Harden package installs with pnpm and CI updates

.github/workflows/ci.yml

@@ -108,12 +108,12 @@ jobs:
           node-version: '20'
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: |
-          yarn tsn examples/demo.ts
+          corepack pnpm tsn examples/demo.ts
 
   ecosystem_tests:
     name: ecosystem tests (v${{ matrix.node-version }})
@@ -138,12 +138,16 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
+      - name: Verify Bun install policy
+        working-directory: ecosystem-tests/bun
+        run: bun install --frozen-lockfile
+
       - name: Bootstrap
         run: ./scripts/bootstrap
 
       - name: Run ecosystem tests
         run: |
-          yarn tsn ecosystem-tests/cli.ts --live --verbose --parallel --jobs=4 --retry=3
+          corepack pnpm tsn ecosystem-tests/cli.ts --live --verbose --parallel --jobs=4 --retry=3
         env:
           DISABLE_V8_COMPILE_CACHE: '1'
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

.github/workflows/create-releases.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Install dependencies
         if: ${{ steps.release.outputs.releases_created }}
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Publish to NPM
         if: ${{ steps.release.outputs.releases_created }}
@@ -45,4 +45,3 @@ jobs:
         if: ${{ steps.release.outputs.releases_created }}
         run: |
           bash ./bin/publish-jsr
-

.github/workflows/detect-breaking-changes.yml

@@ -26,7 +26,7 @@ jobs:
           node-version: '20'
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Detect breaking changes
         run: |
@@ -44,12 +44,6 @@ jobs:
         with:
           node-version: '20'
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with:
-          version: 10.25.0
-          run_install: false
-
       # Setup this sdk
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
@@ -71,20 +65,20 @@ jobs:
 
       - name: Link agents packages to local SDKs
         working-directory: openai-agents-js
-        run: pnpm --filter @openai/agents-core --filter @openai/agents-openai --filter @openai/agents add file:../../../openai-node/dist
+        run: corepack pnpm --filter @openai/agents-core --filter @openai/agents-openai --filter @openai/agents add file:../../../openai-node/dist
 
       - name: Install dependencies
         working-directory: openai-agents-js
-        run: pnpm install
+        run: corepack pnpm install --frozen-lockfile
 
       - name: Build all packages
         working-directory: openai-agents-js
-        run: pnpm build
+        run: corepack pnpm build
 
       - name: Run linter
         working-directory: openai-agents-js
-        run: pnpm lint
+        run: corepack pnpm lint
 
       - name: Type-check docs scripts
         working-directory: openai-agents-js
-        run: pnpm docs:scripts:check
+        run: corepack pnpm docs:scripts:check

.github/workflows/publish-jsr.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Publish to JSR
         run: |

.github/workflows/publish-npm.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          yarn install
+          ./scripts/bootstrap
 
       - name: Publish to NPM
         run: |

CONTRIBUTING.md

@@ -1,16 +1,18 @@
 ## Setting up the environment
 
-This repository uses [`yarn@v1`](https://classic.yarnpkg.com/lang/en/docs/install).
+This repository uses [`pnpm`](https://pnpm.io/) via Corepack.
 Other package managers may work but are not officially supported for development.
 
 To set up the repository, run:
 
 ```sh
-$ yarn
-$ yarn build
+$ ./scripts/bootstrap
+$ corepack pnpm build
 ```
 
 This will install all the required dependencies and build output files to `dist/`.
+`./scripts/bootstrap` uses the committed `pnpm-lock.yaml` and will fail if it is out of sync with `package.json`.
+When intentionally changing dependencies, update them explicitly with `corepack pnpm add`, `corepack pnpm up`, or `corepack pnpm install`, then commit the resulting lockfile changes.
 
 ## Modifying/Adding code
 
@@ -25,14 +27,14 @@ All files in the `examples/` directory are not modified by the generator and can
 ```ts
 // add an example to examples/<your-example>.ts
 
-#!/usr/bin/env -S npm run tsn -T
+#!/usr/bin/env -S corepack pnpm tsn -T
 …
 ```
 
 ```sh
 $ chmod +x examples/<your-example>.ts
 # run the example against your api
-$ yarn tsn -T examples/<your-example>.ts
+$ corepack pnpm tsn -T examples/<your-example>.ts
 ```
 
 ## Using the repository from source
@@ -52,15 +54,10 @@ Alternatively, to link a local copy of the repo:
 $ git clone https://www.github.com/openai/openai-node
 $ cd openai-node
 
-# With yarn
-$ yarn link
-$ cd ../my-package
-$ yarn link openai
-
 # With pnpm
-$ pnpm link --global
+$ corepack pnpm link --global
 $ cd ../my-package
-$ pnpm link --global openai
+$ corepack pnpm link --global openai
 ```
 
 ## Running tests
@@ -72,7 +69,7 @@ $ ./scripts/mock
 ```
 
 ```sh
-$ yarn run test
+$ corepack pnpm run test
 ```
 
 ## Linting and formatting
@@ -83,13 +80,13 @@ This repository uses [prettier](https://www.npmjs.com/package/prettier) and
 To lint:
 
 ```sh
-$ yarn lint
+$ corepack pnpm lint
 ```
 
 To format and fix all lint issues automatically:
 
 ```sh
-$ yarn fix
+$ corepack pnpm fix
 ```
 
 ## Publishing and releases

bin/publish-jsr

@@ -3,9 +3,9 @@
 set -eux
 
 # Build the project
-yarn build
+corepack pnpm build
 
 # Navigate to the dist directory
 cd dist-deno
 
-npx jsr publish ${JSR_TOKEN:+"--token=$JSR_TOKEN"}
+../node_modules/.bin/jsr publish ${JSR_TOKEN:+"--token=$JSR_TOKEN"}

bin/publish-npm

@@ -2,14 +2,20 @@
 
 set -eux
 
+NPM_BIN="$PWD/node_modules/.bin/npm"
+if [[ ! -x "$NPM_BIN" ]]; then
+  echo "ERROR: local npm CLI not found. Run corepack pnpm install first."
+  exit 1
+fi
+
 if [[ ${NPM_TOKEN:-} ]]; then
-  npm config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
+  "$NPM_BIN" config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
 elif [[ ! ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-} ]]; then
   echo "ERROR: NPM_TOKEN must be set if not running in a Github Action with id-token permission"
   exit 1
 fi
 
-yarn build
+corepack pnpm build
 cd dist
 
 # Get package name and version from package.json
@@ -26,7 +32,7 @@ VERSION="$(jq -r -e '.version' ./package.json)"
 #     "detail": "'the_package' is not in this registry..."
 #   }
 # }
-NPM_INFO="$(npm view "$PACKAGE_NAME" version --json 2>/dev/null || true)"
+NPM_INFO="$("$NPM_BIN" view "$PACKAGE_NAME" version --json 2>/dev/null || true)"
 
 # Check if we got an E404 error
 if echo "$NPM_INFO" | jq -e '.error.code == "E404"' > /dev/null 2>&1; then
@@ -62,9 +68,6 @@ else
   TAG="latest"
 fi
 
-# Install OIDC compatible npm version
-npm install --prefix ../oidc/ [email protected]
-
 # Publish with the appropriate tag
 export npm_config_registry='https://registry.npmjs.org'
-../oidc/node_modules/.bin/npm publish --tag "$TAG"
+"$NPM_BIN" publish --tag "$TAG"

bunfig.toml

@@ -0,0 +1,2 @@
+[install]
+minimumReleaseAge = 604800

ecosystem-tests/browser-direct-import/.npmrc

@@ -0,0 +1,3 @@
+engine-strict=true
+min-release-age=7
+allow-git=root

ecosystem-tests/bun/bunfig.toml

@@ -0,0 +1,2 @@
+[install]
+minimumReleaseAge = 604800

ecosystem-tests/cli.ts

@@ -13,9 +13,9 @@ const IS_CI = Boolean(process.env['CI'] && process.env['CI'] !== 'false');
 
 async function defaultNodeRunner() {
   await installPackage();
-  await run('npm', ['run', 'tsc']);
+  await runNpm(['run', 'tsc']);
   if (state.live) {
-    await run('npm', ['test']);
+    await runNpm(['test']);
   }
 }
 
@@ -34,11 +34,11 @@ const projectRunners = {
   'ts-browser-webpack': async () => {
     await installPackage();
 
-    await run('npm', ['run', 'tsc']);
-    await run('npm', ['run', 'build']);
+    await runNpm(['run', 'tsc']);
+    await runNpm(['run', 'build']);
 
     if (state.live) {
-      await run('npm', ['run', 'test:ci']);
+      await runNpm(['run', 'test:ci']);
     }
   },
   'browser-direct-import': async () => {
@@ -47,38 +47,38 @@ const projectRunners = {
     await fs.rm('public/node_modules', { force: true });
     await fs.symlink('../node_modules', 'public/node_modules');
 
-    await run('npm', ['run', 'tsc']);
+    await runNpm(['run', 'tsc']);
 
     if (state.live) {
-      await run('npm', ['run', 'test:ci']);
+      await runNpm(['run', 'test:ci']);
     }
   },
   'vercel-edge': async () => {
     await installPackage();
 
     if (state.live) {
-      await run('npm', ['run', 'test:ci:dev']);
+      await runNpm(['run', 'test:ci:dev']);
     }
-    await run('npm', ['run', 'build']);
+    await runNpm(['run', 'build']);
 
     if (state.live) {
-      await run('npm', ['run', 'test:ci']);
+      await runNpm(['run', 'test:ci']);
     }
     if (state.deploy) {
-      await run('npm', ['run', 'vercel', 'deploy', '--prod', '--force']);
+      await runNpm(['run', 'vercel', 'deploy', '--prod', '--force']);
     }
   },
   'cloudflare-worker': async () => {
     await installPackage();
 
     await fs.writeFile('.dev.vars', `OPENAI_API_KEY='${process.env['OPENAI_API_KEY']}'`);
-    await run('npm', ['run', 'tsc']);
+    await runNpm(['run', 'tsc']);
 
     if (state.live) {
-      await run('npm', ['run', 'test:ci']);
+      await runNpm(['run', 'test:ci']);
     }
     if (state.deploy) {
-      await run('npm', ['run', 'deploy']);
+      await runNpm(['run', 'deploy']);
     }
   },
   bun: async () => {
@@ -91,7 +91,7 @@ const projectRunners = {
     await fs.copyFile(packFile, `./${TAR_NAME}`);
     await run('bun', ['install', '-D', `./${TAR_NAME}`]);
 
-    await run('npm', ['run', 'tsc']);
+    await runNpm(['run', 'tsc']);
 
     if (state.live) {
       await run('bun', ['test']);
@@ -365,8 +365,9 @@ async function main() {
               await withRetry(
                 async () => {
                   const child = execa(
-                    'yarn',
+                    'corepack',
                     [
+                      'pnpm',
                       'tsn',
                       __filename,
                       project,
@@ -532,9 +533,9 @@ async function buildPackage() {
   // Run our build script to ensure all of our build artifacts are up to date.
   // This matters the most for deno as it directly relies on build artifacts
   // instead of the pack file
-  await run('yarn', ['build']);
+  await run('corepack', ['pnpm', 'build']);
 
-  const proc = await run('npm', ['pack', '--ignore-scripts', '--json'], {
+  const proc = await run(getPinnedNpmCommand(), ['pack', '--ignore-scripts', '--json'], {
     cwd: path.join(process.cwd(), 'dist'),
     alwaysPipe: true,
   });
@@ -552,7 +553,7 @@ async function buildPackage() {
 
 async function installPackage() {
   if (state.fromNpm) {
-    await run('npm', ['install', '-D', state.fromNpm]);
+    await runNpm(['install', '-D', state.fromNpm]);
     return;
   }
 
@@ -563,7 +564,7 @@ async function installPackage() {
 
   const packFile = getPackFile();
   await fs.copyFile(packFile, `./${TAR_NAME}`);
-  return await run('npm', ['install', '-D', `./${TAR_NAME}`]);
+  return await runNpm(['install', '-D', `./${TAR_NAME}`]);
 }
 
 function getPackFile() {
@@ -576,6 +577,14 @@ interface RunOpts extends execa.Options {
   alwaysPipe?: boolean;
 }
 
+function getPinnedNpmCommand(): string {
+  return path.join(state.rootDir, 'node_modules/.bin/npm');
+}
+
+async function runNpm(args: string[], config?: RunOpts): Promise<execa.ExecaReturnValue> {
+  return await run(getPinnedNpmCommand(), args, config);
+}
+
 async function run(command: string, args: string[], config?: RunOpts): Promise<execa.ExecaReturnValue> {
   if (state.verbose && !config?.alwaysPipe) {
     config = { ...config, stdio: 'inherit' };