fix(build): allow esbuild install scripts

.github/workflows/ci.yml

@@ -39,6 +39,7 @@ jobs:
               - 'flake.lock'
               - 'package.json'
               - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
               - 'scripts/update-flake.sh'
               - '.github/workflows/ci.yml'
 

.github/workflows/security.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - '**/package.json'
       - '**/pnpm-lock.yaml'
+      - '**/pnpm-workspace.yaml'
       - '.github/workflows/security.yml'
   pull_request:
     branches: [main]

flake.nix

@@ -39,6 +39,7 @@
                 ./test
                 ./package.json
                 ./pnpm-lock.yaml
+                ./pnpm-workspace.yaml
                 ./tsconfig.json
                 ./build.js
                 ./vitest.config.ts

package.json

@@ -85,6 +85,9 @@
     "zod": "^4.4.3"
   },
   "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ],
     "overrides": {
       "brace-expansion@<=5.0.8": ">=5.0.9 <6",
       "postcss@<8.5.23": ">=8.5.23 <9"

pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+packages:
+  - '.'
+
+allowBuilds:
+  esbuild@0.28.1: true
+
+overrides:
+  brace-expansion@<=5.0.8: '>=5.0.9 <6'
+  postcss@<8.5.23: '>=8.5.23 <9'

test/pnpm-workspace-config.test.ts

@@ -0,0 +1,65 @@
+import fs from 'fs';
+import path from 'path';
+import { describe, expect, it } from 'vitest';
+import { parse } from 'yaml';
+
+const projectRoot = process.cwd();
+
+function readJson(relativePath: string): Record<string, any> {
+  return JSON.parse(fs.readFileSync(path.join(projectRoot, relativePath), 'utf8'));
+}
+
+function readYaml(relativePath: string): Record<string, any> {
+  return parse(fs.readFileSync(path.join(projectRoot, relativePath), 'utf8'));
+}
+
+describe('pnpm workspace configuration', () => {
+  it('keeps root build approval and security overrides compatible across pnpm versions', () => {
+    const packageJson = readJson('package.json');
+    const lockfile = readYaml('pnpm-lock.yaml');
+    const workspace = readYaml('pnpm-workspace.yaml');
+    const esbuildVersions = Object.keys(lockfile.packages)
+      .filter((key) => key.startsWith('esbuild@'))
+      .map((key) => key.slice('esbuild@'.length));
+
+    expect(workspace.packages).toEqual(['.']);
+    expect(packageJson.pnpm.onlyBuiltDependencies).toEqual(['esbuild']);
+    expect(esbuildVersions).toHaveLength(1);
+    expect(workspace.allowBuilds).toEqual({
+      [`esbuild@${esbuildVersions[0]}`]: true,
+    });
+    expect(workspace.overrides).toEqual(packageJson.pnpm.overrides);
+    expect(workspace.overrides).toEqual(lockfile.overrides);
+  });
+
+  it('keeps the website as an independently locked project', () => {
+    const packageJson = readJson('website/package.json');
+    const lockfile = readYaml('website/pnpm-lock.yaml');
+    const workspace = readYaml('website/pnpm-workspace.yaml');
+    const esbuildVersions = Object.keys(lockfile.packages)
+      .filter((key) => key.startsWith('esbuild@'))
+      .map((key) => key.slice('esbuild@'.length));
+
+    expect(workspace.packages).toEqual(['.']);
+    expect(packageJson.pnpm.onlyBuiltDependencies).toEqual(['esbuild']);
+    expect(esbuildVersions).toHaveLength(1);
+    expect(workspace.allowBuilds).toEqual({
+      [`esbuild@${esbuildVersions[0]}`]: true,
+    });
+    expect(workspace.overrides).toEqual(packageJson.pnpm.overrides);
+    expect(workspace.overrides).toEqual(lockfile.overrides);
+  });
+
+  it('includes install policy changes in Nix and security validation', () => {
+    const flake = fs.readFileSync(path.join(projectRoot, 'flake.nix'), 'utf8');
+    const ci = fs.readFileSync(path.join(projectRoot, '.github/workflows/ci.yml'), 'utf8');
+    const security = fs.readFileSync(
+      path.join(projectRoot, '.github/workflows/security.yml'),
+      'utf8'
+    );
+
+    expect(flake).toContain('./pnpm-workspace.yaml');
+    expect(ci).toContain("- 'pnpm-workspace.yaml'");
+    expect(security).toContain("- '**/pnpm-workspace.yaml'");
+  });
+});

website/package.json

@@ -34,6 +34,9 @@
     "typescript": "^6.0.3"
   },
   "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ],
     "overrides": {
       "postcss": "^8.5.22",
       "sharp": "^0.35.3",

website/pnpm-workspace.yaml

@@ -0,0 +1,11 @@
+packages:
+  - '.'
+
+allowBuilds:
+  esbuild@0.28.1: true
+
+overrides:
+  postcss: ^8.5.22
+  sharp: ^0.35.3
+  brace-expansion@<=5.0.8: '>=5.0.9 <6'
+  fast-uri@<3.1.5: ^3.1.5