Skip to content

Use pnpm 12 to manage agent skills - #159

Open
dahlia wants to merge 4 commits into
fedify-dev:mainfrom
dahlia:deps/pnpm
Open

dahlia wants to merge 4 commits into
fedify-dev:mainfrom
dahlia:deps/pnpm

Conversation

@dahlia

@dahlia dahlia commented Oct 20, 2026 •

Copy link
Copy Markdown
Member

pnpm 12 links skills from installed packages and Git dependencies, with Git commits and package integrity recorded in pnpm-lock.yaml. This replaces skills-npm and vendored copies with one reproducible install step. Git sources receive commit-specific skill approvals.

.pnpmfile.mjs excludes Relay's development dependencies, and its build is denied, so installing its skills does not install its toolchain. ChilliCream uses a schema-only revision whose skill content matches the latest upstream version, avoiding unrelated skills from the collection.

Validation

Existing and fresh frozen installs, build, and checks passed. Tests: 587 passed, 11 conditional PostgreSQL tests skipped.

AI assistance

Codex implemented the changes, ran validation, reviewed earlier iterations, and drafted this description. The maintainer directed Git-based sourcing and scope.

@dahlia dahlia added this to the DrFed 0.2 milestone Oct 20, 2026
@dahlia dahlia self-assigned this Oct 20, 2026
@dahlia dahlia added documentation Improvements or additions to documentation dependencies Pull requests that update a dependency file labels Oct 20, 2026
@coderabbitai

coderabbitai Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: aaf6d194-0dd2-4073-960d-19386c5afbc8
📥 Commits

Reviewing files that changed from the base of the PR and between 8847234 and c7f4024.

⛔ Files ignored due to path filters: 1
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing: 26
  • .agents/skills/.gitignore
  • .agents/skills/README.md
  • .agents/skills/formisch/.claude-plugin/plugin.json
  • .agents/skills/formisch/SKILL.md
  • .agents/skills/graphql-schema-design/SKILL.md
  • .agents/skills/graphql-schema-design/references/connections.md
  • .agents/skills/graphql-schema-design/references/errors.md
  • .agents/skills/graphql-schema-design/references/evolution.md
  • .agents/skills/graphql-schema-design/references/mutations.md
  • .agents/skills/graphql-schema-design/references/naming.md
  • .agents/skills/graphql-schema-design/references/nullability.md
  • .agents/skills/graphql-schema-design/references/types.md
  • .agents/skills/relay-best-practices/SKILL.md
  • .agents/skills/relay-performance/SKILL.md
  • .agents/skills/sacho/SKILL.md
  • .agents/skills/valibot/.claude-plugin/plugin.json
  • .agents/skills/valibot/SKILL.md
  • .crush/skills/.gitignore
  • .gitignore
  • .pnpmfile.mjs
  • CONTRIBUTING.md
  • docs/installation/run-from-source.md
  • mise.toml
  • package.json
  • pnpm-workspace.yaml
  • skills-lock.json
💤 Files with no reviewable changes: 17
  • .agents/skills/valibot/.claude-plugin/plugin.json
  • .agents/skills/graphql-schema-design/references/naming.md
  • .agents/skills/graphql-schema-design/references/mutations.md
  • .agents/skills/formisch/SKILL.md
  • skills-lock.json
  • .agents/skills/formisch/.claude-plugin/plugin.json
  • .agents/skills/graphql-schema-design/references/errors.md
  • .agents/skills/graphql-schema-design/references/evolution.md
  • .gitignore
  • .agents/skills/graphql-schema-design/SKILL.md
  • .agents/skills/graphql-schema-design/references/nullability.md
  • .agents/skills/valibot/SKILL.md
  • .agents/skills/graphql-schema-design/references/types.md
  • .agents/skills/relay-performance/SKILL.md
  • .agents/skills/sacho/SKILL.md
  • .agents/skills/relay-best-practices/SKILL.md
  • .agents/skills/graphql-schema-design/references/connections.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Agent skills are now managed through pinned pnpm Git dependencies and workspace linking instead of checked-in skill copies. The change removes the previous skill files and lock file, updates pnpm to version 12, and documents the new setup and update process.

Changes: Agent skill management

Layer / File(s) Summary
Configure pnpm skill sources and linking
package.json, pnpm-workspace.yaml, .pnpmfile.mjs, .agents/skills/.gitignore, .crush/skills/.gitignore, .gitignore, skills-lock.json
Adds pinned Git dependencies and pnpm skill directory and permission settings. Adds a package hook that clears dependency fields for relay-github-root. Updates skill ignore rules and deletes skills-lock.json.
Remove checked-in skill content
.agents/skills/*
Removes the Formisch, GraphQL schema design, Relay, Sacho, and Valibot skill documentation and plugin manifests.
Update pnpm and skill management guidance
.agents/skills/README.md, CONTRIBUTING.md, mise.toml, docs/installation/run-from-source.md
Updates the configured and documented pnpm version to 12. Adds guidance for linking, reviewing, approving, and updating skill dependencies.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Suggested reviewers: sij411

Merge Risk: ⚪ Minimal · up to c7f40

The skill-source configuration is consistent with the migration. No actionable merge blocker was identified, though the generated links should be checked during a normal frozen install.

Architecture risk: 🔵 Low · up to c7f40

The change affects 6 systems.

Changed systems: CONTRIBUTING.md, docs, mise.toml, package.json, pnpm-workspace.yaml, skills-lock.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

  • observed — CONTRIBUTING.md (service) was modified; 1 changed file maps to changed impact.
  • observed — docs (service) was modified; 1 changed file maps to changed impact.
  • observed — mise.toml (service) was modified; 1 changed file maps to changed impact.
  • observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

  • observed — Modified behavior in CONTRIBUTING.md: The documented mise-managed pnpm requirement changed from pnpm 11 to pnpm 12.
  • observed — Modified behavior in CONTRIBUTING.md: The Sacho guidance now references the @dahlia+sacho skill path, documents pnpm 12.11-or-newer linking approved npm-bundled and Git dependency skills into agent directories, requires reviewing and approving dependency skill sources, documents cleanup of old npm-* symlinks, and replaces the npm package update command with a version-matched github:dahlia/sacho dependency workflow. It also requires reviewing the updated skill and committing the mise pin, root manifest, lockfile, and approval together.
  • observed — Modified behavior in docs/installation/run-from-source.md: Updated the documented pnpm version managed by mise from 11 to 12.
  • observed — Modified behavior in mise.toml: The configured pnpm version was raised from 11 to 12.
Pre-merge checks: Passed 5
Check name Status Explanation
Title check Passed The title clearly summarizes the primary change: migrating agent-skill management to pnpm 12.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Description check Passed The description directly matches the changeset. It explains the pnpm 12 upgrade, migration from skills-npm and vendored skills, Git dependency pinning and approvals, Relay dependency filtering, Chilli…
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (8 skipped: 8 unsupported.)

Full details: Description check

Explanation

The description directly matches the changeset. It explains the pnpm 12 upgrade, migration from skills-npm and vendored skills, Git dependency pinning and approvals, Relay dependency filtering, ChilliCream sourcing, and reported validation.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@dahlia dahlia moved this from Todo to In progress in NLnet NGI0 Commons Fund (2026) Oct 20, 2026
Select pnpm 12 through mise and update the contributor and source-install
prerequisites. The selected stable release is 12.14.0; the existing
lockfile works unchanged with a frozen install.

The maintainer asked Codex to upgrade pnpm, run the review loop, and
commit. Codex updated the configuration and version references while
preserving major-only tool selection. Automated validation passed:
frozen installation, mise build/check/test, and 587 tests with 11 skipped.
Codex Astra reviewed the diff without actionable findings. OpenCode's
model listing failed; Claude review could not authenticate because its
OAuth session had expired. Neither reviewer contributed changes.

Assisted-by: Codex:gpt-6.1-sol
Approve bundled skills and link them into the shared Claude/Codex and
Crush directories through pnpm. Remove skills-npm, its prepare hook and
unused dependencies, legacy link ignores, and the Vercel skills lock.
Keep GitHub-only skill snapshots with documented sources and replace the
duplicate Sacho snapshot with the pinned package's official skill.
Document the one-time cleanup of legacy links for existing checkouts.

The maintainer asked Codex to consolidate skill installation in pnpm,
review the changes, and commit. Codex implemented the configuration and
cleanup, retained existing vendored instructions, and verified frozen
installs in existing and fresh directories, native links, build, check,
and test (587 passed, 11 PostgreSQL tests skipped). Codex Astra's review
identified collapsed source links; Codex fixed them and a second review
found no further defects. OpenCode model discovery failed and Claude's
OAuth session expired, so those independent reviews were unavailable.

Assisted-by: Codex:gpt-6.1-sol
Assisted-by: Codex:gpt-6-astra
Replace the skill-only registry @sacho/sacho package with the GitHub
@dahlia/sacho development dependency at tag 0.3.2, matching the binary
managed by mise. Pin its resolved commit and tarball integrity in the
pnpm lockfile and approve only that source identity for skill linking.
Update the source and contributor documentation with the Git workflow.

The maintainer asked Codex to manage the repository-distributed skill
through pnpm and its lockfile. Codex generated the dependency and approval
configuration, removed the manual snapshot, and verified frozen installs
in existing and fresh trees, live links, exact upstream bytes, and the
full check task. Application code is unchanged; build and application
tests were not rerun for this follow-up. Codex Astra independently found
no actionable defects. OpenCode model discovery failed and Claude review
was unavailable because its OAuth session had expired.

Assisted-by: Codex:gpt-6.1-sol
Replace the five copied Formisch, Valibot, GraphQL schema, and Relay
skills with three Git development dependencies. Lock their commits and
integrity and grant source-specific skill permissions. All fourteen
previously copied files match their Git sources and the requested latest
upstream skill contents, including references and Sacho, are unchanged.

Keep the ChilliCream revision limited to the GraphQL schema skill.
Strip Relay's GitHub-root dependency edges through a pnpm manifest hook
and deny its build, since the repository is used only for instructions.
Update contributor documentation and skill source/update instructions.

The maintainer asked Codex to complete Git-based skill management and
check for upstream updates. Codex implemented the configuration and
hook, removed the copies, and verified fresh and existing frozen
installs, ten native skill links per agent directory, unchanged runtime
dependency entries, build, check, and tests. Further AI review was
skipped at the maintainer's request.

Assisted-by: Codex:gpt-6.1-sol
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation

Projects

Status: In progress

Development

Successfully merging this pull request may close these issues.

1 participant