* ci: pin pnpm 11.20.0 everywhere
Every pnpm version reference now agrees on the latest release:
packageManager and the engines floor in all four manifests, and the
ghcr.io/pnpm/pnpm image in both Dockerfiles. Frozen installs for the
root, web, and website workspaces verified clean on 11.20.0.
* Update client-ts.
Migrate shared pins to pnpm catalogs.
Dependabot updates pnpm-workspace.yaml catalogs (GA since Feb 2025), so
package.json entries duplicating a catalog pin now use the catalog:
protocol instead of a literal range that could drift. Adds esbuild and
prettier-plugin-packagejson to the root catalog, and regenerates the web
lockfile, dropping stale importers left over from the symlink fix.
pnpm publish replaces catalog: with the concrete range at pack time
(verified against packed tarballs and an external consumer install).
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
Declare eslint-config's parser dependency.
index.js imports ParserOptions from @typescript-eslint/parser in JSDoc,
but only the typescript-eslint meta package was declared. The isolated
linker refuses phantom deps, so tsc -p . failed for eslint-config and
every package whose typecheck reaches it (logger-js), which would have
broken the next packages-npm-publish run.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
Update for pnpm.
* Fix sub command syntax.
* Fix version drift.
* Add catalog lint.
* Add scripts.
* Tidy package configs.
* Add a local lint-catalogs target.
CI gained a catalogs check with no make counterpart, breaking the
documented promise that every ci-lint-* target has a local equivalent.
Also drops the second of two success log lines the script printed on
every clean run.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
---------
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* web: bump storybook in /web in the storybook group across 1 directory
Bumps the storybook group with 1 update in the /web directory: [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core).
Updates `storybook` from 10.4.2 to 10.4.6
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.4.6/code/core)
---
updated-dependencies:
- dependency-name: storybook
dependency-version: 10.4.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: storybook
...
Signed-off-by: dependabot[bot] <support@github.com>
* update openapi generator together
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* fix?
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* fix it
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* Revert "web: bump the eslint group across 2 directories with 4 updates (#23604)"
This reverts commit 2116bc0811.
* packages/prettier-config: break eslint-config↔prettier-config symlink cycle
The two shared config packages mutually link:-depended on each other so
each could lint/format its own source. Under npm's flat hoisting this was
harmless, but pnpm's isolated linker materializes it as directly nested
node_modules symlinks, producing an infinite physical path that any
symlink-following recursive walk (Docusaurus theme scan, tsc, IDE
indexers) blows up on with ENAMETOOLONG — breaking the website build.
Drop @goauthentik/eslint-config from prettier-config's devDependencies to
cut one edge of the cycle. prettier-config's own eslint.config.mjs still
resolves @goauthentik/eslint-config (workspace v2.0.0) via the root
node_modules symlink, so its lint is unaffected.
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* Revise locks.
* Remove brace-expansion override.
* Format.
* Update lock.
* Fix version range, format.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* Replace npm + Corepack with pnpm
Migrate package management from npm + Corepack to pnpm across the root,
web, and website workspaces:
- Swap npm/Corepack tooling for pnpm: drop package-lock.json files and the
bespoke Corepack bootstrap scripts (setup-corepack.mjs, utils/corepack.mjs,
lint-lockfile.mjs); add pnpm-lock.yaml + pnpm-workspace.yaml per workspace.
- CI uses the official pnpm/action-setup + actions/setup-node; pin the pnpm
store dir via PNPM_HOME so setup-node's `cache: pnpm` post-step succeeds.
- Docker sources pnpm from the official ghcr.io/pnpm/pnpm image via a
${BUILDPLATFORM}-pinned stage; the website docs build does a hoisted root
install so @goauthentik/docusaurus-config resolves its own deps.
- Gate the web install on the `node` dep so runtime-only jobs don't invoke
pnpm; scope the from-stable env setup so the new tooling doesn't run against
the stable checkout's npm packageManager field.
- Resolve @goauthentik/api (client-ts) from its TypeScript source instead of a
tsc-built dist, so it no longer depends on an install-time prepare having run
(the storybook build's environment never built it); sfe's rollup gains .ts
resolution to match.
- Netlify builds with pnpm; encode pnpm's supply-chain controls
(onlyBuiltDependencies/allowBuilds, minimumReleaseAge) in the workspace.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remove custom node action.
* Format.
* core: add .npmrc baseline to block dependency lifecycle scripts
Set ignore-scripts=true at the repo root, plus engine-strict, save-exact,
audit, and prefer-offline. This neutralizes the dominant npm supply-chain
attack vector — postinstall scripts in transitive dependencies — at the
cost of requiring an explicit rebuild for the handful of packages that
legitimately need install scripts (esbuild, chromedriver, tree-sitter,
tree-sitter-json). The next commit wires that rebuild into the Makefile.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* core: route node installs through make to retire website preinstall hook
Make docs-install depend on a new root-node-install so the root deps
are guaranteed before the website install runs, removing the need for
the website/preinstall lifecycle script. Rebuild the small audited list
of trusted packages (esbuild, chromedriver, tree-sitter, tree-sitter-json)
after the web install so ignore-scripts=true remains the only path that
needs maintenance. web/README documents the new workflow.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* Clean up install scripts.
* Track .npmrc in CODEOWNERS
* Fix formatter config. Reformat.
* Fix mounted references.
* Flesh out node scripts.
* Bump engines.
* Prep containers.
* Update makefile.
* Flesh out github actions.
* Clean up docs container.
* lint.
Bump.
Lint.
Bump NPM version.
* Add limits.
* collapse the composite's three setup-node calls to one cache restore
* Add SHA.
* Bump NPM range.
* Run formatter.
* Bump NPM.
* Remove extra install.
* Fix website deps.
* Use local prettier. Fix drift in CI.
* ci: build frontend in CI with node_env production
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* Install docusaurus config.
* Fix linter warning, order.
* Add linter commands.
* Add timeout.
* Remove pre install check.
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
