Migrate monorepo from Yarn to pnpm

[transphorm]

Summary

• Replaces Yarn with pnpm v11 as the monorepo package manager: new pnpm-workspace.yaml, pnpm-lock.yaml, .npmrc, and removal of yarn.lock / .yarnrc.yml.
• Migrates every GitHub Actions workflow and composite action from Yarn to pnpm, including a new pnpm-install composite, a cache-pnpm store cache, and updated cache keys keyed off pnpm-lock.yaml.
• Fixes a CI hang where pnpm exec triggered an implicit pnpm install over a stale cached node_modules: build-artifact caches (cache-mobile-sdk-build, cache-core-sdk-build) now cover only dist/ outputs, not node_modules.
• Adds monorepo-tooling workstream SPEC and docs/pnpm-migration-status.md documenting the phased migration.

Changes

Config/infra

• New pnpm-workspace.yaml (hoisted nodeLinker, package extensions), .npmrc, and pnpm-lock.yaml; removed yarn.lock, .yarnrc.yml, and .github/actions/yarnrc-hash.
• Renamed .github/actions/yarn-install → pnpm-install and .github/actions/cache-yarn → cache-pnpm; rewired mobile-setup to use them.
• Updated packageManager and scripts across root and all workspace package.json files to pnpm.
• Bumped pnpm to v11; added packageExtensionsChecksum to lockfile; overrode jsdom to resolve a peer-deps conflict.

CI workflows

• Migrated 20+ workflows (mobile-ci, mobile-sdk-ci, core-sdk-ci, web, webview-*, circuits, contracts, npm-publish, mobile-deploy*, mobile-e2e, mobile-sdk-demo*, rn-sdk-test-app-ci, qrcode-sdk-ci, workspace-ci, etc.) from yarn/yarn-install to pnpm/pnpm-install.
• Fixed invalid pnpm workspace command forms (--filter syntax) introduced during the first migration pass.
• Removed node_modules paths from cache-mobile-sdk-build and cache-core-sdk-build to eliminate a 20m pnpm install hang on lint.
• Memory tuning for Node OOMs on workflow steps.

React Native app

• metro.config.cjs / jest.config.cjs updated for pnpm's hoisted node_modules layout.
• New Jest mocks (blurEffectMock.js, lottieMock.js); removed dupe mocks from jest.setup.js.
• mobile-ci-build-android.sh and install-ios-deps-if-needed.sh updated to call pnpm.
• android/settings.gradle path adjustments for pnpm hoisting (also in packages/mobile-sdk-demo, packages/rn-sdk-test-app).

SDK packages

• mobile-sdk-alpha, webview-app, webview-bridge, rn-sdk, rn-sdk-test-app, mobile-sdk-demo, sdk/core, sdk/qrcode*, sdk/sdk-common, common, new-common, circuits, contracts: package/tsconfig updates for pnpm.
• webview-app/vite.config.ts: dedupe/resolver tweak for hoisted layout.
• packages/mobile-sdk-demo/src/hooks/useRegistration.ts: import path fix.

Docs/specs

• New specs/projects/sdk/workstreams/monorepo-tooling/SPEC.md and specs/projects/sdk/INDEX.md entry.
• New docs/pnpm-migration-status.md.
• Updated AGENTS.md, CLAUDE.md, app/AGENTS.md, packages/*/AGENTS.md for pnpm-first instructions.

Bundled CI tooling (intentional)

• New .github/CI_FORCE_RUN sentinel + scripts/ci/add-force-run-sentinel.py helper.
  This PR will be re-synced with dev multiple times before merge, and each
  re-sync needs to re-validate the full workflow matrix to confirm the pnpm
  upgrade remains sound. check_changes path gating otherwise skips workflows
  whose touched paths are unchanged; bumping the sentinel forces every gated
  workflow to run. Tracked as MT-24 in the monorepo-tooling SPEC; retention
  after merge will be evaluated separately.

Test Plan

• pnpm lint && pnpm types && pnpm build passes locally
• mobile-sdk-ci lint job completes (previously timed out at 20m — see cache fix)
• core-sdk-ci, mobile-ci, webview-app-ci, webview-bridge-ci all green
• pnpm install from clean checkout reproduces the committed lockfile
• iOS build (app/, rn-sdk-test-app) succeeds with pnpm-installed pods
• Android build (app/, rn-sdk-test-app, mobile-sdk-demo) succeeds with new settings.gradle paths

Native Consolidation Checklist

• CONTRACTS.md reviewed — no unintended contract changes (this PR is tooling-only)
• Layer 1 bridge contract tests pass (cd app && pnpm jest:run / pnpm --filter @selfxyz/rn-sdk-test-app test)
• Layer 3 builds pass (app iOS, RN test app iOS, RN test app Android)
• No new native business logic added (this PR touches only build/CI plumbing)

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Add CI force-run sentinel to optionally trigger path-filtered workflows.

• Chores

  • Migrate repository and CI from Yarn to pnpm (lockfile, install, cache, pack, and workspace scripts).
  • Replace Yarn-based CI actions with pnpm equivalents.

• Documentation

  • Update developer guides, templates, and migration status to reflect pnpm workflows.

• Bug Fixes

  • Improve native build/test reliability and add Jest test mocks for CI consistency.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
self-webview-app	Ignored	Preview	May 21, 2026 11:23pm

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Repo-wide migration from Yarn to pnpm ([email protected]) across workspace config, package.json scripts, CI composite actions and workflows, native build wiring, test/runtime resolution, and docs. Adds a CI force-run sentinel .github/CI_FORCE_RUN and scripts/ci/add-force-run-sentinel.py to opt path-filtered workflows into running.

Changes

PNPM cutover (workspace, CI actions, workflows, packages, tooling, native, tests)

Layer / File(s)	Summary
Workspace & package manager metadata pnpm-workspace.yaml, package.json (root), many package.json files (app/, common/, contracts/, circuits/, packages/*, sdk/*, etc.)	Adds pnpm-workspace.yaml, updates root and per-package packageManager to [email protected], adds pnpm config/overrides, and rewrites root/workspace scripts to use pnpm -r / pnpm --filter.
PNPM installer & cache composite actions .github/actions/pnpm-install/action.yml, .github/actions/cache-pnpm/action.yml, .github/actions/mobile-setup/action.yml	Introduces pnpm install action (Corepack/pinned pnpm prepare + pnpm install --frozen-lockfile), pnpm store caching (Linux/macOS paths), lockfile hashing for pnpm-lock.yaml, and exposes cache-hit output.
Workflows: replace Yarn with pnpm .github/workflows/*.yml (examples: common-ci.yml, workspace-ci.yml, core-sdk-ci.yml, mobile-*, web*, npm-publish.yml, qrcode-sdk-ci.yml, rn-sdk-test-app-ci.yml, circuits*.yml, etc.)	Switches CI dependency install/caching to ./.github/actions/pnpm-install and ./.github/actions/cache-pnpm; replaces yarn workspace invocations with pnpm --filter/pnpm -w; updates lockfile/hash references to pnpm-lock.yaml and cache env names.
Dist-only cache narrowing .github/actions/cache-core-sdk-build/action.yml, .github/actions/cache-mobile-sdk-build/action.yml	Removes node_modules entries from composite action cache path lists, keeping only dist artifacts.
TypeScript & build config adjustments selected tsconfig.json files (common, contracts, circuits, sdk/*, new-common, packages/webview-app, packages/webview-bridge, etc.)	Adds explicit compilerOptions.types and composite flags in multiple TS projects to constrain ambient type resolution for pnpm/hoisted layouts.
Jest, Metro, and test mocks app/jest.config.cjs, app/jest.setup.js, app/metro.config.cjs, app/tests/__setup__/*	Adjusts Jest mappings to resolve RN/hoisted deps from ../node_modules, expands transform allowlist, removes one bundled mock, adds lottie and blur mocks, and refactors Metro resolver with resolveInstalledFile helper and computed React blocklist.
Native build wiring & scripts app/android/*, packages/*/android/*, packages/rn-sdk-test-app/ios/*, app/ios/*, app/ios/scripts/install-ios-deps-if-needed.sh	Updates RN autolinking invocations to pnpm exec react-native config, adjusts node_modules relative paths in Gradle/Xcode, guards Swift import with canImport, and keys iOS pod fingerprint on pnpm-lock.yaml.
CI helper scripts & packaging app/scripts/mobile-ci-build-android.sh	Converts CI build/pack/add/lockfile backup-restore and validation flows to pnpm (pnpm pack, pnpm add, pnpm-lock.yaml backups and checks).
Web build & polyfills packages/webview-app/vite.config.ts, packages/webview-app/package.json, packages/webview-app/vercel.json	Adds Vite alias crypto → crypto-browserify, updates web install/build commands to pnpm and Vercel install/build to use pnpm --frozen-lockfile and pnpm --filter builds.
Husky hook update .husky/pre-commit	Changes gitleaks invocation from yarn gitleaks to pnpm gitleaks.
Minor Solidity formatting-only edits contracts/contracts/libraries/Formatter.sol, contracts/contracts/registry/IdentityRegistry*.sol	Formatting/line-break-only refactors of bitwise/boolean expressions; no logic changes.
Docs & AGENTS updates for pnpm AGENTS.md, CLAUDE.md, app/AGENTS.md, package-level AGENTS.md files, docs/pnpm-migration-status.md	Replaces Yarn-based setup, validation, and CI guidance with pnpm equivalents and documents migration status and verification steps.

CI force-run sentinel and automation

Layer / File(s)	Summary
Sentinel documentation & PR template .github/CI_FORCE_RUN, .github/PULL_REQUEST_TEMPLATE.md, docs/pnpm-migration-status.md	Adds .github/CI_FORCE_RUN sentinel file documenting how path-filtered workflows and check_changes allowlists should include the sentinel; updates PR template to reference pnpm test instructions and the sentinel.
Automation to inject/check sentinel scripts/ci/add-force-run-sentinel.py, updated paths / check_changes blocks across .github/workflows/*.yml	Adds Python script that scans .github/workflows/*.yml to insert the sentinel into paths: lists (or report missing cases in --check mode); many workflows were updated to include the sentinel in pull_request/push paths and check_changes allowlists.
Workflow gating & debug .github/workflows/core-sdk-ci.yml, .github/workflows/contracts.yml, .github/workflows/circuits.yml, others	Adjusts check_changes/changed-files patterns to consider the sentinel or workflow file changes and adds a debug_check_changes job to print gating context; preserves explicit if: false/disabled guards where present.
Workflows: selective ignore for deploy flows mobile-deploy-auto.yml, mobile-deploy.yml	Adds .github/CI_FORCE_RUN to paths exclusions for deploy workflows so sentinel changes do not trigger deploy-on-merge flows.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/evaluate-pnpm-conversion-difficulty-and-benefits