Harden package installs with pnpm and CI updates

.github/workflows/ci.yml

@@ -108,12 +108,12 @@ jobs:
           node-version: '20'
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: |
-          yarn tsn examples/demo.ts
+          corepack pnpm tsn examples/demo.ts
 
   ecosystem_tests:
     name: ecosystem tests (v${{ matrix.node-version }})
@@ -138,12 +138,16 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
+      - name: Verify Bun install policy
+        working-directory: ecosystem-tests/bun
+        run: bun install --frozen-lockfile
+
       - name: Bootstrap
         run: ./scripts/bootstrap
 
       - name: Run ecosystem tests
         run: |
-          yarn tsn ecosystem-tests/cli.ts --live --verbose --parallel --jobs=4 --retry=3
+          corepack pnpm tsn ecosystem-tests/cli.ts --live --verbose --parallel --jobs=4 --retry=3
         env:
           DISABLE_V8_COMPILE_CACHE: '1'
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

.github/workflows/create-releases.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Install dependencies
         if: ${{ steps.release.outputs.releases_created }}
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Publish to NPM
         if: ${{ steps.release.outputs.releases_created }}
@@ -45,4 +45,3 @@ jobs:
         if: ${{ steps.release.outputs.releases_created }}
         run: |
           bash ./bin/publish-jsr
-

.github/workflows/detect-breaking-changes.yml

@@ -26,7 +26,7 @@ jobs:
           node-version: '20'
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Detect breaking changes
         run: |
@@ -44,12 +44,6 @@ jobs:
         with:
           node-version: '20'
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with:
-          version: 10.25.0
-          run_install: false
-
       # Setup this sdk
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
@@ -71,20 +65,20 @@ jobs:
 
       - name: Link agents packages to local SDKs
         working-directory: openai-agents-js
-        run: pnpm --filter @openai/agents-core --filter @openai/agents-openai --filter @openai/agents add file:../../../openai-node/dist
+        run: corepack pnpm --filter @openai/agents-core --filter @openai/agents-openai --filter @openai/agents add file:../../../openai-node/dist
 
       - name: Install dependencies
         working-directory: openai-agents-js
-        run: pnpm install
+        run: corepack pnpm install --frozen-lockfile
 
       - name: Build all packages
         working-directory: openai-agents-js
-        run: pnpm build
+        run: corepack pnpm build
 
       - name: Run linter
         working-directory: openai-agents-js
-        run: pnpm lint
+        run: corepack pnpm lint
 
       - name: Type-check docs scripts
         working-directory: openai-agents-js
-        run: pnpm docs:scripts:check
+        run: corepack pnpm docs:scripts:check

.github/workflows/publish-jsr.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Publish to JSR
         run: |

.github/workflows/publish-npm.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Publish to NPM
         run: |

CONTRIBUTING.md

@@ -1,13 +1,13 @@
 ## Setting up the environment
 
-This repository uses [`yarn@v1`](https://classic.yarnpkg.com/lang/en/docs/install).
+This repository uses [`pnpm`](https://pnpm.io/) via Corepack.
 Other package managers may work but are not officially supported for development.
 
 To set up the repository, run:
 
 ```sh
-$ yarn
-$ yarn build
+$ corepack pnpm install
+$ corepack pnpm build
 ```
 
 This will install all the required dependencies and build output files to `dist/`.
@@ -25,14 +25,14 @@ All files in the `examples/` directory are not modified by the generator and can
 ```ts
 // add an example to examples/<your-example>.ts
 
-#!/usr/bin/env -S npm run tsn -T
+#!/usr/bin/env -S corepack pnpm tsn -T
 …
 ```
 
 ```sh
 $ chmod +x examples/<your-example>.ts
 # run the example against your api
-$ yarn tsn -T examples/<your-example>.ts
+$ corepack pnpm tsn -T examples/<your-example>.ts
 ```
 
 ## Using the repository from source
@@ -52,15 +52,10 @@ Alternatively, to link a local copy of the repo:
 $ git clone https://www.github.com/openai/openai-node
 $ cd openai-node
 
-# With yarn
-$ yarn link
-$ cd ../my-package
-$ yarn link openai
-
 # With pnpm
-$ pnpm link --global
+$ corepack pnpm link --global
 $ cd ../my-package
-$ pnpm link --global openai
+$ corepack pnpm link --global openai
 ```
 
 ## Running tests
@@ -72,7 +67,7 @@ $ ./scripts/mock
 ```
 
 ```sh
-$ yarn run test
+$ corepack pnpm run test
 ```
 
 ## Linting and formatting
@@ -83,13 +78,13 @@ This repository uses [prettier](https://www.npmjs.com/package/prettier) and
 To lint:
 
 ```sh
-$ yarn lint
+$ corepack pnpm lint
 ```
 
 To format and fix all lint issues automatically:
 
 ```sh
-$ yarn fix
+$ corepack pnpm fix
 ```
 
 ## Publishing and releases

bin/publish-jsr

@@ -3,9 +3,9 @@
 set -eux
 
 # Build the project
-yarn build
+corepack pnpm build
 
 # Navigate to the dist directory
 cd dist-deno
 
-npx jsr publish ${JSR_TOKEN:+"--token=$JSR_TOKEN"}
+../node_modules/.bin/jsr publish ${JSR_TOKEN:+"--token=$JSR_TOKEN"}

bin/publish-npm

@@ -2,14 +2,20 @@
 
 set -eux
 
+NPM_BIN="$PWD/node_modules/.bin/npm"
+if [[ ! -x "$NPM_BIN" ]]; then
+  echo "ERROR: local npm CLI not found. Run corepack pnpm install first."
+  exit 1
+fi
+
 if [[ ${NPM_TOKEN:-} ]]; then
-  npm config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
+  "$NPM_BIN" config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
 elif [[ ! ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-} ]]; then
   echo "ERROR: NPM_TOKEN must be set if not running in a Github Action with id-token permission"
   exit 1
 fi
 
-yarn build
+corepack pnpm build
 cd dist
 
 # Get package name and version from package.json
@@ -26,7 +32,7 @@ VERSION="$(jq -r -e '.version' ./package.json)"
 #     "detail": "'the_package' is not in this registry..."
 #   }
 # }
-NPM_INFO="$(npm view "$PACKAGE_NAME" version --json 2>/dev/null || true)"
+NPM_INFO="$("$NPM_BIN" view "$PACKAGE_NAME" version --json 2>/dev/null || true)"
 
 # Check if we got an E404 error
 if echo "$NPM_INFO" | jq -e '.error.code == "E404"' > /dev/null 2>&1; then
@@ -62,9 +68,6 @@ else
   TAG="latest"
 fi
 
-# Install OIDC compatible npm version
-npm install --prefix ../oidc/ npm@11.6.2
-
 # Publish with the appropriate tag
 export npm_config_registry='https://registry.npmjs.org'
-../oidc/node_modules/.bin/npm publish --tag "$TAG"
+"$NPM_BIN" publish --tag "$TAG"

bunfig.toml

@@ -0,0 +1,2 @@
+[install]
+minimumReleaseAge = 604800

ecosystem-tests/browser-direct-import/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/bun/bunfig.toml

@@ -0,0 +1,2 @@
+[install]
+minimumReleaseAge = 604800

ecosystem-tests/cli.ts

@@ -365,8 +365,9 @@ async function main() {
               await withRetry(
                 async () => {
                   const child = execa(
-                    'yarn',
+                    'corepack',
                     [
+                      'pnpm',
                       'tsn',
                       __filename,
                       project,
@@ -532,12 +533,16 @@ async function buildPackage() {
   // Run our build script to ensure all of our build artifacts are up to date.
   // This matters the most for deno as it directly relies on build artifacts
   // instead of the pack file
-  await run('yarn', ['build']);
-
-  const proc = await run('npm', ['pack', '--ignore-scripts', '--json'], {
-    cwd: path.join(process.cwd(), 'dist'),
-    alwaysPipe: true,
-  });
+  await run('corepack', ['pnpm', 'build']);
+
+  const proc = await run(
+    path.join(state.rootDir, 'node_modules/.bin/npm'),
+    ['pack', '--ignore-scripts', '--json'],
+    {
+      cwd: path.join(process.cwd(), 'dist'),
+      alwaysPipe: true,
+    },
+  );
 
   const pack = JSON.parse(proc.stdout);
   assert(Array.isArray(pack), `Expected pack output to be an array but got ${typeof pack}`);

ecosystem-tests/cloudflare-worker/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-js/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-ts-cjs-auto/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-ts-cjs-web/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-ts-cjs/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-ts-esm-auto/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-ts-esm-web/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-ts-esm/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/node-ts4.5-jest28/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/ts-browser-webpack/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root

ecosystem-tests/vercel-edge/.npmrc

@@ -0,0 +1,4 @@
+engine-strict=true
+min-release-age=7
+ignore-scripts=true
+allow-git=root