build(deps): Migrate repository to pnpm

.github/workflows/ci.yml

@@ -14,14 +14,15 @@ jobs:
     name: test
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v5
         with:
           node-version: "22"
-          cache: npm
-      - run: npm ci
-      - run: npm run typecheck
-      - run: npm test
-      - run: npm run build
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run typecheck
+      - run: pnpm test
+      - run: pnpm run build
 
   # Pack the npm tarball on release branches only — Craft pulls this
   # artifact by name (`npm-tarball`) from the `CI` workflow to publish
@@ -32,13 +33,14 @@ jobs:
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v5
         with:
           node-version: "22"
-          cache: npm
-      - run: npm ci
-      - run: npm run build
-      - run: npm pack
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
+      - run: pnpm pack
       - uses: actions/upload-artifact@v7
         with:
           name: npm-tarball

.github/workflows/docs-preview.yml

@@ -30,11 +30,12 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v5
         with:
           node-version: "22"
-          cache: npm
-          cache-dependency-path: website/package-lock.json
+          cache: pnpm
+          cache-dependency-path: website/pnpm-lock.yaml
 
       # Check if website files changed. On 'closed' events we always proceed
       # (cleanup). Otherwise we only build/deploy when website files changed.
@@ -53,14 +54,14 @@ jobs:
           (github.event.action == 'closed' || steps.filter.outputs.website == 'true') &&
           github.event.pull_request.head.repo.full_name == github.repository
         working-directory: website
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build site
         if: >-
           (github.event.action == 'closed' || steps.filter.outputs.website == 'true') &&
           github.event.pull_request.head.repo.full_name == github.repository
         working-directory: website
-        run: npm run build
+        run: pnpm run build
         env:
           PR_NUMBER: ${{ github.event.number }}
           DOCS_BASE_PATH: /_preview/pr-${{ github.event.number }}/

.github/workflows/pages.yml

@@ -27,19 +27,20 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v5
         with:
           node-version: "22"
-          cache: npm
-          cache-dependency-path: website/package-lock.json
+          cache: pnpm
+          cache-dependency-path: website/pnpm-lock.yaml
 
       - name: Install dependencies
         working-directory: website
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build site
         working-directory: website
-        run: npm run build
+        run: pnpm run build
 
       - name: Upload built site for the link-check job
         uses: actions/upload-artifact@v5

README.md

@@ -11,7 +11,7 @@ Action. Pure Node, zero product coupling — works for Electron apps, CLIs,
 agents, and any single-file binary artifact.
 
 ```sh
-npm install binpatch
+pnpm add binpatch
 ```
 
 **Docs:** https://binpatch.p.byk.im/ · **Source:** https://github.com/BYK/binpatch