@catladder/cli 0.0.0-next-a2f59d07 → 0.0.0-next-cf4e99eb

package/dist/bundles/cli/index.js

@@ -12028,11 +12028,14 @@ const createNodeDockerJobDefinition = async (context) => {
         (0, packageManagerInstall_1.getDockerAppCopyAndBuildScript)(context),
         context.packageManagerInfo,
     ]);
-    // the pnpm store (pulled via the cache above) is copied into the
-    // image so the prod install works offline — like the yarn zip cache,
-    // which travels inside the copied `.yarn` config folder
-    const copyPnpmStore = packageManagerInfo.type === "pnpm" &&
-        packageManagerInfo.componentIsInWorkspace;
+    // The pnpm store is deliberately NOT copied into the image. It used
+    // to be, so the prod install could link instead of hitting the
+    // registry — but the store lands in an earlier layer than
+    // node_modules, so pnpm cannot hardlink across the overlay boundary
+    // and copies every package instead. Measured on one component: the
+    // in-image install was *slower* that way (28s vs 10s from the
+    // registry), the store added 3GB to the build context and the final
+    // image, and the build took 339s instead of 27s.
     // pnpm copies every workspace manifest into the image — as individual
     // COPY instructions that many layers exceed docker's depth limit, so
     // the job tars them up and a single ADD extracts them
@@ -12040,8 +12043,6 @@ const createNodeDockerJobDefinition = async (context) => {
     const WORKSPACE_FILES_TAR = ".catladder-workspace-files.tar";
     return {
         script: [
-            // the COPY source must exist even when the cache was cold
-            ...(copyPnpmStore ? ["mkdir -p .pnpm-store"] : []),
             ...(isPnpm
                 ? [
                     `tar -cf ${WORKSPACE_FILES_TAR} ${packageManagerInfo.pathsToCopyInDocker.join(" ")}`,
@@ -12058,14 +12059,10 @@ const createNodeDockerJobDefinition = async (context) => {
                     `ADD ${WORKSPACE_FILES_TAR} /app/`,
                     // ADD does not apply --chown to extracted tars, and parent
                     // dirs of the entries come out root-owned — fix ownership
-                    // while the stage still runs as root (store not copied yet,
-                    // so this only touches the small manifest tree). Custom
-                    // base images without a node user run as root and don't
-                    // need it, hence the fallback
+                    // while the stage still runs as root (this only touches the
+                    // small manifest tree). Custom base images without a node
+                    // user run as root and don't need it, hence the fallback
                     `RUN chown -R node:node /app || true`,
-                    ...(copyPnpmStore
-                        ? [`COPY --chown=node:node .pnpm-store /app/.pnpm-store`]
-                        : []),
                 ].join("\n")
                 : packageManagerInfo.pathsToCopyInDocker
                     .map((dir) => `COPY --chown=node:node ${dir} /app/${dir}`)
@@ -12099,10 +12096,9 @@ const lodash_es_1 = __nccwpck_require__(50210);
 const path_1 = __nccwpck_require__(16928);
 const slugify_1 = __importDefault(__nccwpck_require__(84007));
 /**
- * stable reference between the two node caches: the package-manager
- * (yarn zip / pnpm store) cache declares itself redundant when the
- * node_modules cache scored an exact-lockfile hit (github skips the
- * ~0.6GB download on warm runs)
+ * stable reference between the two yarn caches: the zip cache declares
+ * itself redundant when the node_modules cache scored an exact-lockfile
+ * hit (github skips the ~0.6GB download on warm runs)
  */
 const NODE_MODULES_CACHE_ID = "node-modules";
 /**
@@ -12130,36 +12126,36 @@ const getCacheBaseDir = async (context) => {
         : ".";
 };
 /**
- * the package manager's download cache: yarn's `.yarn` zip cache, or
- * pnpm's content-addressable store (which catladder points at a
- * project-local `.pnpm-store`, see the install script)
+ * the package manager's download cache: yarn's `.yarn` zip cache.
+ *
+ * pnpm gets nothing. Its store is a content-addressable tree of
+ * hundreds of thousands of small files, and moving it costs more than
+ * the install it saves: measured on a 3800-package monorepo, restoring
+ * the 1 GB store took ~53s on gitlab (which zips file by file) and
+ * ~23s on github, against a from-registry install of ~30-40s. See
+ * getNodeModulesCache for the node_modules half of the same finding.
  */
 const getYarnCache = async (context, policy = "pull-push") => {
     const packageManagerInfo = await context.packageManagerInfo;
-    const isPnpm = packageManagerInfo.type === "pnpm";
+    if (packageManagerInfo.type === "pnpm")
+        return [];
     const baseDir = await getCacheBaseDir(context);
-    // pnpm keeps its store in a format-versioned subdir (v10, v11, ...)
-    // and never cleans old ones up — scope the cache slot by major so a
-    // pnpm upgrade starts a fresh slot instead of dragging the dead old
-    // store tree along in every cache transfer (formats change only on
-    // majors)
-    const pnpmStoreKey = `pnpm-v${packageManagerInfo.version.split(".")[0]}`;
     return [
         {
             scope: "buildDir",
             pathMode: "relative",
             buildDir: baseDir,
-            key: isPnpm ? pnpmStoreKey : "yarn",
+            key: "yarn",
             policy,
-            paths: [isPnpm ? ".pnpm-store" : ".yarn"],
+            paths: [".yarn"],
             // content-key for immutable-cache backends (github); the lockfile
             // decides whether the cached content could have changed
-            keyFiles: [isPnpm ? "pnpm-lock.yaml" : "yarn.lock"],
-            // the package manager's download cache (~hundreds of MB) is only
-            // read when packages have to be (re)installed. When the
-            // node_modules cache hit for the same lockfile, install verifies
-            // its state file and never touches the store — so github skips
-            // downloading this cache entirely
+            keyFiles: ["yarn.lock"],
+            // the yarn zip cache (~hundreds of MB) is only read when packages
+            // have to be (re)installed. When the node_modules cache hit for
+            // the same lockfile, install verifies its state file and never
+            // touches the zips — so github skips downloading this cache
+            // entirely
             redundantOnExactHitOf: NODE_MODULES_CACHE_ID,
         },
     ];
@@ -12168,12 +12164,18 @@ exports.getYarnCache = getYarnCache;
 const getNodeModulesCache = async (context, policy = "pull-push") => {
     const packageManagerInfo = await context.packageManagerInfo;
     const baseDir = await getCacheBaseDir(context);
-    const { workspaces } = packageManagerInfo;
-    const isPnpm = packageManagerInfo.type === "pnpm";
-    const lockFileName = isPnpm ? "pnpm-lock.yaml" : "yarn.lock";
-    // yarn berry tracks install state in .yarn/install-state.gz (pnpm's
-    // equivalent lives inside node_modules and is covered by the paths)
-    const hasInstallState = packageManagerInfo.type === "yarn" && !packageManagerInfo.isClassic;
+    // pnpm gets no node_modules cache either: archiving the tree (root
+    // plus every workspace's symlink farm, >1GB in real monorepos) costs
+    // ~190s per saving job to spare ~6s of install, and a safe pnpm slot
+    // must be keyed by lockfile hash (a pnpm install over a node_modules
+    // from a different lockfile leaves orphaned .pnpm dirs that break
+    // type identity), so it misses on every dependency change anyway.
+    // pnpm projects run entirely uncached — see getYarnCache
+    if (packageManagerInfo.type === "pnpm")
+        return [];
+    const lockFileName = "yarn.lock";
+    // yarn berry tracks install state in .yarn/install-state.gz
+    const hasInstallState = !packageManagerInfo.isClassic;
     // We intentionally do not use the contents of the lockfile as a cache key, as install should always guarantee that the files are updated, but it can still use part of the cache if not all packages are up-to-date.
     // It would slow down all pipelines whenever one adds a new dependency as it will need to download all node_modules again.
     return [
@@ -12181,19 +12183,7 @@ const getNodeModulesCache = async (context, policy = "pull-push") => {
             scope: "global",
             pathMode: "absolute",
             // we use the dirname, not the component name, because in certain cases we have two apps in the same directory and want to share the cache, e.g. when having storybook in the same package.json
-            //
-            // pnpm gets its own, lockfile-keyed cache: node_modules layouts
-            // are not compatible between package managers (a migrating
-            // project must not inherit the yarn slot), and unlike yarn, a
-            // pnpm install on top of a node_modules from a different lockfile
-            // leaves orphaned .pnpm dirs behind that break type identity —
-            // so the slot changes whenever the lockfile changes
-            key: isPnpm
-                ? {
-                    prefix: "pnpm-" + (0, slugify_1.default)(baseDir) + "-node-modules",
-                    files: [(0, path_1.join)(baseDir, "pnpm-lock.yaml")],
-                }
-                : (0, slugify_1.default)(baseDir) + "-node-modules",
+            key: (0, slugify_1.default)(baseDir) + "-node-modules",
             // content-key for immutable-cache backends (github); the lockfile
             // decides whether the cached content could have changed (absolute
             // pathMode: resolve the lockfile explicitly)
@@ -12204,12 +12194,6 @@ const getNodeModulesCache = async (context, policy = "pull-push") => {
             policy,
             paths: (0, lodash_es_1.uniq)([
                 (0, path_1.join)(baseDir, "node_modules"),
-                // pnpm's per-package node_modules are symlink farms worth
-                // keeping warm (yarn hoists into the root, so root-only
-                // matches its historical behavior)
-                ...(isPnpm
-                    ? workspaces.map((w) => (0, path_1.join)(w.location, "node_modules"))
-                    : []),
                 ...(hasInstallState ? [(0, path_1.join)(baseDir, ".yarn/install-state.gz")] : []),
             ]),
         },
@@ -12377,7 +12361,7 @@ exports.createMeteorBuildJobs = createMeteorBuildJobs;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getDockerAppCopyAndBuildScript = exports.getPackageManagerInstall = exports.ensureNodeVersion = exports.getDefaultAuditCommand = void 0;
+exports.getDockerAppCopyAndBuildScript = exports.getPackageManagerInstall = exports.ensureNodeVersion = exports.getDefaultAuditCommand = exports.DEFAULT_AUDIT_LEVEL = void 0;
 const bash_1 = __nccwpck_require__(94143);
 const utils_1 = __nccwpck_require__(49401);
 const gitlab_1 = __nccwpck_require__(86962);
@@ -12401,33 +12385,38 @@ const isInWorkspace = (context, packageManagerInfo) => context.type === "workspa
  */
 const getEnsurePnpmCommand = (version) => `if ! command -v pnpm &> /dev/null; then corepack enable pnpm 2>/dev/null || npm install -g pnpm@${version}; fi`;
 /**
- * pnpm's store is global by default; point it at a project-local
- * directory so CI can cache it (the pnpm equivalent of the `.yarn`
- * zip cache). Passed as the --store-dir flag: pnpm 11 stopped reading
- * the npm_config_store_dir env var (settings only come from
- * pnpm-workspace.yaml / global config / CLI flags), the flag works on
- * v10 and v11
- */
-const getPnpmStoreDirExpression = (inWorkspace) => inWorkspace
-    ? `"$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.pnpm-store"`
-    : `"$PWD/.pnpm-store"`;
-const getPnpmInstallCommands = (context, packageManagerInfo) => [
+ * pnpm jobs use pnpm's own (global, per-runner) store location. There
+ * used to be a `--store-dir` pointing at a project-local
+ * `.pnpm-store`, so CI could cache it — that cache is gone (see
+ * getYarnCache), and keeping the store inside the repo only meant it
+ * landed in docker build contexts.
+ */
+const getPnpmInstallCommands = (packageManagerInfo) => [
     getEnsurePnpmCommand(packageManagerInfo.version),
-    `pnpm install --frozen-lockfile --store-dir ${getPnpmStoreDirExpression(isInWorkspace(context, packageManagerInfo))}`,
+    `pnpm install --frozen-lockfile`,
 ];
+exports.DEFAULT_AUDIT_LEVEL = "critical";
 /**
- * default `audit` job command per package manager. Exhaustive on the
- * package-manager type and throws for anything unsupported, so adding a
- * new package manager surfaces every place that needs a command here.
+ * default `audit` job command per package manager, failing on advisories
+ * of `level` and above. Exhaustive on the package-manager type and throws
+ * for anything unsupported, so adding a new package manager surfaces every
+ * place that needs a command here.
  */
-const getDefaultAuditCommand = (packageManagerInfo) => {
+const getDefaultAuditCommand = (packageManagerInfo, level = exports.DEFAULT_AUDIT_LEVEL) => {
     switch (packageManagerInfo.type) {
         case "pnpm":
-            return "pnpm audit --prod --audit-level critical";
+            return `pnpm audit --prod --audit-level ${level}`;
         case "yarn":
             return packageManagerInfo.isClassic
-                ? "yarn audit --level critical"
-                : "yarn npm audit --environment production --severity critical"; // yarn 2+
+                ? // classic walks the whole tree; --groups limits it to production
+                    `yarn audit --level ${level} --groups dependencies`
+                : // yarn 2+ audits only the CURRENT workspace's DIRECT dependencies
+                    // by default — in a monorepo that is the root manifest, which
+                    // usually has no production dependencies at all, so the job passed
+                    // without checking anything. --all covers every workspace,
+                    // --recursive the transitive dependencies (what `pnpm audit` and
+                    // `yarn audit` classic do on their own).
+                    `yarn npm audit --environment production --severity ${level} --all --recursive`;
         default:
             throw new Error(`no audit command implemented for package manager "${packageManagerInfo.type}"`);
     }
@@ -12448,7 +12437,7 @@ const getPackageManagerInstall = async (context, options) => {
         ? context.build.config.postInstall
         : null;
     const installSection = packageManagerInfo.type === "pnpm"
-        ? (0, gitlab_1.collapseableSection)("pnpminstall", "pnpm install")(getPnpmInstallCommands(context, packageManagerInfo))
+        ? (0, gitlab_1.collapseableSection)("pnpminstall", "pnpm install")(getPnpmInstallCommands(packageManagerInfo))
         : (0, gitlab_1.collapseableSection)("yarninstall", "Yarn install")([getYarnInstallCommand(packageManagerInfo)]);
     return [
         ...(0, exports.ensureNodeVersion)(context),
@@ -12461,11 +12450,12 @@ const getPackageManagerInstall = async (context, options) => {
 exports.getPackageManagerInstall = getPackageManagerInstall;
 const DOCKER_COPY_FILES = `COPY --chown=node:node $APP_DIR .`;
 const getPnpmDockerAppCopyAndBuildScript = (packageManagerInfo) => {
-    // the store was copied into the image (like the yarn zip cache), so
-    // the prod install links from it instead of hitting the registry
-    const storeDir = packageManagerInfo.componentIsInWorkspace
-        ? "/app/.pnpm-store"
-        : "/app/$APP_DIR/.pnpm-store";
+    // the prod install downloads from the registry: nothing is copied
+    // into the image to link from (see createNodeDockerJobDefinition).
+    // The store it fills is scratch space outside /app, dropped in the
+    // same layer so the packages ship once — node_modules holds
+    // hardlinks, so removing the store keeps the files alive
+    const storeDir = "/tmp/pnpm-store";
     // in a workspace, only install the component (and its workspace
     // dependencies) — the pnpm equivalent of `yarn workspaces focus`.
     // npm package names are shell-safe unquoted (the whole script is
@@ -12477,7 +12467,7 @@ const getPnpmDockerAppCopyAndBuildScript = (packageManagerInfo) => {
     return new bash_1.BashExpression(`
 ${DOCKER_COPY_FILES}
 RUN command -v pnpm >/dev/null 2>&1 || npm install -g pnpm@${packageManagerInfo.version}
-RUN pnpm install --prod --frozen-lockfile --store-dir ${storeDir}${filter}
+RUN pnpm install --prod --frozen-lockfile --store-dir ${storeDir}${filter} && rm -rf ${storeDir}
     `.trim());
 };
 const getDockerAppCopyAndBuildScript = async (context) => {
@@ -12540,7 +12530,7 @@ const cache_1 = __nccwpck_require__(74559);
 const constants_1 = __nccwpck_require__(5576);
 const packageManagerInstall_1 = __nccwpck_require__(28419);
 const createNodeTestJobs = async (context) => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4;
     // don't run tests after release
     // TODO: this will be replaced by using rules
     if (context.trigger === "taggedRelease") {
@@ -12586,11 +12576,11 @@ const createNodeTestJobs = async (context) => {
             script: [
                 `cd ${context.build.dir}`,
                 ...((_f = (0, utils_1.ensureArrayOrNull)((_e = buildConfig.audit) === null || _e === void 0 ? void 0 : _e.command)) !== null && _f !== void 0 ? _f : [
-                    (0, packageManagerInstall_1.getDefaultAuditCommand)(packageManagerInfo),
+                    (0, packageManagerInstall_1.getDefaultAuditCommand)(packageManagerInfo, (_g = buildConfig.audit) === null || _g === void 0 ? void 0 : _g.level),
                 ]),
             ],
-            allow_failure: (_h = (_g = buildConfig.audit) === null || _g === void 0 ? void 0 : _g.allowFailure) !== null && _h !== void 0 ? _h : true,
-            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_j = buildConfig.audit) === null || _j === void 0 ? void 0 : _j.artifactsReports, (_k = buildConfig.audit) === null || _k === void 0 ? void 0 : _k.artifacts),
+            allow_failure: (_j = (_h = buildConfig.audit) === null || _h === void 0 ? void 0 : _h.allowFailure) !== null && _j !== void 0 ? _j : true,
+            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_k = buildConfig.audit) === null || _k === void 0 ? void 0 : _k.artifactsReports, (_l = buildConfig.audit) === null || _l === void 0 ? void 0 : _l.artifacts),
         })
         : null;
     const lintJob = buildConfig.lint !== false
@@ -12599,20 +12589,20 @@ const createNodeTestJobs = async (context) => {
             ...base,
             runnerVariables: {
                 ...constants_1.NODE_RUNNER_BUILD_VARIABLES,
-                ...((_m = (_l = buildConfig.lint) === null || _l === void 0 ? void 0 : _l.runnerVariables) !== null && _m !== void 0 ? _m : {}),
+                ...((_o = (_m = buildConfig.lint) === null || _m === void 0 ? void 0 : _m.runnerVariables) !== null && _o !== void 0 ? _o : {}),
             },
-            image: (_p = (_o = buildConfig.lint) === null || _o === void 0 ? void 0 : _o.jobImage) !== null && _p !== void 0 ? _p : defaultImage,
+            image: (_q = (_p = buildConfig.lint) === null || _p === void 0 ? void 0 : _p.jobImage) !== null && _q !== void 0 ? _q : defaultImage,
             caches: nodeCache,
             script: [
                 ...(0, packageManagerInstall_1.ensureNodeVersion)(context),
                 `cd ${context.build.dir}`,
                 ...packageManagerInstall,
-                ...((_r = (0, utils_1.ensureArrayOrNull)((_q = buildConfig.lint) === null || _q === void 0 ? void 0 : _q.command)) !== null && _r !== void 0 ? _r : [
+                ...((_s = (0, utils_1.ensureArrayOrNull)((_r = buildConfig.lint) === null || _r === void 0 ? void 0 : _r.command)) !== null && _s !== void 0 ? _s : [
                     (0, runScript_1.runScript)(packageManagerInfo.type, "lint"),
                 ]),
             ],
-            allow_failure: (_s = buildConfig.lint) === null || _s === void 0 ? void 0 : _s.allowFailure,
-            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_t = buildConfig.lint) === null || _t === void 0 ? void 0 : _t.artifactsReports, (_u = buildConfig.lint) === null || _u === void 0 ? void 0 : _u.artifacts),
+            allow_failure: (_t = buildConfig.lint) === null || _t === void 0 ? void 0 : _t.allowFailure,
+            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_u = buildConfig.lint) === null || _u === void 0 ? void 0 : _u.artifactsReports, (_v = buildConfig.lint) === null || _v === void 0 ? void 0 : _v.artifacts),
         })
         : null;
     const testJob = buildConfig.test !== false
@@ -12621,22 +12611,22 @@ const createNodeTestJobs = async (context) => {
             ...base,
             runnerVariables: {
                 ...constants_1.NODE_RUNNER_BUILD_VARIABLES,
-                ...((_w = (_v = buildConfig.test) === null || _v === void 0 ? void 0 : _v.runnerVariables) !== null && _w !== void 0 ? _w : {}),
+                ...((_x = (_w = buildConfig.test) === null || _w === void 0 ? void 0 : _w.runnerVariables) !== null && _x !== void 0 ? _x : {}),
             },
             // browser tests need a jobImage carrying the browser, e.g. the
             // official playwright image (version-matched to the project)
-            image: (_y = (_x = buildConfig.test) === null || _x === void 0 ? void 0 : _x.jobImage) !== null && _y !== void 0 ? _y : (0, runner_1.getRunnerImage)("jobs-default"),
+            image: (_z = (_y = buildConfig.test) === null || _y === void 0 ? void 0 : _y.jobImage) !== null && _z !== void 0 ? _z : (0, runner_1.getRunnerImage)("jobs-default"),
             caches: nodeCache,
             script: [
                 ...(0, packageManagerInstall_1.ensureNodeVersion)(context),
                 `cd ${context.build.dir}`,
                 ...packageManagerInstall,
-                ...((_0 = (0, utils_1.ensureArrayOrNull)((_z = buildConfig.test) === null || _z === void 0 ? void 0 : _z.command)) !== null && _0 !== void 0 ? _0 : [
+                ...((_1 = (0, utils_1.ensureArrayOrNull)((_0 = buildConfig.test) === null || _0 === void 0 ? void 0 : _0.command)) !== null && _1 !== void 0 ? _1 : [
                     (0, runScript_1.runScript)(packageManagerInfo.type, "test"),
                 ]),
             ],
-            allow_failure: (_1 = buildConfig.test) === null || _1 === void 0 ? void 0 : _1.allowFailure,
-            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_2 = buildConfig.test) === null || _2 === void 0 ? void 0 : _2.artifactsReports, (_3 = buildConfig.test) === null || _3 === void 0 ? void 0 : _3.artifacts),
+            allow_failure: (_2 = buildConfig.test) === null || _2 === void 0 ? void 0 : _2.allowFailure,
+            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_3 = buildConfig.test) === null || _3 === void 0 ? void 0 : _3.artifactsReports, (_4 = buildConfig.test) === null || _4 === void 0 ? void 0 : _4.artifacts),
         })
         : null;
     return [auditJob, lintJob, testJob].filter(utils_1.notNil);

package/dist/bundles/skills/catladder-builds/references/build-types.md

@@ -26,6 +26,16 @@ generated pipeline files.
 `artifactsReports`, `artifacts`, `runnerVariables`, `allowFailure`
 (`allowFailure` defaults to `true` for `audit`).
 
+`audit` additionally takes `level`: `"info" | "low" | "moderate" | "high" |
+"critical"` (default `"critical"`) — the lowest severity that fails the job,
+translated to the package manager's own flag (`pnpm audit --audit-level`,
+`yarn npm audit --severity`, classic `yarn audit --level`). Ignored when
+`command` spells out its own command:
+
+```ts
+audit: { level: "high" },   // fail on high and critical advisories
+```
+
 ## Per-type options & defaults
 
 ### `node`

package/dist/bundles/skills/catladder-migrate-package-manager/SKILL.md

@@ -40,13 +40,19 @@ change needed:
 
 | | yarn | pnpm |
 |---|---|---|
-| CI install | `yarn install --immutable` | `pnpm install --frozen-lockfile --store-dir …` |
-| download cache | `.yarn` zip cache | project-local `.pnpm-store`, cache slot scoped by pnpm major |
-| node_modules cache | mutable slot per build dir | **lockfile-keyed** slot (a pnpm install over a foreign tree leaves orphaned `.pnpm` dirs) |
+| CI install | `yarn install --immutable` | `pnpm install --frozen-lockfile` |
+| download cache | `.yarn` zip cache | **none** — installing from the registry is cheaper than moving the store |
+| node_modules cache | mutable slot per build dir | **none** (measured: the archive costs more than the install it saves) |
 | docker prod install | `yarn workspaces focus --production` | `pnpm install --prod --frozen-lockfile --filter <pkg>...` |
-| audit job | `yarn npm audit …` | `pnpm audit --prod --audit-level critical` |
+| audit job | `yarn npm audit … --all --recursive` | `pnpm audit --prod --audit-level critical` |
 | build/start defaults | `yarn build` / `yarn start` | `pnpm build` / `pnpm start` |
 
+The audit job is the one place where the two are not equivalent in
+practice: it is easy to have a yarn pipeline whose audit checked nothing
+(before catladder 5 the generated command lacked `--all --recursive`), so
+the pnpm job can turn up long-standing vulnerabilities. Read them as
+pre-existing, not as caused by the migration.
+
 Because the cache keys differ per package manager, the first pnpm
 pipeline runs **cold** (and rebuilds job images). Judge speed on the
 second run, not the first.
@@ -140,9 +146,9 @@ skip it and run a bare `pnpm install` — that silently upgrades hundreds
 of transitive dependencies at the same time as the package manager
 changes, and you will not know which change broke what.
 
-Then set the `packageManager` field, and update `.gitignore`:
-`.pnpm-store/` in, `.yarn/*` entries out (keep `.yarn/patches` only if
-you left the patches there).
+Then set the `packageManager` field, and update `.gitignore`: `.yarn/*`
+entries out (keep `.yarn/patches` only if you left the patches there).
+Nothing pnpm-specific needs ignoring — the store lives outside the repo.
 
 ## Step 4 — fix the fallout locally
 
@@ -225,8 +231,8 @@ Mirrored, with one loss to state up front: **there is no importer back**.
 every range — the migration necessarily bumps transitive versions.
 Do it deliberately:
 
-1. Delete `pnpm-lock.yaml`, `pnpm-workspace.yaml`, `.pnpm-store`, and the
-   `node_modules` trees.
+1. Delete `pnpm-lock.yaml`, `pnpm-workspace.yaml`, and the `node_modules`
+   trees.
 2. Move `packages:` back into package.json `workspaces`, `overrides` →
    `resolutions`, `patchedDependencies` → yarn's patch protocol,
    `allowBuilds` → (yarn runs build scripts by default; nothing needed).

package/dist/bundles/skills/catladder-migrate-package-manager/references/yarn-to-pnpm-differences.md

@@ -19,7 +19,7 @@ here has bitten a real catladder project during a migration.
 | `yarn run -T x` / `yarn -T x` (berry top-level) | `x` (root `node_modules/.bin` is on the script PATH) |
 | `yarn dlx x` | `pnpm dlx x` |
 | `yarn node x` / `yarn exec x` | `pnpm exec x` |
-| `yarn npm audit --environment production` | `pnpm audit --prod` |
+| `yarn npm audit --environment production --all --recursive` | `pnpm audit --prod` |
 | `yarn bin x` | `pnpm bin x` |
 
 ## Configuration mapping
@@ -82,9 +82,26 @@ the docker build context.
 
 **Version drift in `--prod` installs.** `pnpm install --prod` on a
 node_modules tree from a *different* lockfile does not prune orphaned
-`.pnpm` directories. That is why catladder keys the pnpm node_modules
-cache by the lockfile instead of reusing a mutable slot — and why you
-should never reuse a yarn branch's cache for a pnpm branch.
+`.pnpm` directories — never reuse one branch's node_modules for another
+lockfile, and never a yarn tree for a pnpm branch.
+
+**Nothing is cached.** A yarn pipeline caches its zip cache and
+node_modules; a pnpm pipeline caches neither, and does not copy a store
+into docker images either. pnpm installs a 3800-package monorepo from
+the registry in 30-40s, which is less than it costs to move a 1 GB
+store or a 1.3 GB node_modules tree through a CI cache — measured
+side-by-side, caching made jobs about twice as slow on gitlab. Two
+consequences when migrating: CI pulls more from the registry than the
+yarn setup did (worth a registry proxy if that matters to you), and
+`.pnpm-store` should not appear anywhere in the repo or a build
+context.
+
+**Docker images must not carry the store.** If a store is copied into
+an image, it lands in a layer below `node_modules`, pnpm cannot hardlink
+across the overlay boundary, and every package is copied instead — the
+install gets *slower* (28s vs 10s from the registry) and the image
+carries the packages twice. Let the `--prod` install download, into a
+store outside the app directory that the same `RUN` layer deletes.
 
 **pnpm 11 needs node ≥ 22.13** (pnpm 10: ≥ 18.12), and it does not fail
 politely: it prints a `warn:` line and then crashes on
@@ -92,6 +109,15 @@ politely: it prints a `warn:` line and then crashes on
 job image ships node 22 — the jobs run `nvm install` from `.nvmrc`, so
 an `.nvmrc` of `20` downgrades the image right before the install.
 
+**`pnpm audit` needs no scope flags.** It audits every workspace and the
+whole transitive tree by default, which is what `yarn npm audit` only does
+with `--all --recursive` (without them it checks the current workspace's
+*direct* dependencies — in a monorepo root that is usually nothing at all).
+Expect the pnpm audit job to surface vulnerabilities the yarn one never
+reported. In return `--prod` is stricter than yarn's
+`--environment production`: yarn still reports a devDependency of a
+workspace, pnpm does not.
+
 **`minimumReleaseAge`** defaults to 1440 minutes on pnpm 11: freshly
 published versions are refused. Set it to `0` while migrating (it is a
 supply-chain feature worth enabling deliberately later, not something to

package/dist/bundles/skills/catladder-pipelines/SKILL.md

@@ -58,12 +58,13 @@ the registry.
 
 ## Caching
 
-Cache configuration is generated per build type; node builds cache
-`node_modules` and the package manager's download cache (the `.yarn`
-zip cache, or for pnpm projects a project-local `.pnpm-store`). GitLab
-uses mutable caches with
-fallback keys (review branches fall back to the dev cache); GitHub uses
-immutable lockfile-keyed caches where only the build job writes.
+Cache configuration is generated per build type. **yarn** node builds
+cache `node_modules` and the `.yarn` zip cache; GitLab uses mutable
+caches with fallback keys (review branches fall back to the dev cache),
+GitHub immutable lockfile-keyed caches where only the build job writes.
+**pnpm** builds cache nothing: measured on a 3800-package monorepo,
+moving the store or node_modules through a CI cache costs more than
+pnpm's from-registry install.
 Caching behavior is changed via the build config in `catladder.ts`,
 not in the YAML.
 

package/dist/packages/pipeline/src/build/node/buildJob.js

@@ -44,11 +44,14 @@ const createNodeDockerJobDefinition = async (context) => {
         (0, packageManagerInstall_1.getDockerAppCopyAndBuildScript)(context),
         context.packageManagerInfo,
     ]);
-    // the pnpm store (pulled via the cache above) is copied into the
-    // image so the prod install works offline — like the yarn zip cache,
-    // which travels inside the copied `.yarn` config folder
-    const copyPnpmStore = packageManagerInfo.type === "pnpm" &&
-        packageManagerInfo.componentIsInWorkspace;
+    // The pnpm store is deliberately NOT copied into the image. It used
+    // to be, so the prod install could link instead of hitting the
+    // registry — but the store lands in an earlier layer than
+    // node_modules, so pnpm cannot hardlink across the overlay boundary
+    // and copies every package instead. Measured on one component: the
+    // in-image install was *slower* that way (28s vs 10s from the
+    // registry), the store added 3GB to the build context and the final
+    // image, and the build took 339s instead of 27s.
     // pnpm copies every workspace manifest into the image — as individual
     // COPY instructions that many layers exceed docker's depth limit, so
     // the job tars them up and a single ADD extracts them
@@ -56,8 +59,6 @@ const createNodeDockerJobDefinition = async (context) => {
     const WORKSPACE_FILES_TAR = ".catladder-workspace-files.tar";
     return {
         script: [
-            // the COPY source must exist even when the cache was cold
-            ...(copyPnpmStore ? ["mkdir -p .pnpm-store"] : []),
             ...(isPnpm
                 ? [
                     `tar -cf ${WORKSPACE_FILES_TAR} ${packageManagerInfo.pathsToCopyInDocker.join(" ")}`,
@@ -74,14 +75,10 @@ const createNodeDockerJobDefinition = async (context) => {
                     `ADD ${WORKSPACE_FILES_TAR} /app/`,
                     // ADD does not apply --chown to extracted tars, and parent
                     // dirs of the entries come out root-owned — fix ownership
-                    // while the stage still runs as root (store not copied yet,
-                    // so this only touches the small manifest tree). Custom
-                    // base images without a node user run as root and don't
-                    // need it, hence the fallback
+                    // while the stage still runs as root (this only touches the
+                    // small manifest tree). Custom base images without a node
+                    // user run as root and don't need it, hence the fallback
                     `RUN chown -R node:node /app || true`,
-                    ...(copyPnpmStore
-                        ? [`COPY --chown=node:node .pnpm-store /app/.pnpm-store`]
-                        : []),
                 ].join("\n")
                 : packageManagerInfo.pathsToCopyInDocker
                     .map((dir) => `COPY --chown=node:node ${dir} /app/${dir}`)

package/dist/packages/pipeline/src/build/node/buildJob.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildJob.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/build/node/buildJob.ts"],"names":[],"mappings":";;;AAKA,iDAG6B;AAM7B,kCAA6E;AAC7E,+EAA4E;AAC5E,sCAAsE;AAEtE,mCAAqD;AACrD,mEAGiC;AAE1B,MAAM,mBAAmB,GAAG,KAAK,EACtC,OAAqD,EAC5B,EAAE;IAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,IAAA,+BAAwB,EAAC,OAAO,EAAE;YACvC,QAAQ,EAAE,MAAM,IAAA,oCAA4B,EAAC,OAAO,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAA,+BAAwB,EAAC,OAAO,EAAE;QACvC,QAAQ,EAAE,IAAA,2CAAiC,EAAC,OAAO,CAAC;YAClD,CAAC,CAAC,MAAM,IAAA,oCAA4B,EAAC,OAAO,CAAC;YAC7C,CAAC,CAAC,SAAS;QAEb,WAAW,EAAE,MAAM,IAAA,qCAA6B,EAAC,OAAO,CAAC;KAC1D,CAAC,CAAC;AACL,CAAC,CAAC;AAfW,QAAA,mBAAmB,uBAe9B;AAEK,MAAM,4BAA4B,GAAG,KAAK,EAC/C,OAAoE,EACxB,EAAE;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;IAEzC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3D,IAAA,gDAAwB,EAAC,OAAO,CAAC;QACjC,IAAA,oBAAY,EAAC,OAAO,CAAC;KACtB,CAAC,CAAC;IACH,OAAO,IAAA,mDAAwB,EAAC,OAAO,EAAE,WAAW,EAAE;QACpD,SAAS,EAAE,qBAAqB;QAChC,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAbW,QAAA,4BAA4B,gCAavC;AAIK,MAAM,6BAA6B,GAAG,KAAK,EAChD,OAAgB,EACmB,EAAE;IACrC,+DAA+D;IAC/D,MAAM,oBAAoB,GACxB,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,aAAa;QACzC,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,WAAW;QACrC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,CAAC;IAEb,MAAM,CAAC,SAAS,EAAE,2BAA2B,EAAE,kBAAkB,CAAC,GAChE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,IAAA,oBAAY,EAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,IAAA,sDAA8B,EAAC,OAAO,CAAC;QACvC,OAAO,CAAC,kBAAkB;KAC3B,CAAC,CAAC;IAEL,iEAAiE;IACjE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,aAAa,GACjB,kBAAkB,CAAC,IAAI,KAAK,MAAM;QAClC,kBAAkB,CAAC,sBAAsB,CAAC;IAE5C,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,MAAM,CAAC;IAClD,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;IAE7D,OAAO;QACL,MAAM,EAAE;YACN,0DAA0D;YAC1D,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC;oBACE,WAAW,mBAAmB,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;iBACrF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,IAAA,kDAAyC,EAC1C,OAAO,EACP,oBAAoB,CACrB;SACF;QACD,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;QACrB,SAAS,EAAE;YACT,+BAA+B;YAC/B,2BAA2B,EAAE,2BAA2B;YACxD,2BAA2B,EAAE,MAAM;gBACjC,CAAC,CAAC;oBACE,OAAO,mBAAmB,QAAQ;oBAClC,2DAA2D;oBAC3D,0DAA0D;oBAC1D,4DAA4D;oBAC5D,wDAAwD;oBACxD,wDAAwD;oBACxD,8BAA8B;oBAC9B,qCAAqC;oBACrC,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC,CAAC,qDAAqD,CAAC;wBACzD,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,IAAI,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,kBAAkB,CAAC,mBAAmB;qBACnC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,GAAG,SAAS,GAAG,EAAE,CAAC;qBACzD,IAAI,CAAC,IAAI,CAAC;YACjB,iEAAiE;YACjE,kDAAkD;YAClD,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC;oBACE,4BAA4B,EAAE,2BAA2B,kBAAkB,CAAC,OAAO,EAAE;iBACtF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC,CAAC;AA1EW,QAAA,6BAA6B,iCA0ExC"}
+{"version":3,"file":"buildJob.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/build/node/buildJob.ts"],"names":[],"mappings":";;;AAKA,iDAG6B;AAM7B,kCAA6E;AAC7E,+EAA4E;AAC5E,sCAAsE;AAEtE,mCAAqD;AACrD,mEAGiC;AAE1B,MAAM,mBAAmB,GAAG,KAAK,EACtC,OAAqD,EAC5B,EAAE;IAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,IAAA,+BAAwB,EAAC,OAAO,EAAE;YACvC,QAAQ,EAAE,MAAM,IAAA,oCAA4B,EAAC,OAAO,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAA,+BAAwB,EAAC,OAAO,EAAE;QACvC,QAAQ,EAAE,IAAA,2CAAiC,EAAC,OAAO,CAAC;YAClD,CAAC,CAAC,MAAM,IAAA,oCAA4B,EAAC,OAAO,CAAC;YAC7C,CAAC,CAAC,SAAS;QAEb,WAAW,EAAE,MAAM,IAAA,qCAA6B,EAAC,OAAO,CAAC;KAC1D,CAAC,CAAC;AACL,CAAC,CAAC;AAfW,QAAA,mBAAmB,uBAe9B;AAEK,MAAM,4BAA4B,GAAG,KAAK,EAC/C,OAAoE,EACxB,EAAE;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;IAEzC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3D,IAAA,gDAAwB,EAAC,OAAO,CAAC;QACjC,IAAA,oBAAY,EAAC,OAAO,CAAC;KACtB,CAAC,CAAC;IACH,OAAO,IAAA,mDAAwB,EAAC,OAAO,EAAE,WAAW,EAAE;QACpD,SAAS,EAAE,qBAAqB;QAChC,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAbW,QAAA,4BAA4B,gCAavC;AAIK,MAAM,6BAA6B,GAAG,KAAK,EAChD,OAAgB,EACmB,EAAE;IACrC,+DAA+D;IAC/D,MAAM,oBAAoB,GACxB,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,aAAa;QACzC,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,WAAW;QACrC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,CAAC;IAEb,MAAM,CAAC,SAAS,EAAE,2BAA2B,EAAE,kBAAkB,CAAC,GAChE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,IAAA,oBAAY,EAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,IAAA,sDAA8B,EAAC,OAAO,CAAC;QACvC,OAAO,CAAC,kBAAkB;KAC3B,CAAC,CAAC;IAEL,oEAAoE;IACpE,+DAA+D;IAC/D,0DAA0D;IAC1D,oEAAoE;IACpE,mEAAmE;IACnE,8DAA8D;IAC9D,oEAAoE;IACpE,iDAAiD;IAEjD,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,KAAK,MAAM,CAAC;IAClD,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;IAE7D,OAAO;QACL,MAAM,EAAE;YACN,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC;oBACE,WAAW,mBAAmB,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;iBACrF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,IAAA,kDAAyC,EAC1C,OAAO,EACP,oBAAoB,CACrB;SACF;QACD,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;QACrB,SAAS,EAAE;YACT,+BAA+B;YAC/B,2BAA2B,EAAE,2BAA2B;YACxD,2BAA2B,EAAE,MAAM;gBACjC,CAAC,CAAC;oBACE,OAAO,mBAAmB,QAAQ;oBAClC,2DAA2D;oBAC3D,0DAA0D;oBAC1D,4DAA4D;oBAC5D,0DAA0D;oBAC1D,yDAAyD;oBACzD,qCAAqC;iBACtC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,kBAAkB,CAAC,mBAAmB;qBACnC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,GAAG,SAAS,GAAG,EAAE,CAAC;qBACzD,IAAI,CAAC,IAAI,CAAC;YACjB,iEAAiE;YACjE,kDAAkD;YAClD,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC;oBACE,4BAA4B,EAAE,2BAA2B,kBAAkB,CAAC,OAAO,EAAE;iBACtF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC,CAAC;AAtEW,QAAA,6BAA6B,iCAsExC"}

package/dist/packages/pipeline/src/build/node/cache.d.ts

@@ -1,9 +1,14 @@
 import type { Context } from "../../types/context";
 import type { CacheConfig } from "../types";
 /**
- * the package manager's download cache: yarn's `.yarn` zip cache, or
- * pnpm's content-addressable store (which catladder points at a
- * project-local `.pnpm-store`, see the install script)
+ * the package manager's download cache: yarn's `.yarn` zip cache.
+ *
+ * pnpm gets nothing. Its store is a content-addressable tree of
+ * hundreds of thousands of small files, and moving it costs more than
+ * the install it saves: measured on a 3800-package monorepo, restoring
+ * the 1 GB store took ~53s on gitlab (which zips file by file) and
+ * ~23s on github, against a from-registry install of ~30-40s. See
+ * getNodeModulesCache for the node_modules half of the same finding.
  */
 export declare const getYarnCache: (context: Context, policy?: string) => Promise<CacheConfig[]>;
 export declare const getNodeModulesCache: (context: Context, policy?: string) => Promise<CacheConfig[]>;