[r0b1n]

Pull request type

Refactoring (e.g. file rename, variable rename, etc.)

---

Description

Second step towards replacing shelljs. Stacked on #2502; retarget to main after that one is merged.

The shelljs file helpers in automation/utils are replaced with node:fs/promises, and shelljs is removed from automation/utils. (automation/run-e2e still uses its own shelljs; that is a later step.)

• rm -rf, mkdir -p and cp call sites now use rm/mkdir/cp from node:fs/promises, in automation/utils and in the charts-web and data-widgets scripts.
• shell.ts keeps small helpers only where node:fs has no direct equivalent:
  • findFiles(...patterns): fs.globSync that throws when a pattern matches nothing. shelljs find with fatal failed the same way, so a missing mpk still stops the release instead of being skipped silently.
  • move(source, dest): rename with a copy and remove fallback when crossing file systems, like shelljs mv. This replaces the cp + rm workaround in moveModuleToDist for mv silently swallows errors shelljs/shelljs#878.
  • makeWritableRecursive(dir): the chmod -R a+rw used before re-zipping mpks.
• ensureFileExists uses fs.access and is now async.
• zip() switches directories with process.chdir instead of shelljs pushd/popd.
• rui-oss-clearance imports node:fs/promises statically instead of the inline await import(...) calls.

Copying a file into a directory now passes the full destination path, since fs.cp doesn't copy into an existing directory the way shelljs cp does.

pnpm-lock.yaml: removes shelljs 0.8.5. pnpm also swapped two peer-resolution variants of pluggable-widgets-tools between importers; that came from pnpm i, not a manual edit.

What should be covered while testing?

Verified locally:

• automation/utils type-checks and lints; script lints pass for all modules and charts-web.
• Helper smoke test: zip/unzip, zip restoring the directory on failure, ensureFileExists throwing ENOENT, findFiles matching and throwing, makeWritableRecursive (600 → 666), move.
• pnpm turbo build --filter=@mendix/charts-web: Charts.mpk contains all 10 widgets merged under com/ plus package.xml and License.txt.
• build:module for data-widgets (all 9 widget mpks copied, themesource, .version, LICENSE) and web-actions (themesource identical to source).

Not run locally: the release-only paths (createModuleMpk in Docker, addWidgetsToMpk, moveModuleToDist, the OSS clearance scripts, rui-create-gh-release). They are worth watching on the next module release. The EXDEV fallback in move wasn't exercised either.

[github-actions]

AI Code Review

✅ Approved — no issues found

---

What was reviewed

Package / area	Change
automation/utils (src/shell.ts, steps.ts, monorepo.ts, mpk.ts, oss-clearance.ts, bin/*)	shelljs rm/mkdir/cp/mv/chmod/find/pushd/popd replaced with node:fs/promises. New findFiles, move and makeWritableRecursive helpers. ensureFileExists is now async. shelljs removed from package.json.
packages/modules/data-widgets/scripts/start.ts	Uses mkdir from node:fs/promises.
packages/pluggableWidgets/charts-web/scripts/build.mts	Uses node:fs/promises helpers. File copies now pass the full destination path.

Skipped (out of scope): pnpm-lock.yaml

CI: pending: AI Code Review · unrelated failures: security/snyk (external scanner, not tied to this diff)

---

Positives

• Every cp into a directory now passes an explicit destination path. This covers the fs.cp difference from shelljs, and I found no call site that still relies on copy-into-directory behaviour.
• findFiles throws when a pattern matches nothing. That keeps shelljs's fail-fast behaviour, so a missing mpk still stops a release.
• Every call site that was synchronous under shelljs is now awaited, including ensureFileExists. The zip() helper restores the working directory in its callback on both success and error.

[r0b1n]

Not a merge to main: this commit (e2f4c2f) was folded into #2502 as a separate commit, which GitHub records as merging this PR into its base branch. Review it in #2502.