Skip to content

chore: unify pnpm into a single root workspace#103

Closed
kyscott18 wants to merge 27 commits into
mainfrom
chore/root-pnpm-workspace
Closed

chore: unify pnpm into a single root workspace#103
kyscott18 wants to merge 27 commits into
mainfrom
chore/root-pnpm-workspace

Conversation

@kyscott18

@kyscott18 kyscott18 commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Makes the repo root the single pnpm workspace, eliminating the two separate pnpm installs (root Biome-only + self-contained frontend/).

Changes

  • Add root pnpm-workspace.yaml with packages: [frontend], moving the pnpm-10 settings (minimumReleaseAge, minimumReleaseAgeExclude, onlyBuiltDependencies, allowBuilds) up from frontend/.
  • Root package.json scripts delegating to the workspace: dev/build/start/typecheck -> pnpm --filter frontend ..., plus lint -> biome check ..
  • Delete frontend/pnpm-workspace.yaml and frontend/pnpm-lock.yaml. There is now a single root pnpm-lock.yaml covering root (Biome) + frontend.
  • ci.yml: typecheck/build install once at the repo root (dropped working-directory: frontend; cache-dependency-path: pnpm-lock.yaml) and run the root scripts.

Verification From Original PR

  • pnpm install --frozen-lockfile
  • pnpm typecheck
  • pnpm build
  • biome ci

Vercel Coordination Required Before Merge

This moves the lockfile to the repo root and makes the project a pnpm workspace. The Vercel project settings (Root Directory, Install Command, lockfile detection) live in the dashboard, not this repo. They likely need updating or preview/production deploys can break.

Suggested Vercel settings:

  • Root Directory: frontend with "Include files outside the root directory" enabled, so the root lockfile/workspace is available, or set Root Directory to repo root with build/output configured for frontend.
  • Install Command: pnpm install --frozen-lockfile run at the workspace root.

Stack order: #109 -> #106 -> this -> #108.

dak-agent Bot and others added 11 commits June 8, 2026 20:48
Switch the TPS Area interpolation from `linear` to `monotone` so the
Transaction volume chart renders as a smooth curve instead of connected
straight segments between data points.
Revert line interpolation to linear and enable Recharts' built-in
animation so newly arriving data points ease into the chart instead
of snapping in. This is the smoothing that was actually requested:
the visible motion of new points appearing, not the line shape.
Switch the X axis to a continuous time scale with a [now - 5min, now]
domain advanced each animation frame, so new points slide in smoothly
from the right edge instead of popping into discrete category slots.
Keeps isAnimationActive disabled to avoid Recharts re-animation loops on
each TPS event. Clamp the domain's left edge to the oldest point so the
chart fills immediately instead of showing an empty 5-minute lead-in.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replaces frontend/pnpm-lock.yaml with main's lockfile minus the duplicate
keys introduced by PR #97 (so pnpm 10 can parse it). No package versions
change vs main; pnpm install --frozen-lockfile passes.

The previous commit on this branch ran a non-frozen pnpm install, which
silently re-resolved every floating semver in package.json and produced
~2000 lines of incidental lockfile churn. This commit reverses that.
Addresses 6 of the 8 clippy findings surfaced by the new rust CI job:
- needless_return (server.rs)
- match_like_matches_macro (server.rs)
- ptr_arg: &Vec<T> -> &[T] (event_filter.rs)
- needless_borrow (event_filter.rs)
- manual_is_multiple_of (event_listener.rs)
- clone_on_copy (serializable_event.rs)

Remaining (require manual judgment, deferred): large_enum_variant
(server.rs), should_implement_trait for from_str (event_listener.rs).
- large_enum_variant: box the 640-byte Event variant of EventDataOrMetrics
  (Event(Box<EventData>)). Since From::from infers its parameter type from
  the argument (deref coercion does not apply), the match-site call passes
  &*event_data to select From<&EventData>; construction uses Box::new(..).
- should_implement_trait: rename inherent EventName::from_str -> from_name
  (and its single caller) so it no longer shadows std::str::FromStr::from_str.
Surfaced once the lib compiled clean: timestamp_ns is u64, so the
(u64 - u64) as u64 casts are redundant; drop the cast and parens.
@vercel

vercel Bot commented Jun 9, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
monode Skipped Skipped Jun 11, 2026 3:33pm

Request Review

@socket-security

socket-security Bot commented Jun 9, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​types/​react@​19.2.7 ⏵ 19.2.16100 +110079 +196100
Updatednpm/​@​types/​node@​20.19.25 ⏵ 20.19.41100 +110081 +196100
Updatednpm/​tailwindcss@​4.1.17 ⏵ 4.3.0100 +110084 +198100
Updatednpm/​eslint@​9.39.1 ⏵ 9.39.497 +110010095100
Updatednpm/​@​tailwindcss/​postcss@​4.1.17 ⏵ 4.3.0100 +110010098100

View full report

@socket-security

socket-security Bot commented Jun 9, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/eslint-config-next@16.0.6npm/@typescript-eslint/eslint-plugin@8.60.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.60.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/eslint-config-next@16.0.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/eslint-config-next@16.0.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/eslint-config-next@16.0.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/eslint-config-next@16.0.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm es-abstract is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/eslint-config-next@16.0.6npm/es-abstract@1.24.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-yaml is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/eslint@9.39.4npm/js-yaml@4.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@greptile-apps

greptile-apps Bot commented Jun 9, 2026

Copy link
Copy Markdown

Greptile Summary

This PR unifies the repo into a single pnpm workspace by moving pnpm-workspace.yaml to the root and replacing the two separate lockfiles with one. CI jobs for typecheck and build now install once at the repo root and delegate to the frontend workspace via pnpm --filter frontend … scripts.

  • Root pnpm-workspace.yaml created with all security/release-age settings ported from frontend/pnpm-workspace.yaml; both the old frontend/pnpm-workspace.yaml and frontend/pnpm-lock.yaml are deleted and replaced by a unified root pnpm-lock.yaml that covers both the root (Biome) and frontend importers.
  • CI typecheck and build jobs drop working-directory: frontend and switch cache-dependency-path to the root lockfile; they now call the root package.json scripts which delegate with --filter frontend.
  • Vercel coordination is explicitly called out in the PR description as a required out-of-band step before this lands, since the dashboard-side lockfile path and root directory settings are not tracked in this repo.

Confidence Score: 5/5

Safe to merge on the code side; Vercel dashboard settings must be updated out-of-band before production deploys will work, as explicitly documented in the PR description.

The workspace unification is mechanically straightforward: lockfile paths updated in CI, delegating scripts added to root package.json, workspace settings faithfully ported to the new root pnpm-workspace.yaml. The unified lockfile correctly tracks both root and frontend importers. No functional logic is changed.

No files require special attention from a correctness standpoint. The Vercel deployment concern is purely a dashboard configuration step, not a code defect.

Important Files Changed

Filename Overview
.github/workflows/ci.yml Correctly drops working-directory: frontend and updates cache-dependency-path to root lockfile for typecheck and build jobs; lint job was already running from root and is unchanged.
package.json Adds workspace name, private flag, and delegating scripts; no packageManager field to pin pnpm 10 locally (CI pins it via action).
pnpm-workspace.yaml New root workspace config with packages: [frontend] and all security/release settings faithfully ported from the deleted frontend/pnpm-workspace.yaml.
pnpm-lock.yaml New unified lockfile (lockfileVersion 9.0) covering both root (biome) and frontend importers; replaces the deleted frontend/pnpm-lock.yaml.
frontend/pnpm-lock.yaml Deleted — superseded by the unified root pnpm-lock.yaml.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[CI: pnpm install --frozen-lockfile\nat repo root] --> B[root pnpm-lock.yaml\ncovers . + frontend]

    B --> C{Job}

    C -->|typecheck job| D[pnpm typecheck\nroot package.json]
    C -->|build job| E[pnpm build\nroot package.json]
    C -->|lint job| F[biome ci --linter-enabled\n--formatter-enabled\nno pnpm needed]

    D -->|pnpm --filter frontend typecheck| G[frontend/\ntsc --noEmit]
    E -->|pnpm --filter frontend build| H[frontend/\nnext build]

    style A fill:#e8f5e9
    style B fill:#e8f5e9
    style F fill:#fff3e0
Loading

Reviews (5): Last reviewed commit: "Merge branch 'reopen/100-unified-workflo..." | Re-trigger Greptile

Comment thread package.json
"build": "pnpm --filter frontend build",
"start": "pnpm --filter frontend start",
"typecheck": "pnpm --filter frontend typecheck",
"lint": "biome check ."

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 lint script diverges from CI behavior

The CI lint job runs biome ci --linter-enabled=true --formatter-enabled=true directly (via biomejs/setup-biome), while the new root lint script runs biome check .. biome check without --write exits non-zero on violations like biome ci does, but the flag set differs — biome ci hard-enables both linter and formatter regardless of biome.json, whereas biome check . inherits defaults from config. If biome.json disables one of those by default, pnpm lint locally will pass on code that CI rejects, defeating the point of the script.

Prompt To Fix With AI
This is a comment left during a code review.
Path: package.json
Line: 9

Comment:
**`lint` script diverges from CI behavior**

The CI `lint` job runs `biome ci --linter-enabled=true --formatter-enabled=true` directly (via `biomejs/setup-biome`), while the new root `lint` script runs `biome check .`. `biome check` without `--write` exits non-zero on violations like `biome ci` does, but the flag set differs — `biome ci` hard-enables both linter and formatter regardless of biome.json, whereas `biome check .` inherits defaults from config. If `biome.json` disables one of those by default, `pnpm lint` locally will pass on code that CI rejects, defeating the point of the script.

How can I resolve this? If you propose a fix, please make it concise.

- Add root pnpm-workspace.yaml (packages: [frontend]) and move the pnpm 10
  settings (minimumReleaseAge, minimumReleaseAgeExclude, onlyBuiltDependencies,
  allowBuilds) up from frontend/.
- Add root package.json scripts delegating to the frontend workspace
  (dev/build/start/typecheck) plus a biome lint script.
- Delete frontend/pnpm-workspace.yaml and frontend/pnpm-lock.yaml; the repo now
  has a single root pnpm-lock.yaml covering root (biome) + frontend.
- ci.yml: typecheck/build install once at the repo root (no working-directory,
  cache-dependency-path: pnpm-lock.yaml) and run the root pnpm scripts.

Verified locally with pnpm 10: frozen install, pnpm typecheck, pnpm build pass.
@kyscott18 kyscott18 changed the base branch from ci/unified-frontend-workflow to fix/backend-clippy-autofix June 9, 2026 19:54
@kyscott18 kyscott18 force-pushed the chore/root-pnpm-workspace branch from 2b1f545 to d0b4c2a Compare June 9, 2026 19:54
Base automatically changed from fix/backend-clippy-autofix to ci/unified-frontend-workflow June 11, 2026 09:04
Base automatically changed from ci/unified-frontend-workflow to smooth-transaction-volume-chart June 11, 2026 09:12
Next 16 removed the built-in ESLint integration (next lint), and ESLint
wasn't wired into CI or the build, so eslint-config-next's @next/next rules
weren't being enforced anyway. Biome (run in the CI lint job) owns linting +
formatting + import organization going forward.

- Remove the 'lint': 'eslint' script and the eslint / eslint-config-next
  devDependencies from frontend/package.json.
- Delete frontend/eslint.config.mjs.
- Drop 'eslint.enable' from .vscode/settings.json (Biome is the formatter).
- Update root pnpm-lock.yaml (removes eslint + 300 transitive deps).

Verified locally: frozen install, pnpm typecheck, and biome ci all pass.
@greptile-apps

greptile-apps Bot commented Jun 11, 2026

Copy link
Copy Markdown

Want your agent to iterate on Greptile's feedback? Try greploops.

@kyscott18 kyscott18 changed the base branch from smooth-transaction-volume-chart to main June 11, 2026 14:36
Addresses 6 of the 8 clippy findings surfaced by the new rust CI job:
- needless_return (server.rs)
- match_like_matches_macro (server.rs)
- ptr_arg: &Vec<T> -> &[T] (event_filter.rs)
- needless_borrow (event_filter.rs)
- manual_is_multiple_of (event_listener.rs)
- clone_on_copy (serializable_event.rs)

Remaining (require manual judgment, deferred): large_enum_variant
(server.rs), should_implement_trait for from_str (event_listener.rs).
- large_enum_variant: box the 640-byte Event variant of EventDataOrMetrics
  (Event(Box<EventData>)). Since From::from infers its parameter type from
  the argument (deref coercion does not apply), the match-site call passes
  &*event_data to select From<&EventData>; construction uses Box::new(..).
- should_implement_trait: rename inherent EventName::from_str -> from_name
  (and its single caller) so it no longer shadows std::str::FromStr::from_str.
Surfaced once the lib compiled clean: timestamp_ns is u64, so the
(u64 - u64) as u64 casts are redundant; drop the cast and parens.
# Conflicts:
#	.github/workflows/ci.yml
#	frontend/package.json
@kyscott18 kyscott18 changed the base branch from main to reopen/101-backend-clippy June 11, 2026 15:28
Addresses 6 of the 8 clippy findings surfaced by the new rust CI job:
- needless_return (server.rs)
- match_like_matches_macro (server.rs)
- ptr_arg: &Vec<T> -> &[T] (event_filter.rs)
- needless_borrow (event_filter.rs)
- manual_is_multiple_of (event_listener.rs)
- clone_on_copy (serializable_event.rs)

Remaining (require manual judgment, deferred): large_enum_variant
(server.rs), should_implement_trait for from_str (event_listener.rs).
- large_enum_variant: box the 640-byte Event variant of EventDataOrMetrics
  (Event(Box<EventData>)). Since From::from infers its parameter type from
  the argument (deref coercion does not apply), the match-site call passes
  &*event_data to select From<&EventData>; construction uses Box::new(..).
- should_implement_trait: rename inherent EventName::from_str -> from_name
  (and its single caller) so it no longer shadows std::str::FromStr::from_str.
Surfaced once the lib compiled clean: timestamp_ns is u64, so the
(u64 - u64) as u64 casts are redundant; drop the cast and parens.
@kyscott18 kyscott18 changed the base branch from reopen/101-backend-clippy to reopen/100-unified-workflow June 11, 2026 15:33
@kyscott18 kyscott18 changed the base branch from reopen/100-unified-workflow to main June 11, 2026 15:40
@kyscott18 kyscott18 closed this Jun 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants