ci: the tree runs on one pinned pnpm 12

.github/workflows/ci.yml

@@ -252,7 +252,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"

.github/workflows/cli-ci.yml

@@ -82,7 +82,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -98,7 +97,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -115,7 +113,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -131,7 +128,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -148,7 +144,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -164,7 +159,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -191,7 +185,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -206,7 +199,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
@@ -228,7 +220,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"

.github/workflows/validate.yml

@@ -32,7 +32,6 @@ jobs:
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
 
       - name: Cache pnpm store
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -42,7 +41,7 @@ jobs:
           restore-keys: pnpm-${{ runner.os }}-
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile=false --ignore-scripts
+        run: pnpm install --no-frozen-lockfile --ignore-scripts
 
       - name: Install cli dependencies
         # cli/ is a self-contained project (own lockfile, not a pnpm workspace

cli/package.json

@@ -35,15 +35,7 @@
   "engines": {
     "node": ">=22.12"
   },
-  "packageManager": "pnpm@10.14.0",
-  "pnpm": {
-    "overrides": {
-      "fast-uri": ">=3.1.2",
-      "picomatch": ">=4.0.4",
-      "postcss": ">=8.5.10",
-      "qs": ">=6.15.2"
-    }
-  },
+  "packageManager": "pnpm@12.3.4",
   "bundleBudgetKB": 598,
   "scripts": {
     "build": "tsup && node scripts/check-bundle-size.mjs",

cli/pnpm-workspace.yaml

@@ -5,3 +5,20 @@
 #
 # Empty on purpose - cli/ has its own lockfile and installs alone.
 packages: []
+
+# Moved here from `package.json`'s own `pnpm` field, which pnpm 12 stopped reading:
+# "The 'pnpm' field in package.json is no longer read by pnpm". Left there, these four
+# security floors were silently ignored while the lockfile still recorded them, which is
+# the ERR_PNPM_LOCKFILE_CONFIG_MISMATCH every `cli` install answered with.
+overrides:
+  fast-uri: '>=3.1.2'
+  picomatch: '>=4.0.4'
+  postcss: '>=8.5.10'
+  qs: '>=6.15.2'
+
+# pnpm refuses a dependency's install scripts unless it is named here, and pnpm 12 makes
+# that refusal a hard error rather than a warning: `ERR_PNPM_IGNORED_BUILDS`. Measured by
+# running the install, never guessed - these are the packages pnpm 12 named itself.
+allowBuilds:
+  esbuild: true
+  lefthook: true

kanban/package.json

@@ -6,7 +6,7 @@
   "engines": {
     "node": ">=22.12"
   },
-  "packageManager": "pnpm@10.14.0",
+  "packageManager": "pnpm@12.3.4",
   "scripts": {
     "test": "vitest run",
     "test:watch": "vitest",

kanban/pnpm-workspace.yaml

@@ -1,3 +1,9 @@
 # See cli/pnpm-workspace.yaml. This stops pnpm searching upward and treating the
 # repository root as this project's workspace.
 packages: []
+
+# pnpm refuses a dependency's install scripts unless it is named here, and pnpm 12 makes
+# that refusal a hard error rather than a warning: `ERR_PNPM_IGNORED_BUILDS`. Measured by
+# running the install, never guessed - these are the packages pnpm 12 named itself.
+allowBuilds:
+  esbuild: true

lefthook.yml

@@ -162,13 +162,18 @@ pre-commit:
     cli-typecheck:
       # The CLI type-checks `kanban/` too, so that folder's dependencies must be
       # resolvable. Install them only when they are missing, to keep the hook fast.
-      # `--ignore-workspace` because the repository root declares one (for pnpm's
-      # build allowlist); without the flag pnpm resolves kanban to that root, finds
-      # it lists no members, reports "Already up to date" and installs nothing —
-      # leaving this step to fail on a sibling package it was meant to repair.
+      #
+      # `--ignore-workspace` was here so pnpm would not resolve kanban to the
+      # repository root, find it lists no members, report "Already up to date" and
+      # install nothing. `kanban/pnpm-workspace.yaml` now stops that upward search on
+      # its own — that is the whole reason the file exists — and the flag had turned
+      # harmful: it discards that same file, and with it the `allowBuilds` entry pnpm
+      # needs to run esbuild's install script. Measured in the real layout under
+      # pnpm 12.3.4, a root workspace above and kanban's own file present: without the
+      # flag the install exits 0, with it, ERR_PNPM_IGNORED_BUILDS.
       glob: "{cli,kanban}/**"
       run: |
-        [ -d kanban/node_modules ] || (cd kanban && pnpm install --frozen-lockfile --ignore-workspace)
+        [ -d kanban/node_modules ] || (cd kanban && pnpm install --frozen-lockfile)
         cd cli && pnpm typecheck
 
 pre-push:

package.json

@@ -24,6 +24,7 @@
     "sdlc-automation",
     "prompt-engineering"
   ],
+  "packageManager": "pnpm@12.3.4",
   "engines": {
     "node": ">=22.12"
   },