Merge branch 'master' into feat/assign-multi-channels

Resolve i18n catalog conflicts by re-extracting translations after merging master.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: casperiv0

.github/workflows/docs_ci.yml

@@ -11,6 +11,7 @@ on:
             - '!docs/manifest.json'
             - 'lerna.json'
     pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
         branches:
             - master
             - minor
@@ -27,6 +28,8 @@ concurrency:
 jobs:
     validate:
         name: Validate MDX
+        # Skip draft PRs
+        if: ${{ github.event_name == 'push' || !github.event.pull_request.draft }}
         permissions:
             contents: read
         runs-on: ubuntu-latest
@@ -48,8 +51,8 @@ jobs:
 
     generate-manifest:
         name: Generate & commit manifest
-        # Skip fork PRs — can't push back to fork branches
-        if: ${{ github.event_name == 'push' || !github.event.pull_request.head.repo.fork }}
+        # Skip fork PRs (can't push back to fork branches) and draft PRs
+        if: ${{ github.event_name == 'push' || (!github.event.pull_request.head.repo.fork && !github.event.pull_request.draft) }}
         runs-on: ubuntu-latest
         permissions:
             contents: write

.github/workflows/generate_docs.yml

@@ -2,6 +2,7 @@ name: Generate Docs
 
 on:
     pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
         branches:
             - master
             - minor
@@ -17,8 +18,8 @@ concurrency:
 jobs:
     generate:
         name: Generate & commit docs
-        # Skip fork PRs — can't push back to fork branches
-        if: ${{ !github.event.pull_request.head.repo.fork }}
+        # Skip fork PRs (can't push back to fork branches) and draft PRs
+        if: ${{ !github.event.pull_request.head.repo.fork && !github.event.pull_request.draft }}
         runs-on: ubuntu-latest
         permissions:
             contents: write

.github/workflows/publish_and_install.yml

@@ -209,3 +209,91 @@ jobs:
                 name: dashboard-test-screenshots-${{ matrix.os }}-${{ matrix.node-version }}
                 path: /tmp/dashboard-test-*.png
                 retention-days: 28
+
+    # Job 3: Verify `@vendure/create` works end-to-end when invoked via bun and pnpm.
+    # The package manager is detected from npm_config_user_agent (which bunx / pnpm dlx
+    # set), so the install step and generated project must use that manager rather than
+    # hard-coding npm (#4390).
+    test_package_managers:
+        needs: build_and_publish
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+        strategy:
+            matrix:
+                include:
+                    - pm: bun
+                      scaffold: bunx @vendure/create@ci test-app --ci --log-level info
+                    - pm: pnpm
+                      scaffold: pnpm dlx @vendure/create@ci test-app --ci --log-level info
+            fail-fast: false
+        steps:
+            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - name: Use Node.js 22.x
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version: 22.x
+            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+              with:
+                  bun-version: '1.3.10'
+            - name: Enable pnpm via corepack
+              run: |
+                  corepack enable
+                  corepack prepare pnpm@9.15.9 --activate
+                  pnpm --version
+            - name: Download Verdaccio storage
+              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+              with:
+                  name: verdaccio-storage
+                  path: ~/verdaccio-download
+            - name: Setup Verdaccio with pre-built packages
+              run: |
+                  npm install -g verdaccio
+                  npm install -g wait-on
+                  mkdir -p $HOME/.config/verdaccio
+                  cp -v ./.github/workflows/verdaccio/config.yaml $HOME/.config/verdaccio/config.yaml
+                  cd $HOME/.config/verdaccio
+                  tar -xzf ~/verdaccio-download/verdaccio-storage.tar.gz
+                  nohup verdaccio --config $HOME/.config/verdaccio/config.yaml &
+                  wait-on http://localhost:4873
+                  # Register a Verdaccio user and capture an auth token.
+                  TOKEN_RES=$(curl -XPUT \
+                    -H "Content-type: application/json" \
+                    -d '{ "name": "test", "password": "test" }' \
+                    'http://localhost:4873/-/user/org.couchdb.user:test')
+                  TOKEN=$(echo "$TOKEN_RES" | jq -r '.token')
+                  # npm + pnpm read ~/.npmrc; bun is pointed at Verdaccio via the
+                  # npm_config_registry env var on the install step (see below).
+                  npm set registry=http://localhost:4873
+                  npm set //localhost:4873/:_authToken $TOKEN
+            - name: Install via @vendure/create using ${{ matrix.pm }}
+              # bun ignores the home-directory ~/.npmrc (oven-sh/bun#22971) and does not walk
+              # up to a parent .npmrc/bunfig, but it DOES honour the npm_config_registry env
+              # var — and so does the scaffolded project's nested install (it inherits the
+              # env). This is the one mechanism that reaches both bunx and the nested install.
+              env:
+                  CI: true
+                  npm_config_registry: http://localhost:4873/
+              run: |
+                  mkdir -p $HOME/install
+                  cd $HOME/install
+                  npm dist-tag ls @vendure/create
+                  # No --use-npm: the manager is detected from the invoking bunx / pnpm dlx.
+                  ${{ matrix.scaffold }}
+            - name: Assert the generated project used ${{ matrix.pm }}
+              run: |
+                  cd $HOME/install/test-app
+                  case "${{ matrix.pm }}" in
+                    bun) test -f bun.lock || { echo "Expected bun.lock to exist"; ls -la; exit 1; } ;;
+                    pnpm) test -f pnpm-lock.yaml || { echo "Expected pnpm-lock.yaml to exist"; ls -la; exit 1; } ;;
+                  esac
+                  echo "Lockfile for ${{ matrix.pm }} present ✓"
+            - name: Server smoke tests
+              run: |
+                  cd $HOME/install/test-app
+                  ${{ matrix.pm }} run dev &
+                  node $GITHUB_WORKSPACE/.github/workflows/scripts/smoke-tests
+            - name: Kill dev server after smoke tests
+              if: always()
+              run: |
+                  lsof -ti:3000,5173 | xargs kill 2>/dev/null || true

.github/workflows/publish_to_npm.yml

@@ -66,6 +66,10 @@ jobs:
       id-token: write
     strategy:
       fail-fast: false
+      # Both nightly jobs publish new versions of the same packages. npm rejects
+      # a publish with E409 while it is still processing a previous publish of
+      # the same package, so the jobs must not run concurrently.
+      max-parallel: 1
       matrix:
         type: ${{ fromJson(needs.setup.outputs.matrix) }}
 
@@ -168,15 +172,19 @@ jobs:
         run: |
           bunx lerna exec --no-private -- 'publish_dir=$(node -p "require(\"./package.json\").publishConfig?.directory || \".\"") && cd "$publish_dir" && npm stage publish --access public'
 
+      # --no-bail: a failure in one package must not skip publishing the rest —
+      # downstream consumers expect ALL packages to exist at a given nightly
+      # version. The retry loop handles transient registry errors (e.g. E409
+      # while npm is still processing an earlier publish of the same package).
       - name: Publish to NPM (master-nightly)
         if: matrix.type == 'master-nightly' && steps.commit_check.outputs.should_publish == 'true'
         run: |
-          bunx lerna exec --no-private -- 'publish_dir=$(node -p "require(\"./package.json\").publishConfig?.directory || \".\"") && cd "$publish_dir" && npm publish --access public --tag master'
+          bunx lerna exec --no-private --no-bail -- 'publish_dir=$(node -p "require(\"./package.json\").publishConfig?.directory || \".\"") && cd "$publish_dir" && for i in 1 2 3; do npm publish --access public --tag master && break; if [ "$i" = 3 ]; then exit 1; fi; echo "npm publish failed, retrying in 30s..."; sleep 30; done'
 
       - name: Publish to NPM (minor-nightly)
         if: matrix.type == 'minor-nightly' && steps.commit_check.outputs.should_publish == 'true'
         run: |
-          bunx lerna exec --no-private -- 'publish_dir=$(node -p "require(\"./package.json\").publishConfig?.directory || \".\"") && cd "$publish_dir" && npm publish --access public --tag minor'
+          bunx lerna exec --no-private --no-bail -- 'publish_dir=$(node -p "require(\"./package.json\").publishConfig?.directory || \".\"") && cd "$publish_dir" && for i in 1 2 3; do npm publish --access public --tag minor && break; if [ "$i" = 3 ]; then exit 1; fi; echo "npm publish failed, retrying in 30s..."; sleep 30; done'
 
       - name: Skip publish (no new commits)
         if: matrix.type != 'release' && steps.commit_check.outputs.should_publish == 'false'

.gitignore

@@ -393,3 +393,7 @@ __admin-ui/
 
 # Vendure telemetry installation ID
 .vendure/
+
+# Bun is the canonical package manager; package-lock.json is only generated
+# locally (e.g. for the dependency-tracker script) and must not be committed.
+package-lock.json