Migrate monorepo from Yarn to pnpm (#2069)

* Migrate GitHub Actions workflows to pnpm install actions

* Fix invalid pnpm workspace commands in CI workflows

* pipeline fixes

* update to pnpm v11

* fix pipelines

* fixes

* update pnpm

* fix paths

* fix tsup

* remove dupe mock

* override jsdom pkg

* fix types

* fix types

* fix some prs

* workflow fixes

* fix building with overriedses

* more pipeline fixes

* fixes

* fix react

* fix test

* remove yarn artifacts

* fix(pnpm): add packageExtensionsChecksum to lockfile

CI's frozen install computes a checksum from the packageExtensions block
in pnpm-workspace.yaml and rejects the lockfile because none was written
when the field was added. Pin the checksum so --frozen-lockfile passes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* try again

* fix types

* fix tests

* fixes

* add follow up spec

* update agent files

* pipeline fixes

* fix mock

* fix oom issues

* fix caching issue

* fix pipelines

* format

* dedupe

* fix tests

* fix android build

* fix ios

* update spec

* update pnpm tooling specs

* Honor CI_FORCE_RUN sentinel in check_changes-gated workflows

Add the sentinel to the diff allowlist in circuits, core-sdk, contracts,
and qrcode-sdk so editing .github/CI_FORCE_RUN actually forces them to
run on dev-base PRs. Clarify scope/limits in the sentinel doc and
AGENTS.md, and add a --check mode to the helper script.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix vercel deploys

* Force-run CI on PR #2069 and unblock skipped jobs

- Re-enable web-build, workspace-format-check, workspace-test (were if:
  false). check-and-deploy in mobile-deploy-auto stays disabled — its
  comment says it doesn't work as expected.
- Add a debug job in Core SDK CI that echoes needs.check_changes.outputs
  .should_run, pull_request.draft, and event_name so we can diagnose why
  downstream jobs skip despite should_run=true.
- Bump CI_FORCE_RUN to trigger a fresh run of all path-filtered
  workflows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Address PR review comments on #2069

- core-sdk-ci (P1, codex): always install deps in lint/types/test; the
  build cache restores only common/dist and sdk/core/dist, so skipping
  pnpm install on cache hit left the runner with no node_modules.
- mobile-setup (P2, greptile): replace --prod=false with --no-prod.
- cache-pnpm (P2, greptile): document the store path assumption.
- native-shells-ci (Major, coderabbit): mirror the CI_FORCE_RUN sentinel
  into the dorny/paths-filter filters so editing the sentinel alone
  actually runs android/ios jobs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fixes

* format

* fixes

* fixes

* fixes

* fixes

* upgrade pnpm

* fix format

* update lock

* check for more script conversion opportunities

* upgrade pnpm version

* convert format scripts

* format

* fix circuits tests

* fixes

* Stabilize CI tests and add circom tester compat shim

* fixes

* fix pr

* updates

* update lock

* Merge dev: resolve SelfQRcode conflict, fix circom shim loadSymbols

The circom_tester compat shim was throwing 'Unable to resolve witness
index for signal' because circuit.symbols is only populated by
loadSymbols(). Call it before reading the table.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* update lock

* formatting

* update lock file

* revert test shim

* test circuits ci

* update specs

* prettier fixes

* update spec

* simplify pnpm version tracking

* sort package json files

* dedupe

* convert npm to pnpm

* simplify include paths

* match jest

* dedupe

* update spec

* revert jest for now. wait for rn upgrade

* claude feedback

* update pnpm and install files

* downgrade and dedupe

* update lock

* remove old web logic

* update mt spec

* remove additional web artifacts

* pnpm upgrade

* add optimize script

* update packages

* format

* update lock after merge

* formatting and type fix

* update react and types

* update lockfile

* fix ci pipelines

* formatting

* pin package to fix formatting issues

* upgrade packages

* fix pipelines again

* Fix Android CI pipeline failures

* convert scripts from yarn to pnpm

* format

* fix prettier

* fix(ci): keep typechain on prettier 2.x; reformat sol for prettier 3.8.3

The global `prettier: 3.8.3` override forced typechain@8's internal prettier
to v3, whose format() is async. typechain calls it synchronously and writes
the returned Promise to disk, crashing sdk/core's build with
"The data argument ... Received an instance of Promise". This cascaded into
Workspace CI, Common CI type-check, and Core SDK CI. Scope the override
(typechain>prettier: 2.8.8) so typechain keeps prettier 2.x's sync format().

Separately, pinning prettier to 3.8.3 reflows 5 contracts .sol files vs the
versions committed under yarn's older prettier; reformat them so Contracts CI
prettier:check passes. Changes are token-identical line-wrapping only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* debug(ci): print full format diff to diagnose SPEC.md mismatch

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: exclude markdown from format gate

Prettier aligns markdown tables by display width, which differs across OS
for East-Asian-Width-ambiguous glyphs (em-dash U+2014, arrow U+2192). The
Linux CI runner measures them wider than macOS, so committed-on-Mac tables
show spurious reformatting diffs on CI (e.g. analytics/SPEC.md).

Keep markdown in `pnpm format` but stop .md drift from failing the gate;
other languages still fail as before. Reverts the temporary debug diff dump.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* update lock

* sort

* formatting

* fix formatting

* fix merge conflicts; update pnpm

* pnpm dedupe

---------

Co-authored-by: Justin Hernandez <jmh@Justins-MacBook-Air.local>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/CI_FORCE_RUN

@@ -0,0 +1,43 @@
+# CI Force-Run Sentinel
+
+Every path-filtered CI workflow under `.github/workflows/` lists this file
+in its `paths:` filter (or, for workflows with an internal `check_changes`
+gate, in its diff allowlist). Editing this file forces those workflows to
+run on the next push, which is useful when:
+
+- Migrating tooling (package manager, Node version, monorepo runner)
+- Refactoring shared `.github/actions/*` composite actions
+- Pre-merge confidence check on a large branch
+- Verifying that a workflow you _think_ is unrelated to your changes still
+  passes
+
+## Scope and limitations
+
+- Triggers path-filtered `pull_request` / `push` workflows only.
+- Does **not** trigger workflows gated on `workflow_dispatch` / `schedule`
+  only (e.g. `release-calendar.yml`), nor workflows whose `push:` event
+  filters this branch out (e.g. `npm-publish.yml` only runs on `push` to
+  `dev`).
+- Jobs guarded by `if: github.event.pull_request.head.repo.fork == false`
+  still skip on fork PRs by design (secrets are not exposed to forks).
+- Jobs hard-disabled with `if: false` stay disabled regardless of the
+  sentinel.
+
+Run `python3 scripts/ci/add-force-run-sentinel.py --check` to verify that
+every workflow with a `paths:` block lists this sentinel and that internal
+`check_changes` allowlists include it too.
+
+## How to use
+
+1. Add a one-line entry to the log below with date + reason.
+2. Commit on your branch. Path-filtered CI workflows will run on the PR.
+3. After verification, you may revert the entry before merge (optional —
+   the file is intentionally low-churn; leaving entries as a history is
+   also fine).
+
+## Log
+
+- 2026-05-13 — Force-run all workflows to verify Yarn → pnpm migration
+  (PR #2069).
+- 2026-05-13 — Re-trigger after enabling check_changes sentinel + debug
+  step + re-enabling web/workspace jobs (PR #2069).

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,13 +14,13 @@
 
 Run each command and check the box only after it passes. Paste failures into the Test plan.
 
-- [ ] `yarn lint && yarn types` pass
-- [ ] Bridge contract tests pass: `cd app && yarn jest:run` and `yarn workspace @selfxyz/rn-sdk-test-app test`
-- [ ] If `packages/mobile-sdk-alpha` touched: `cd packages/mobile-sdk-alpha && yarn test && yarn types` pass
-- [ ] Diff of `.kt`/`.swift` reviewed — no business logic added (only hardware/OS access; logic lives in TypeScript)
+- [ ] `pnpm lint && pnpm types` pass
+- [ ] Bridge contract tests pass: `cd app && pnpm jest:run` and `pnpm --filter @selfxyz/rn-sdk-test-app test`
+- [ ] If `packages/mobile-sdk-alpha` touched: `pnpm --filter @selfxyz/mobile-sdk-alpha test && pnpm --filter @selfxyz/mobile-sdk-alpha types` pass
+- [ ] Diff of `.kt`/`.swift` reviewed - no business logic added (only hardware/OS access; logic lives in TypeScript)
 - [ ] NativeModules bridge contract (method names, payload keys, error codes) unchanged, or the change is intentional and described in the summary
 
-**Cannot be verified by an agent — flag for human QA:**
+**Cannot be verified by an agent - flag for human QA:**
 
-- [ ] Native builds (app + RN test app, iOS + Android) — relying on CI, or needs a human local build
-- [ ] On-device smoke test of the affected flow (e.g. NFC passport read, MRZ camera scan) — **needs human**, or N/A if no runtime behavior changed
+- [ ] Native builds (app + RN test app, iOS + Android) - relying on CI, or needs a human local build
+- [ ] On-device smoke test of the affected flow (e.g. NFC passport read, MRZ camera scan) - **needs human**, or N/A if no runtime behavior changed

.github/actions/cache-core-sdk-build/action.yml

@@ -29,9 +29,6 @@ runs:
         path: |
           common/dist
           sdk/core/dist
-          node_modules
-          sdk/core/node_modules
-          common/node_modules
         key: core-sdk-build-${{ inputs.cache-version }}-${{ github.sha }}
         fail-on-cache-miss: ${{ inputs.fail-on-cache-miss }}
     - id: save
@@ -41,7 +38,4 @@ runs:
         path: |
           common/dist
           sdk/core/dist
-          node_modules
-          sdk/core/node_modules
-          common/node_modules
         key: core-sdk-build-${{ inputs.cache-version }}-${{ github.sha }}

.github/actions/cache-mobile-sdk-build/action.yml

@@ -29,9 +29,6 @@ runs:
         path: |
           common/dist
           packages/mobile-sdk-alpha/dist
-          node_modules
-          packages/mobile-sdk-alpha/node_modules
-          common/node_modules
         key: mobile-sdk-alpha-build-${{ inputs.cache-version }}-${{ github.sha }}
         fail-on-cache-miss: ${{ inputs.fail-on-cache-miss }}
     - id: save
@@ -41,7 +38,4 @@ runs:
         path: |
           common/dist
           packages/mobile-sdk-alpha/dist
-          node_modules
-          packages/mobile-sdk-alpha/node_modules
-          common/node_modules
         key: mobile-sdk-alpha-build-${{ inputs.cache-version }}-${{ github.sha }}

.github/actions/cache-pnpm/action.yml

@@ -0,0 +1,46 @@
+name: Cache PNPM
+
+description: Cache the pnpm content-addressable store. Do not cache node_modules — pnpm uses `.modules.yaml` as an up-to-date marker and will skip re-linking workspace packages if a partial node_modules tree is restored.
+
+inputs:
+  lock-file:
+    description: Path to pnpm-lock.yaml
+    required: false
+    default: pnpm-lock.yaml
+  cache-version:
+    description: Additional cache version segment
+    required: false
+    default: v2
+
+outputs:
+  cache-hit:
+    description: Whether an exact match was found for the cache key
+    value: ${{ steps.cache.outputs.cache-hit }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: get-hash
+      name: Hash lock file
+      shell: bash
+      run: |
+        if [ -f "${{ inputs.lock-file }}" ]; then
+          echo "hash=$(shasum -a 256 "${{ inputs.lock-file }}" | awk '{ print $1 }')" >> $GITHUB_OUTPUT
+        else
+          echo "::warning::Lock file '${{ inputs.lock-file }}' not found."
+          echo "hash=no-lock-file" >> $GITHUB_OUTPUT
+        fi
+    - id: cache
+      name: Cache pnpm store
+      uses: actions/cache@v4
+      with:
+        # Default pnpm store locations on Linux/macOS. If PNPM_HOME is set or
+        # pnpm changes its default store path in a future release, update
+        # these paths or invoke `pnpm store path --silent` dynamically.
+        path: |
+          ~/.local/share/pnpm/store
+          ~/Library/pnpm/store
+        key: ${{ runner.os }}-pnpm-store-${{ inputs.cache-version }}-${{ steps.get-hash.outputs.hash }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-${{ inputs.cache-version }}-
+          ${{ runner.os }}-pnpm-store-

.github/actions/cache-yarn/action.yml

@@ -0,0 +1,35 @@
+name: Check Nested Requires
+description: Fail CI if tests contain nested require() patterns that can trigger OOMs.
+
+inputs:
+  paths:
+    description: Newline-separated list of paths to scan.
+    required: true
+  pattern:
+    description: Extended regular expression to search for.
+    required: false
+    default: "require\\(['\"]react(-native)?['\"]\\)"
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        CHECK_PATHS: ${{ inputs.paths }}
+        CHECK_PATTERN: ${{ inputs.pattern }}
+      run: |
+        set -euo pipefail
+
+        paths=()
+        while IFS= read -r path; do
+          if [[ -n "$path" ]]; then
+            paths+=("$path")
+          fi
+        done <<< "$CHECK_PATHS"
+
+        if grep -rE "$CHECK_PATTERN" -- "${paths[@]}" 2>/dev/null; then
+          echo "❌ Found nested require() patterns that cause OOM in CI"
+          exit 1
+        fi
+
+        echo "✅ No nested require() patterns found"

.github/actions/check-nested-requires/action.yml

@@ -57,28 +57,28 @@ runs:
       run: |
         cd ${{ inputs.app_path }}
 
-        # Configure Yarn
+        # Configure pnpm
         corepack enable
-        yarn set version 4.12.0
 
         echo "📦 Installing JavaScript dependencies with strict lock file..."
-        if ! yarn install --immutable --inline-builds; then
+        # Force full dependency installation even when workflows export NODE_ENV=production.
+        if ! NODE_ENV=development pnpm install --frozen-lockfile --no-prod; then
           echo ""
-          echo "❌ ERROR: yarn.lock is out of date!"
+          echo "❌ ERROR: pnpm-lock.yaml is out of date!"
           echo ""
-          echo "This happens when package.json was modified but yarn.lock wasn't updated."
+          echo "This happens when package.json was modified but pnpm-lock.yaml wasn't updated."
           echo ""
           echo "To fix this:"
-          echo "  1. Run 'yarn install' locally in the app directory"
-          echo "  2. Commit the updated yarn.lock file"
+          echo "  1. Run 'pnpm install' locally at the repository root"
+          echo "  2. Commit the updated pnpm-lock.yaml file"
           echo "  3. Push your changes"
           echo ""
           echo "This ensures everyone has the exact same dependency versions."
           exit 1
         fi
 
-        # Run mobile-specific installation
-        yarn install-app:mobile-deploy
+        # Run mobile-specific installation with full dependency graph as well.
+        NODE_ENV=development pnpm install-app:mobile-deploy
 
     - name: Install Ruby dependencies
       shell: bash

.github/actions/mobile-setup/action.yml

@@ -1,6 +1,6 @@
-name: Yarn Install
+name: PNPM Install
 
-description: Install Yarn v4 and run yarn install.
+description: Install pnpm and run pnpm install.
 
 inputs:
   working_directory:
@@ -11,27 +11,21 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Yarn v4
-      shell: bash
-      run: |
-        corepack enable
-        corepack prepare yarn@4.12.0 --activate
-        # Ensure we're using the correct version
-        yarn --version
-
     - name: Setup Node.js
       uses: actions/setup-node@v4
       with:
         node-version-file: .nvmrc
-        cache: "yarn"
-        cache-dependency-path: |
-          yarn.lock
-          .yarnrc.yml
+
+    - name: Install pnpm
+      shell: bash
+      run: |
+        corepack enable
+        pnpm --version
 
     - name: Install dependencies
       uses: nick-fields/retry@v3
       with:
         timeout_minutes: 10
         max_attempts: 3
         retry_wait_seconds: 5
-        command: yarn install --immutable
+        command: pnpm install --frozen-lockfile