           cp ./node_modules/@quantinuum/documentation-ui/dist/tokens.css ../quantinuum_sphinx/static/styles/quantinuum-ui-tokens.css
-          npx tailwindcss --postcss ./postcss.config.mjs -i ./index.css -o ../quantinuum_sphinx/static/styles/quantinuum-ui-tailwind.css
+          pnpm exec tailwindcss --postcss ./postcss.config.mjs -i ./index.css -o ../quantinuum_sphinx/static/styles/quantinuum-ui-tailwind.css
           echo ✅ "Done. Generated UI assets."
       - name: Build PyPI distributions
         working-directory: sphinx-ui

.gitignore

@@ -1,2 +1,3 @@
 **/.idea/**
 **/.vscode/**
+node_modules

.pre-commit-config.yaml

@@ -32,7 +32,7 @@ repos:
       - id: documentation-ui-lint
         name: Lint (documentation-ui)
         language: system
-        entry: bash -c 'cd documentation-ui && npm run lint'
+        entry: bash -c 'cd documentation-ui && pnpm run lint'
         pass_filenames: false
         files: '^documentation-ui/src/.*\.(ts|tsx|js|jsx)$'
 

README.md

@@ -11,7 +11,7 @@ alternative to `pre-commit`, written in Rust.
 
 ### Prerequisites
 
-- **Node.js / npm** — required by the Biome format check and commitlint hooks.
+- **Node.js / pnpm** — required by the Biome format check and commitlint hooks.
 
 No Python or other runtime is needed to run prek itself.
 

documentation-ui/README.md

@@ -1,21 +1,22 @@
 # @quantinuum/documentation-ui
+
 Quantinuum design tokens and React components.
 
 Based on [shadcn](https://ui.shadcn.com/), an opinionated tailwind theme and radix-ui component generator. Shadcn components have been generated into this repo using the `components.json` definition and re-exported as a new library.
 
 ### Development
 
 #### Basic commands
+
 ```bash
-npm run storybook # Run storybook application to view components.
-npm run build-storybook # Build storybook application as static HTML.
-npm run build # Build component library with rollup.
+pnpm run storybook # Run storybook application to view components.
+pnpm run build-storybook # Build storybook application as static HTML.
+pnpm run build # Build component library with rollup.
 ```
 
-
 ### Design Tokens
-CSS variables are declared in `src/tokens.css`. Dark mode is enabled when using the attribute `data-theme="dark"` higher up in the DOM tree. See `src/tokens.css` for more details.
 
+CSS variables are declared in `src/tokens.css`. Dark mode is enabled when using the attribute `data-theme="dark"` higher up in the DOM tree. See `src/tokens.css` for more details.
 
 ### Semantic release