tapforce-pnpm_skill

Overview

This skill provides best practices for using pnpm ^10.0.0 in Node.js projects. It focuses on workspace configuration, consistent command usage, and strict version management to ensure reproducible installs and team consistency. Apply it when creating, converting, or maintaining Node.js projects that target Node.js ^20.0.0.

How this skill works

The skill inspects project metadata and environment versions to validate compatibility with pnpm ^10.0.0. It enforces a pnpm workspace root (pnpm-workspace.yaml), recommends packageManager and engines settings in package.json, and guides the use of pnpm commands instead of other package managers. It also documents recommended .npmrc and CI actions for pinning and verifying pnpm versions.

When to use it

• When initializing a new Node.js project that should use pnpm as the package manager
• When converting an existing npm/yarn project to pnpm to improve performance and disk usage
• When configuring or validating a monorepo workspace with multiple packages
• When enforcing consistent pnpm versions across a team or CI environment
• When implementing strict dependency locking and reproducible installs

Best practices

• Always ensure a pnpm-workspace.yaml file at the repository root and list package paths under packages
• Use pnpm commands exclusively (replace npm/yarn prefixes with pnpm) to avoid lockfile and node_modules incompatibilities
• Pin the pnpm version in package.json (packageManager) and set engines to enforce minimum version
• Enable package-manager-strict and save-exact in .npmrc to avoid accidental version drift
• Use pnpm-lock.yaml in version control and enforce pnpm version checks in CI to guarantee consistency

Example use cases

• Create a new monorepo: add pnpm-workspace.yaml with packages: - . and use pnpm workspace commands to run scripts across packages
• Migrate a single-package repo: replace npm install scripts with pnpm equivalents, add packageManager to package.json, and commit pnpm-lock.yaml
• Enforce team tooling: add a CI step that runs pnpm --version and installs a pinned pnpm before running installs
• Strict production installs: add --save-exact when adding production dependencies and use pnpm-lock.yaml for reproducible builds
• Version pinning: install a specific global pnpm version in developer setup scripts and in CI bootstrap steps