Adopt pnpm 11 install policy (#272)

* Adopt pnpm 11 install policy

Updates the desktop workspace to pnpm 11.3.0 and replaces onlyBuiltDependencies with allowBuilds approvals for audited desktop install scripts.

Keeps unreviewed transitive build scripts denied unless a reviewed desktop path requires them.

* Emit desktop version check for all PRs

Run the workflow for every PR and no-op when apps/desktop is unchanged so branch protection receives the required context without forcing irrelevant version bumps.

Author: shafty023

.github/workflows/version-check.yml

@@ -3,8 +3,6 @@ name: Desktop Version Bump Check
 on:
   pull_request:
     types: [opened, synchronize, reopened]
-    paths:
-      - "apps/desktop/**"
 
 jobs:
   version-bump-check:
@@ -16,7 +14,22 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Detect desktop changes
+        id: desktop_changes
+        run: |
+          BASE_REF="${{ github.event.pull_request.base.ref }}"
+          BASE=$(git merge-base "origin/$BASE_REF" HEAD)
+
+          if git diff --quiet "$BASE" HEAD -- apps/desktop; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "No apps/desktop changes detected; desktop version bump is not required."
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "apps/desktop changes detected; desktop version bump is required."
+          fi
+
       - name: Check desktop version bump
+        if: steps.desktop_changes.outputs.changed == 'true'
         run: |
           BASE_REF="${{ github.event.pull_request.base.ref }}"
           BASE=$(git merge-base "origin/$BASE_REF" HEAD)

CONTRIBUTING.md

@@ -7,7 +7,7 @@ We welcome contributions! This guide covers everything you need to get started.
 ### Prerequisites
 
 - **Node.js** 24+ for development, build, and test tooling; Electron's bundled runtime Node version is unchanged.
-- **pnpm** 10.32.1 (`corepack enable && corepack prepare pnpm@10.32.1 --activate`)
+- **pnpm** 11.3.0 (`corepack enable && corepack prepare pnpm@11.3.0 --activate`)
 - **just** command runner (`brew install just`)
 - **macOS** (Electron desktop builds target macOS only)
 

README.md

@@ -5,7 +5,7 @@ Electron desktop app for the [ClosedLoop](https://closedloop.ai) platform. Provi
 ## Prerequisites
 
 - **Node.js** 24+ for development, build, and test tooling; Electron's bundled runtime Node version is unchanged.
-- **pnpm** 10.32.1 (`corepack enable && corepack prepare pnpm@10.32.1 --activate`)
+- **pnpm** 11.3.0 (`corepack enable && corepack prepare pnpm@11.3.0 --activate`)
 - **just** command runner (`brew install just`)
 - **macOS** or **Linux** (packaging currently macOS-only; Linux runs via `just desktop-dev`)
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "closedloop-electron",
   "private": true,
-  "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be",
+  "packageManager": "pnpm@11.3.0+sha512.2c403d6594527287672b1f7056343a1f7c3634036a67ffabfcc2b3d7595d843768f8787148d1b57cf7956c90606bbd192857c363af19e96d2d0ec9ec5741d215",
   "engines": {
     "node": ">=24"
   },

pnpm-workspace.yaml

@@ -25,15 +25,18 @@ minimumReleaseAgeExclude:
 # file:, link:) introduced via transitive deps — closes the github-ref bypass.
 blockExoticSubdeps: true
 
-# pnpm 10 disables postinstall lifecycle scripts by default — also a
-# supply-chain mitigation, since malicious packages typically run their
-# payload via postinstall. Explicitly allowlist the few packages whose
-# postinstall is load-bearing for this Electron app:
-#   - electron: downloads the platform-specific Electron binary
-#   - electron-winstaller: builds the Windows installer toolchain
-#   - esbuild: installs the platform-specific native binary
-# Add to this list intentionally, after auditing the package's install script.
-onlyBuiltDependencies:
-  - electron
-  - electron-winstaller
-  - esbuild
+# pnpm 11 blocks dependency build scripts unless explicitly approved.
+# Keep this standalone allowlist limited to audited desktop install scripts.
+allowBuilds:
+  # Transitive telemetry notice script is not required for desktop installs.
+  '@scarf/scarf': false
+  # Keep transitive native database addon builds denied unless a reviewed desktop path requires them.
+  better-sqlite3: false
+  # Downloads the platform-specific Electron binary.
+  electron: true
+  # Builds the Windows installer toolchain.
+  electron-winstaller: true
+  # Installs the platform-specific esbuild native binary.
+  esbuild: true
+  # Keep transitive image tooling builds denied unless a reviewed desktop path requires them.
+  sharp: false