chore: パッケージマネージャを npm から pnpm へ移行

.github/pull_request_template.md

@@ -8,6 +8,6 @@
 
 ## Test plan
 
-- [ ] `npm run all` is green (typecheck + lint + test + build)
+- [ ] `pnpm run all` is green (typecheck + lint + test + build)
 - [ ] `dist/` rebuilt and committed (if `src/` changed)
 - [ ] CI / self-test pass

.github/workflows/ci.yml

@@ -23,16 +23,19 @@ jobs:
         with:
           persist-credentials: false
 
+      # pnpm must be set up before setup-node so `cache: pnpm` can find it.
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
-          cache: npm
+          cache: pnpm
 
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
 
-      - run: npm run typecheck
-      - run: npm run lint
-      - run: npm run test:coverage
+      - run: pnpm run typecheck
+      - run: pnpm run lint
+      - run: pnpm run test:coverage
 
       # Coverage + test analytics via Codecov, authenticated with OIDC — no
       # CODECOV_TOKEN secret needed. Non-blocking (fail_ci_if_error: false) so a
@@ -56,10 +59,10 @@ jobs:
           use_oidc: true
           fail_ci_if_error: false
 
-      - run: npm run build
+      - run: pnpm run build
 
       # The committed dist/ must match a fresh build, otherwise the action
-      # would run stale code. Fail if `npm run build` produced a diff.
+      # would run stale code. Fail if `pnpm run build` produced a diff.
       - name: Verify dist/ is up to date
         run: |
           if [ -n "$(git status --porcelain dist)" ]; then

.github/workflows/self-test.yml

@@ -28,12 +28,13 @@ jobs:
           persist-credentials: false
 
       # The action runs from dist/, so build it first in CI.
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
-          cache: npm
-      - run: npm ci
-      - run: npm run build
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
 
       - name: Run setup-task (first install — expect cache miss)
         id: setup
@@ -91,12 +92,13 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
-          cache: npm
-      - run: npm ci
-      - run: npm run build
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
 
       # skip-checksum bypasses SHA256 verification and must still install.
       # (Checksum verification with mismatch detection is covered by the matrix

CLAUDE.md

@@ -8,20 +8,24 @@ A GitHub Action (TypeScript, Node 24 runtime) that installs the [go-task](https:
 
 ## Commands
 
+This repo uses **pnpm** (enforced via a `preinstall` guard; version pinned in
+`package.json` `packageManager`). Use `corepack enable` to get it.
+
 ```bash
-npm run all          # typecheck + lint + test + build — run before committing
-npm run typecheck    # tsc --noEmit
-npm run lint         # eslint .   (lint:fix to autofix)
-npm run test         # vitest run
-npm run test:watch   # vitest in watch mode
-npm run build        # ncc bundles src/main.ts -> dist/index.js
-npx vitest run tests/version.test.ts            # run a single test file
-npx vitest run -t "resolves a semver range"     # run tests matching a name
+pnpm install         # honours minimumReleaseAge cooldown (pnpm-workspace.yaml)
+pnpm run all         # typecheck + lint + test + build — run before committing
+pnpm run typecheck   # tsc --noEmit
+pnpm run lint        # eslint .   (lint:fix to autofix)
+pnpm run test        # vitest run
+pnpm run test:watch  # vitest in watch mode
+pnpm run build       # ncc bundles src/main.ts -> dist/index.js
+pnpm exec vitest run tests/version.test.ts        # run a single test file
+pnpm exec vitest run -t "resolves a semver range" # run tests matching a name
 ```
 
 ## Critical: `dist/` is committed and must stay in sync
 
-GitHub Actions runs the bundled `dist/index.js` directly (see `action.yml` → `main: dist/index.js`), **not** the TypeScript source. After any change under `src/`, run `npm run build` and commit the regenerated `dist/`. CI (`.github/workflows/ci.yml`) fails the build if `git status --porcelain dist` is non-empty — i.e. if the committed `dist/` doesn't match a fresh build.
+GitHub Actions runs the bundled `dist/index.js` directly (see `action.yml` → `main: dist/index.js`), **not** the TypeScript source. After any change under `src/`, run `pnpm run build` and commit the regenerated `dist/`. CI (`.github/workflows/ci.yml`) fails the build if `git status --porcelain dist` is non-empty — i.e. if the committed `dist/` doesn't match a fresh build. (Rebuild with the same pnpm version CI uses — the `packageManager` pin keeps them aligned.)
 
 ## Architecture
 

CONTRIBUTING.md

@@ -4,27 +4,32 @@ Thanks for considering a contribution to `setup-task`!
 
 ## Development
 
-Requires Node 24+.
+Requires Node 24+ and [pnpm](https://pnpm.io) (this repo enforces pnpm; the
+pinned version is in `package.json`'s `packageManager` field — `corepack enable`
+will provide it).
 
 ```bash
-npm install
-npm run all      # typecheck + lint + test + build — run before pushing
-npm test         # vitest (test:watch for watch mode)
-npm run lint     # eslint  (lint:fix to autofix)
+pnpm install
+pnpm run all      # typecheck + lint + test + build — run before pushing
+pnpm test         # vitest (test:watch for watch mode)
+pnpm run lint     # eslint  (lint:fix to autofix)
 ```
 
+> Dependency installs honour a supply-chain cooldown (`minimumReleaseAge` in
+> `pnpm-workspace.yaml`): versions published in the last 3 days are not used.
+
 ### `dist/` is committed — keep it in sync
 
 GitHub Actions runs the bundled `dist/index.js` directly, so it is checked into
-the repository. After any change under `src/`, run `npm run build` and commit
+the repository. After any change under `src/`, run `pnpm run build` and commit
 the regenerated `dist/`. CI fails if the committed `dist/` does not match a
 fresh build.
 
 ## Pull requests
 
 - Branch from `main` and open a PR — direct pushes to `main` are blocked.
 - `main` uses **squash merge**; keep each PR focused on one change.
-- Make sure `npm run all` is green and `dist/` has been rebuilt.
+- Make sure `pnpm run all` is green and `dist/` has been rebuilt.
 - Reference any related issue (e.g. `Closes #123`).
 
 See [CLAUDE.md](./CLAUDE.md) for the architecture overview and design rationale.

README.md

@@ -68,9 +68,11 @@ Replace the `uses:` line — the common inputs are compatible:
 
 ## Development
 
+Uses [pnpm](https://pnpm.io) (`corepack enable` provides the pinned version).
+
 ```bash
-npm install
-npm run all        # typecheck + lint + test + build (bundles dist/)
+pnpm install
+pnpm run all       # typecheck + lint + test + build (bundles dist/)
 ```
 
 `dist/` is committed because GitHub Actions run the bundled `dist/index.js` directly. CI fails if it is out of date.

TODO.md

@@ -37,7 +37,7 @@ GitHub の各マイルストーンページ。`(FR/NFR/§)` は要求仕様書
 | # | 概要 | 優先度 | ラベル |
 |---|---|---|---|
 | [#8](https://github.com/yk-lab/setup-task/issues/8) | `[ci]` Codecov でカバレッジを PR 表示（ネイティブ機能は個人アカウント不可） | `P3: low` | `ci` `test` |
-| [#9](https://github.com/yk-lab/setup-task/issues/9) | `[chore]` lefthook で pre-push に `npm run all`（stale dist 防止） | `P3: low` | `chore` `ci` |
+| [#9](https://github.com/yk-lab/setup-task/issues/9) | `[chore]` lefthook で pre-push に `pnpm run all`（stale dist 防止） | `P3: low` | `chore` `ci` |
 
 ### 未 Issue 化