Switch package manager from yarn to pnpm

[aileen]

Why

Standardise this theme on pnpm so CI and contributors agree on one lockfile and one resolution algorithm, matching the shared TryGhost theme convention (Casper, Massively, Pico, et al. pin pnpm@11.5.1).

The repo previously carried both a yarn.lock and a committed package-lock.json with npm-based scripts, leaving the package manager ambiguous — installs could resolve differently depending on which tool a contributor reached for.

Changes

• Pin "packageManager": "pnpm@11.5.1" as the single source of truth (corepack resolves the pnpm version from this field; pnpm/action-setup needs no version: input).
• Swap npm run → pnpm in scripts (zip, pretest).
• Add a test:ci / pretest:ci pair: pretest:ci runs pnpm zip so CI rebuilds assets before gscan rather than testing stale committed assets/built/*, and test:ci runs gscan --fatal --verbose so a fatal compatibility issue fails CI.
• Delete the redundant yarn.lock and package-lock.json; pnpm-lock.yaml (lockfileVersion 9.0) is now the only lockfile.
• README install/dev/build/zip/test commands now use pnpm.

Per-repo decision — no pnpm-workspace.yaml

pnpm 11 gates dependency install/postinstall build scripts, but this rollup-based theme's tree contains none: the only native package is fsevents@2.3.3, whose lifecycle scripts are build/prepublishOnly (not install/postinstall), so pnpm never flags it. (The gulp-based sibling themes pull in fsevents@1.x + dtrace-provider, which do have install hooks — hence their allowBuilds lists; this repo does not.) A clean pnpm install emits no "Ignored build scripts" warning, so an allowBuilds file would be cargo-culting.

CI hardening (matches the shared convention)

• Add test.yml running pnpm test on PRs.
• Gate deploy-theme.yml behind a test job (needs: test) running pnpm test:ci, so a broken build or fatal gscan aborts the deploy instead of shipping it.
• Pin action digests, set permissions: contents: read, persist-credentials: false, cache the pnpm store keyed on pnpm-lock.yaml, use --frozen-lockfile. Drop the stale master branch trigger.

Verification

• pnpm install --frozen-lockfile — clean
• pnpm test:ci — no fatal Ghost 6.x compatibility issues, exit 0
• pnpm zip — produces ghost-starter-theme.zip ($npm_package_name resolves under pnpm)

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ac866233-cf7d-4640-af96-6fec096092a8

📥 Commits

Reviewing files that changed from the base of the PR and between 4200205 and 83128d9.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• package.json
• pnpm-workspace.yaml

✅ Files skipped from review due to trivial changes (1)

• pnpm-workspace.yaml

---

Walkthrough

This PR migrates the project to pnpm: it sets packageManager to pnpm@11.5.1, updates scripts to use pnpm and the local gscan binary, adds gscan to devDependencies, updates README commands, and adds pnpm workspace build approvals. It adds a pull-request test workflow that installs with a frozen lockfile and runs pnpm test, and updates the deploy workflow to run only on main, declare contents: read, run a test job (pnpm test:ci) on ubuntu-latest, and make deploy depend on that test.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: switching the package manager from yarn to pnpm, which is the primary objective of this pull request.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset, providing clear context for why the change was made, what was changed, and verification steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch switch-to-pnpm

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 17-20: The test scripts ("test" and "test:ci") call an unpinned
npx gscan which makes runs nondeterministic; add gscan to devDependencies with a
fixed version (e.g., "gscan": "x.y.z"), update package.json to use the local
binary (keep "npx gscan" or better "gscan" in the "test" and "test:ci" scripts
to rely on the installed devDependency), and remove reliance on unpinned npx by
running pnpm install so CI and local runs use the pinned gscan; update
package.json's devDependencies and adjust the "test"/"test:ci" script entries
accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7ce32968-57ba-4357-ba6e-2e4088229856

📥 Commits

Reviewing files that changed from the base of the PR and between 2f70a26 and 4200205.

⛔ Files ignored due to path filters (3)

• package-lock.json is excluded by !**/package-lock.json
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/deploy-theme.yml
• .github/workflows/test.yml
• README.md
• package.json