This shared configuration for pnpm is intended to set some sane defaults for pnpm configurations.

The main concern it is trying to address is security. Using this config will not allow pnpm to run arbitrary scripts during dependency installation. Trusted dependencies must be manually vetted and added to the list in pnpmfile.mjs.

Installation

pnpm add --config pnpm-plugin-bettermarks

Configuring Renovate

Renovate will run pnpm commands without considering scripts or pnpmfiles. This means that it will drop the pnpmfileChecksum in pnpm-lock.yaml. To restore it, you can use this workflow that runs after renovate updates.

name: Renovate Post Update

on:
  pull_request:
    branches:
      - main
    paths:
      - pnpm-lock.yaml

  workflow_dispatch:

jobs:
  renovate-post-update:
    name: Renovate Post Update
    uses: bettermarks/pnpm-plugin/.github/workflows/patch-lockfile.yml@main
    secrets:
      NPM_PKG_GITHUB_COM_AUTH_TOKEN: ${{ secrets.NPM_PKG_GITHUB_COM_READ_AUTH_TOKEN }}
      NPM_FONTAWESOME_COM_AUTH_TOKEN: ${{ secrets.NPM_FONTAWESOME_COM_AUTH_TOKEN }}
      GH_TOKEN: ${{ secrets.GH_TOKEN }}