Skip to content

Release: v1.0.0 #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Release: v1.0.0 #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c5b84dd
Initial plan
Copilot Oct 2, 2025
bc7fe6e
Phase 1: Update package.json, add .npmrc, generate pnpm-lock.yaml, fi…
Copilot Oct 2, 2025
f9fc456
Phase 2: Update Dockerfile to use pnpm instead of yarn
Copilot Oct 2, 2025
7e7c0ce
Phase 3 & 4: Update CI/CD workflows and documentation for pnpm
Copilot Oct 2, 2025
c09511f
Update .gitignore to reflect pnpm usage and ignore npm/yarn lock files
Copilot Oct 2, 2025
fa3c2a0
Fix GitHub Actions workflow - setup pnpm before Node.js for proper ca…
Copilot Oct 2, 2025
8ade4a2
✨ tweak: update pnpm version to 9.15.4
warengonzaga Oct 3, 2025
9a52c61
✨ tweak: migrate from yarn to pnpm package manager
warengonzaga Oct 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .github/workflows/validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,25 @@ jobs:
- name: Checkout code
uses: actions/checkout@v4

- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
version: 9.15.4

- name: Setup Node.js
uses: actions/setup-node@v4
Comment on lines 14 to 22
Copy link

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For supply-chain security, pin actions to a full commit SHA instead of a floating tag. Replace @v4 with the corresponding immutable SHA from the action's releases.

Suggested change
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
version: 9.15.4
- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/checkout@v4.1.6 # 4.1.6 is the latest v4 release as of June 2024
- name: Setup pnpm
uses: pnpm/action-setup@v4.0.0 # 4.0.0 is the latest v4 release as of June 2024
with:
version: 9.15.4
- name: Setup Node.js
uses: actions/setup-node@v4.0.2 # 4.0.2 is the latest v4 release as of June 2024

Copilot uses AI. Check for mistakes.
with:
node-version: '20'
cache: 'yarn'
cache: 'pnpm'

- name: Install dependencies
run: yarn install --frozen-lockfile
run: pnpm install --frozen-lockfile

- name: Type checking
run: yarn type-check
run: pnpm type-check

- name: Build TypeScript
run: yarn build
run: pnpm build

- name: Test Docker build (no push)
run: |
Expand Down
3 changes: 2 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,8 +132,9 @@ Thumbs.db
docs/
ai_context/

# Enforce Yarn usage - ignore npm lockfile
# Enforce pnpm usage - ignore npm and yarn lockfiles
package-lock.json
yarn.lock

# Environment files with sensitive data
.env
Expand Down
13 changes: 13 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# pnpm configuration
# Use shamefully-hoist to make peer dependencies available
# This resolves TypeScript type inference issues with nested dependencies
shamefully-hoist=true

# Public hoist pattern - hoist @redis packages to resolve TypeScript type issues
public-hoist-pattern[]=@redis/*

# Auto-install peers to prevent missing peer dependency warnings
auto-install-peers=true

# Use strict peer dependencies to maintain dependency integrity
strict-peer-dependencies=false
Copy link

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment contradicts the configuration: strict-peer-dependencies=false disables strict peer dependency enforcement. Update the comment or set strict-peer-dependencies=true to match the stated intent.

Suggested change
strict-peer-dependencies=false
strict-peer-dependencies=true

Copilot uses AI. Check for mistakes.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Sir, I've detected a rather amusing contradiction in the documentation.

The comment states "Use strict peer dependencies to maintain dependency integrity" whilst the setting is strict-peer-dependencies=false, which does quite the opposite. This setting actually disables strict peer dependency checking, permitting version mismatches that auto-install-peers might introduce.

May I suggest a more accurate comment, Sir?

-# Use strict peer dependencies to maintain dependency integrity
+# Disable strict peer dependencies to allow auto-install-peers flexibility
 strict-peer-dependencies=false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
strict-peer-dependencies=false
# Disable strict peer dependencies to allow auto-install-peers flexibility
strict-peer-dependencies=false
🤖 Prompt for AI Agents 
.npmrc around line 13: the inline comment claims "Use strict peer dependencies
to maintain dependency integrity" but the config sets
strict-peer-dependencies=false, which contradicts that statement; either flip
the value to true to enable strict peer dependency checks or update the comment
to accurately state that strict peer dependency checking is disabled (e.g.,
"Disable strict peer dependency checking to allow auto-install-peers to resolve
mismatches"); make the file consistent by choosing one of those two options and
applying the matching value and comment.

4 changes: 0 additions & 4 deletions .yarnrc
View file
Open in desktop

This file was deleted.

24 changes: 12 additions & 12 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,9 +26,9 @@ To get started with development:

2. **Install dependencies**
```bash
yarn install
pnpm install
```
> ⚠️ **Important**: This project enforces the use of Yarn. npm install will be blocked automatically.
> ⚠️ **Important**: This project enforces the use of pnpm. npm and yarn install will be blocked automatically.

3. **Set up environment variables**
- Copy `.env.example` to `.env`
Expand All @@ -52,7 +52,7 @@ To get started with development:

5. **Start the project in development mode**
```bash
yarn dev
pnpm dev
```

Please refer to the [README](./README.md) for more detailed setup instructions.
Expand All @@ -61,19 +61,19 @@ Please refer to the [README](./README.md) for more detailed setup instructions.

```bash
# Development with auto-reload
yarn dev
pnpm dev

# Build for production
yarn build
pnpm build

# Type checking only
yarn type-check
pnpm type-check

# Clean build artifacts
yarn clean
pnpm clean

# Start production build
yarn start
pnpm start
```

#### 🏛️ Project Structure
Expand Down Expand Up @@ -103,7 +103,7 @@ src/
- **TypeScript First**: All code must be written in TypeScript with strict type checking
- **Structured Logging**: Use `@wgtechlabs/log-engine` for all logging with built-in PII protection and security features
- **Error Handling**: Implement comprehensive error handling with detailed logging
- **Package Manager**: Use Yarn exclusively (enforced via preinstall script)
- **Package Manager**: Use pnpm exclusively (enforced via preinstall script)
- **Code Style**: Follow existing patterns and maintain consistency
- **Environment**: Use Node.js 20+ for development
- **Redis Integration**: Ensure Redis connectivity for all webhook-related features
Expand All @@ -122,9 +122,9 @@ While this project doesn't currently have a test suite, when contributing:
#### 🔍 Code Review Process

1. **Pre-submission checks**:
- [ ] Code builds without errors (`yarn build`)
- [ ] TypeScript type checking passes (`yarn type-check`)
- [ ] Development server starts successfully (`yarn dev`)
- [ ] Code builds without errors (`pnpm build`)
- [ ] TypeScript type checking passes (`pnpm type-check`)
- [ ] Development server starts successfully (`pnpm dev`)
- [ ] Redis integration works properly
- [ ] Error handling is comprehensive

Expand Down
20 changes: 13 additions & 7 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,10 @@ RUN apk update && apk upgrade && \
apk add --no-cache dumb-init && \
rm -rf /var/cache/apk/*

# Enable and install pnpm via corepack
RUN corepack enable && \
corepack prepare pnpm@latest --activate
Copy link

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using pnpm@latest makes builds non-deterministic. Pin pnpm to the same version declared in package.json (packageManager: \"[email protected]\") for reproducible builds, e.g., corepack prepare [email protected] --activate.

Suggested change
corepack prepare pnpm@latest --activate
corepack prepare pnpm@9.15.4 --activate

Copilot uses AI. Check for mistakes.
Comment on lines +37 to +39
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Sir, I must bring a critical inconsistency to your attention.

The Dockerfile installs pnpm@latest via Corepack, whilst package.json specifies [email protected]. This version drift will cause subtle build inconsistencies between local development and containerized deployments, potentially invalidating Railway cache mounts and introducing hard-to-diagnose dependency resolution differences.

I strongly recommend pinning to the same version specified in package.json:

 # Enable and install pnpm via corepack
 RUN corepack enable && \
-    corepack prepare pnpm@latest --activate
+    corepack prepare [email protected] --activate

This ensures perfect parity across all development and deployment environments, Sir.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Enable and install pnpm via corepack
RUN corepack enable && \
corepack prepare pnpm@latest --activate
# Enable and install pnpm via corepack
RUN corepack enable && \
corepack prepare pnpm@9.15.4 --activate
🤖 Prompt for AI Agents 
In Dockerfile around lines 37 to 39, the Dockerfile uses corepack to prepare
pnpm@latest which conflicts with package.json pin of [email protected]; change the
corepack prepare command to explicitly pin the same version ([email protected]) so
container builds match local development, e.g. use corepack prepare [email protected]
--activate, and add a short comment noting this must be kept in sync with
package.json (or read the version from package.json during Docker build if you
prefer a single source of truth).


# Set working directory for all subsequent stages
WORKDIR /usr/src/app

Expand All @@ -46,9 +50,10 @@ FROM base AS deps
# Use bind mounts and cache for faster builds
# Downloads dependencies without copying package files into the layer
RUN --mount=type=bind,source=package.json,target=package.json \
--mount=type=bind,source=yarn.lock,target=yarn.lock \
--mount=type=cache,id=s/${RAILWAY_SERVICE_ID}-yarn-cache,target=/root/.yarn \
yarn install --production --frozen-lockfile
--mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
--mount=type=bind,source=.npmrc,target=.npmrc \
--mount=type=cache,id=s/${RAILWAY_SERVICE_ID}-pnpm-store,target=/root/.local/share/pnpm/store \
pnpm install --prod --frozen-lockfile

# =============================================================================
# STAGE 3: Build Application
Expand All @@ -58,13 +63,14 @@ FROM deps AS build

# Install all dependencies (including devDependencies for building)
RUN --mount=type=bind,source=package.json,target=package.json \
--mount=type=bind,source=yarn.lock,target=yarn.lock \
--mount=type=cache,id=s/${RAILWAY_SERVICE_ID}-yarn-cache,target=/root/.yarn \
yarn install --frozen-lockfile
--mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
--mount=type=bind,source=.npmrc,target=.npmrc \
--mount=type=cache,id=s/${RAILWAY_SERVICE_ID}-pnpm-store,target=/root/.local/share/pnpm/store \
pnpm install --frozen-lockfile

# Copy source code and build the application
COPY . .
RUN yarn run build
RUN pnpm run build

# =============================================================================
# STAGE 4: Final Runtime Image
Expand Down
18 changes: 9 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,11 @@ These outstanding organizations partner with us to support our open-source work:

## 🚀 Quick Start

**Requirements**: Node.js 20+, Redis, Yarn
**Requirements**: Node.js 20+, Redis, pnpm

```bash
# 1. Install dependencies
yarn install
pnpm install

# 2. Configure environment
cp .env.example .env
Expand All @@ -37,8 +37,8 @@ sudo systemctl start redis-server # Linux
docker run -d -p 6379:6379 redis:alpine # Docker

# 4. Run the server
yarn dev # Development with auto-reload
yarn start # Production mode
pnpm dev # Development with auto-reload
pnpm start # Production mode
```

Server runs on `http://localhost:3000` with endpoints:
Expand Down Expand Up @@ -209,11 +209,11 @@ Events are queued with this enhanced structure:
### Build Commands

```bash
yarn clean # Clean previous builds
yarn build # Build for production
yarn type-check # TypeScript type checking only
yarn dev # Development with hot-reload
yarn start # Run production build
pnpm clean # Clean previous builds
pnpm build # Build for production
pnpm type-check # TypeScript type checking only
pnpm dev # Development with hot-reload
pnpm start # Run production build
```

### Project Structure
Expand Down
6 changes: 3 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@
"main": "dist/app.js",
"engines": {
"node": ">=20.0.0",
"yarn": ">=1.22.0"
"pnpm": ">=8.0.0"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

🧩 Analysis chain

The package manager configuration appears properly structured, Sir.

The migration from Yarn 1.22.22 to pnpm 9.15.4 is consistently applied across engines requirements, preinstall enforcement, and packageManager field. The version constraint >=8.0.0 provides reasonable forward compatibility whilst the pinned 9.15.4 ensures reproducible environments.

However, Sir, I've noticed the Dockerfile references pnpm@latest rather than the pinned 9.15.4 version. This could introduce build inconsistencies between local development and containerized deployments. Shall we verify version alignment across all installation points?

Also applies to: 27-27, 52-52

🏁 Script executed:

#!/bin/bash
# Description: Verify pnpm version consistency across project files

echo "=== Checking pnpm version references ==="

# Check package.json
echo -e "\n📦 package.json:"
rg -A 1 '"pnpm":|"packageManager":' package.json

# Check Dockerfile
echo -e "\n🐳 Dockerfile:"
rg 'pnpm@' Dockerfile

# Check GitHub workflows
echo -e "\n⚙️ GitHub workflows:"
rg 'version:.*[0-9]' .github/workflows/validate.yml | grep -i pnpm

# Check .npmrc for any version specifications
echo -e "\n📝 .npmrc:"
rg 'pnpm' .npmrc || echo "No pnpm version specified in .npmrc"

Length of output: 239

Pin pnpm version in Dockerfile and workflows
Sir, the Dockerfile invokes pnpm@latest and the CI workflow lacks a pinned version—align both to 9.15.4 for reproducible builds.

🤖 Prompt for AI Agents 
In package.json around line 24, the pnpm engine is loose (">=8.0.0") while
Dockerfile and CI use unpinned/latest pnpm; pin pnpm to 9.15.4 for reproducible
builds by: update the Dockerfile to install or reference [email protected] (e.g., use
corepack to enable and set pnpm 9.15.4 or run npm/pnpm install -g [email protected]),
modify CI workflows to pin the action/setup step to install [email protected] (or add
a step that runs npm/pnpm install -g [email protected] before install commands), and
optionally update package.json engines to "pnpm": "9.15.4" (or a strict range
that includes only 9.15.4) so all three places are consistent.

},
"scripts": {
"preinstall": "npx only-allow yarn",
"preinstall": "npx only-allow pnpm",
"build": "tsc",
"start": "node dist/app.js",
"dev": "nodemon --exec ts-node src/app.ts",
Expand All @@ -49,5 +49,5 @@
"ts-node": "^10.9.2",
"typescript": "^5.8.3"
},
"packageManager": "[email protected]"
"packageManager": "[email protected]"
}
Loading