feat: use pnpm instead of npm

.devcontainers/devcontainer.json

@@ -27,18 +27,18 @@
                     "davidanson.vscode-markdownlint"
                 ]
             }
-    },
+        }
+	},
 	// Use 'forwardPorts' to make a list of ports inside the container available locally.
 	"forwardPorts": [
 		1313
 	],
 	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "npm install",
+	"postCreateCommand": "pnpm install",
 	// Uncomment to use Docker from inside the container. See https://aka.ms/vscode-remote/samples/docker-from-docker.
 	// "mounts": [ "source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind" ],
 	// Uncomment when using a ptrace-based debugger like C++, Go, and Rust
 	// "runArgs": [ "--cap-add=SYS_PTRACE", "--security-opt", "seccomp=unconfined" ],
 	// Uncomment to connect as a non-root user. See https://aka.ms/vscode-remote/containers/non-root.
 	"remoteUser": "vscode"
-    }
 }

.github/workflows/test.yml

@@ -39,8 +39,11 @@ jobs:
         id: pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
       - name: Install Node.js dependencies
-        run: "[[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true"
+        run: pnpm install --frozen-lockfile
 
       - name: Build with Hugo
         env:
@@ -51,7 +54,7 @@ jobs:
           hugo --gc --minify --baseURL "${{ steps.pages.outputs.base_url }}/"
           hugo -s subsite/docs --baseURL "${{ steps.pages.outputs.base_url }}/docs/"
           mv subsite/docs/public public/docs
-          npx -y pagefind --site public
+          pnpm exec pagefind --site public
 
       - name: Restore lychee cache
         id: restore-cache

README.md

@@ -10,10 +10,10 @@ The generated website is automatically updated at https://coreruleset.org/. If y
 ## Requirements
 
 You can edit the documentation on your local system. You will need:
-- [Node.js and npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) for installing dependencies
+- [Node.js and pnpm](https://pnpm.io) for installing dependencies
 - [dart-sass](https://github.com/sass/dart-sass) for transpiling to CSS
 
-`npm install` pulls in Hugo _extended_ as the `hugo-extended` package, so the npm scripts below work without a system-wide install. If you prefer your own [Hugo binary](https://gohugo.io/getting-started/installing/), it must be the **extended** build.
+`pnpm install` pulls in Hugo _extended_ as the `hugo-extended` package, so the pnpm scripts below work without a system-wide install. If you prefer your own [Hugo binary](https://gohugo.io/getting-started/installing/), it must be the **extended** build.
 
 **Important: You need Hugo _extended_ >= 0.163.0** — the version CI builds with is pinned in `package.json` and `.github/workflows/test.yml`.
 
@@ -40,7 +40,7 @@ If you just want to edit documentation (not the website), you can do it in the [
 Install the dependencies once:
 
 ```sh
-npm install
+pnpm install
 ```
 
 Now you have all in place to perform your local edits.
@@ -52,7 +52,7 @@ The theme has shortcodes that can be used to simplify editing. You can get more
 Then start the development server — while you edit and save, your changes are refreshed in the browser:
 
 ```sh
-npm run dev
+pnpm dev
 ```
 
 Then check your edits on http://localhost:1313/. Drafts and future-dated posts are included, so you can preview a post before its publication date.
@@ -61,10 +61,10 @@ Other scripts:
 
 | command | what it does |
 |---------|--------------|
-| `npm run dev` | development server with drafts and future posts |
-| `npm run dev:start:with-pagefind` | same, but builds the [Pagefind](https://pagefind.app/) index first so site search works locally |
-| `npm run dev:build` | one-off build, no server |
-| `npm run build` | production build (`--gc --minify`), output in `public/` |
+| `pnpm dev` | development server with drafts and future posts |
+| `pnpm dev:start:with-pagefind` | same, but builds the [Pagefind](https://pagefind.app/) index first so site search works locally |
+| `pnpm dev:build` | one-off build, no server |
+| `pnpm build` | production build (`--gc --minify`), output in `public/` |
 
 The documentation subsite is a separate Hugo site and is not part of these builds. CI builds it with `hugo -s subsite/docs` and merges the output into `public/docs`.