feat: Switch to pnpm for security reasons

.github/workflows/ci.yml

@@ -11,24 +11,26 @@ permissions:
 jobs:
   frontend:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         name: Checkout code
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
+        with:
+          package_json_file: ./frontend/package.json
+
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "25.x.x"
-
-      - name: Setup Aikido Safe Chain
-        working-directory: ./frontend
-        run: |
-          npm i -g @aikidosec/safe-chain
-          safe-chain setup-ci
+          cache: "pnpm"
+          cache-dependency-path: ./frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         working-directory: ./frontend
-        run: npm ci --safe-chain-skip-minimum-package-age
+        run: pnpm i --frozen-lockfile
 
       - name: Run Linter
         working-directory: ./frontend
@@ -52,6 +54,7 @@ jobs:
 
   backend:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         name: Checkout code

.github/workflows/e2e-tests.yml

@@ -14,19 +14,24 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
+        with:
+          package_json_file: ./frontend/package.json
+
       - name: Use Node.js 25.x
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 25.x
-          cache: "npm"
-          cache-dependency-path: ./e2e/package-lock.json
+          cache: "pnpm"
+          cache-dependency-path: ./e2e/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: npm ci --ignore-scripts
+        run: pnpm i --frozen-lockfile
         working-directory: ./e2e
 
       - name: Install Playwright Browsers
-        run: npx playwright install --with-deps chromium
+        run: pnpx playwright install --with-deps chromium
         working-directory: ./e2e
 
       - name: Run E2E tests

.github/workflows/labeler.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   label:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       contents: read
       pull-requests: write

.github/workflows/release.yml

@@ -13,6 +13,7 @@ env:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment: release
     permissions:
       contents: write
@@ -41,6 +42,7 @@ jobs:
     needs: release-please
     if: needs.release-please.outputs.new-release-created == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
       packages: write

AGENTS.md

@@ -13,7 +13,7 @@ The goal of OrcaCD is to be a simple, self-hosted GitOps solution for Docker Com
 
 ## Prerequisites
 
-Go 1.26+, golangci-lint v2.11+, `just`, Node.js 24.x or 25.x, npm.
+Go 1.26+, golangci-lint v2.11+, `just`, Node.js 24.x or 25.x, pnpm.
 
 ## Commands
 
@@ -43,12 +43,12 @@ go test -v -race ./internal/hub/crypto/...
 ### Frontend
 
 ```sh
-npm ci                 # install dependencies
-node --run dev         # Vite dev server on port 3000
-node --run build       # production bundle
-node --run typecheck   # TypeScript type check
-node --run lint        # oxlint
-node --run format      # oxfmt
+pnpm i --frozen-lockfile # install dependencies
+node --run dev           # Vite dev server on port 3000
+node --run build         # production bundle
+node --run typecheck     # TypeScript type check
+node --run lint          # oxlint
+node --run format        # oxfmt
 ```
 
 ### Local dev (Docker)

CONTRIBUTING.md

@@ -34,16 +34,16 @@ For breaking changes or major new features, open an issue beforehand to discuss
 
 **Frontend:**
 
-| Tool                           | Version           | Purpose         |
-| ------------------------------ | ----------------- | --------------- |
-| [Node.js](https://nodejs.org/) | 24.x or 25.x      | Runtime         |
-| [npm](https://docs.npmjs.com/) | bundled with Node | Package manager |
+| Tool                           | Version       | Purpose         |
+| ------------------------------ | ------------- | --------------- |
+| [Node.js](https://nodejs.org/) | 24.x or 25.x  | Runtime         |
+| [pnpm](https://pnpm.io/)       | 11.x or newer | Package manager |
 
 ### Setting up the development environment
 
 1. Install all required tools listed above.
 2. Clone the repository and navigate to the project directory.
-3. For the frontend, navigate to the `frontend/` directory and run `npm ci` to install dependencies.
+3. For the frontend, navigate to the `frontend/` directory and run `pnpm i --frozen-lockfile` to install dependencies.
 4. Run the frontend development server with `node --run dev` from the `frontend/` directory.
 5. Copy the `.env.dev.example` file in the `backend/` directory to `.env` and adjust any necessary environment variables.
 6. Run the backend services with `just run-hub` and `just run-agent` in the `backend/` directory.

e2e/package.json

@@ -14,5 +14,6 @@
 	},
 	"engines": {
 		"node": ">=24.0.0"
-	}
+	},
+	"packageManager": "pnpm@11.1.1"
 }

e2e/pnpm-workspace.yaml

@@ -0,0 +1,6 @@
+ignorePnpmfile: true
+blockExoticSubdeps: true
+minimumReleaseAge: 2880 # 2 days
+trustPolicy: no-downgrade
+trustPolicyIgnoreAfter: 5760 # 4 days
+ignoreScripts: true