fix: support package manager retries in VS Code promotion - W-23832274

.github/actions/ctcOpen/action.yml

@@ -21,6 +21,18 @@ inputs:
     description: version of node to use.  It's better to specify latest, lts/* or lts/-1 than to hardcode numbers
     required: false
     default: lts/*
+  package-manager:
+    description: Package manager used by the calling repository (npm, pnpm, or yarn)
+    required: false
+    default: npm
+  package-manager-version:
+    description: pnpm version to use when package-manager is pnpm
+    required: false
+    default: '10'
+  cache-dependency-path:
+    description: Path to the calling repository's package manager lockfile
+    required: false
+    default: package-lock.json
 
 outputs:
   changeCaseId:
@@ -32,10 +44,17 @@ runs:
   steps:
     - uses: actions/checkout@v4
 
+    - name: Setup pnpm
+      if: inputs.package-manager == 'pnpm'
+      uses: pnpm/action-setup@v4
+      with:
+        version: ${{ inputs.package-manager-version }}
+
     - uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.nodeVersion }}
-        cache: npm
+        cache: ${{ inputs.package-manager }}
+        cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
     - run: npm install -g @salesforce/change-case-management --omit=dev
       shell: bash

.github/actions/npmInstallWithRetries/action.yml

@@ -1,5 +1,5 @@
 name: npm-install-with-retries
-description: 'wraps npm install with retries/timeout to handle network failures'
+description: 'Wraps npm ci with retries and timeouts. New workflows should use setupNodeAndInstall for package-manager-agnostic installation.'
 inputs:
   ignore-scripts:
     default: 'false'

.github/actions/setupNodeAndInstall/action.yml

@@ -63,11 +63,11 @@ runs:
 
     - name: Install npm dependencies
       if: inputs.package-manager == 'npm' && steps.install-command.outputs.value == 'npm ci'
-      uses: salesforcecli/github-workflows/.github/actions/npmInstallWithRetries@main
+      uses: salesforcecli/github-workflows/.github/actions/npmInstallWithRetries@ph/W-23832274-pnpm-stable-promotion
 
     - name: Install Yarn dependencies
       if: inputs.package-manager == 'yarn' && steps.install-command.outputs.value == 'yarn install --network-timeout 600000'
-      uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@main
+      uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@ph/W-23832274-pnpm-stable-promotion
 
     - name: Install custom or pnpm dependencies
       if: (inputs.package-manager != 'npm' || steps.install-command.outputs.value != 'npm ci') && (inputs.package-manager != 'yarn' || steps.install-command.outputs.value != 'yarn install --network-timeout 600000')

.github/actions/updateNodeLockfile/action.yml

@@ -0,0 +1,60 @@
+name: Update Node lockfile
+description: Refreshes an npm, pnpm, or Yarn lockfile with retries and without lifecycle scripts.
+inputs:
+  package-manager:
+    description: 'Package manager to use: npm, pnpm, or yarn.'
+    required: true
+  package-manager-version:
+    description: 'pnpm version to install when package-manager is pnpm.'
+    required: false
+    default: '10'
+  lockfile-path:
+    description: 'Path to the lockfile to refresh.'
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Validate package manager and lockfile
+      shell: bash
+      env:
+        PACKAGE_MANAGER: ${{ inputs.package-manager }}
+        LOCKFILE_PATH: ${{ inputs.lockfile-path }}
+      run: |
+        case "$PACKAGE_MANAGER" in
+          npm|pnpm|yarn) ;;
+          *) echo "Unsupported package manager: $PACKAGE_MANAGER"; exit 1 ;;
+        esac
+        [ -f "$LOCKFILE_PATH" ] || { echo "Lockfile not found: $LOCKFILE_PATH"; exit 1; }
+
+    - name: Setup pnpm
+      if: inputs.package-manager == 'pnpm'
+      uses: pnpm/action-setup@v4
+      with:
+        version: ${{ inputs.package-manager-version }}
+
+    - name: Resolve lockfile update command
+      id: command
+      shell: bash
+      env:
+        PACKAGE_MANAGER: ${{ inputs.package-manager }}
+        LOCKFILE_PATH: ${{ inputs.lockfile-path }}
+      run: |
+        LOCKFILE_DIR=$(dirname "$LOCKFILE_PATH")
+        case "$PACKAGE_MANAGER" in
+          npm) COMMAND="cd '$LOCKFILE_DIR' && npm install --package-lock-only --ignore-scripts" ;;
+          pnpm) COMMAND="cd '$LOCKFILE_DIR' && pnpm install --lockfile-only --ignore-scripts" ;;
+          yarn)
+            YARN_MAJOR=$(yarn --version | cut -d. -f1)
+            if [ "$YARN_MAJOR" -ge 2 ]; then
+              COMMAND="cd '$LOCKFILE_DIR' && YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn install --mode=skip-build"
+            else
+              COMMAND="cd '$LOCKFILE_DIR' && yarn install --ignore-scripts"
+            fi
+            ;;
+        esac
+        echo "value=$COMMAND" >> "$GITHUB_OUTPUT"
+
+    - name: Refresh lockfile with retries
+      uses: salesforcecli/github-workflows/.github/actions/retry@main
+      with:
+        command: ${{ steps.command.outputs.value }}

.github/workflows/automerge.yml

@@ -20,6 +20,21 @@ on:
         description: Optionally skip ci builds on merges into main
         type: boolean
         default: false
+      package-manager:
+        required: false
+        description: Package manager used by the calling repository (npm, pnpm, or yarn)
+        type: string
+        default: npm
+      package-manager-version:
+        required: false
+        description: pnpm version to use when package-manager is pnpm
+        type: string
+        default: '10'
+      cache-dependency-path:
+        required: false
+        description: Path to the calling repository's package manager lockfile
+        type: string
+        default: package-lock.json
 
 jobs:
   dependabot-automerge:
@@ -29,10 +44,17 @@ jobs:
         with:
           token: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
 
+      - name: Setup pnpm
+        if: inputs.package-manager == 'pnpm'
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ inputs.package-manager-version }}
+
       - uses: actions/setup-node@v4
         with:
           node-version: lts/*
-          cache: npm
+          cache: ${{ inputs.package-manager }}
+          cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
       - run: npm install -g @salesforce/plugin-release-management --omit=dev
 

.github/workflows/ctcClose.yml

@@ -15,18 +15,39 @@ on:
         type: string
         default: lts/*
         required: false
+      package-manager:
+        description: Package manager used by the calling repository (npm, pnpm, or yarn)
+        type: string
+        default: npm
+        required: false
+      package-manager-version:
+        description: pnpm version to use when package-manager is pnpm
+        type: string
+        default: '10'
+        required: false
+      cache-dependency-path:
+        description: Path to the calling repository's package manager lockfile
+        type: string
+        default: package-lock.json
+        required: false
 
 jobs:
   ctcClose:
     runs-on: static-ip-ubuntu-24-runners
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        if: inputs.package-manager == 'pnpm'
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ inputs.package-manager-version }}
+
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.nodeVersion }}
-          # No `cache: npm`: it requires an npm lockfile and so hard-fails on
-          # pnpm/yarn consumer repos; the CTC CLI below is a one-off global install.
+          cache: ${{ inputs.package-manager }}
+          cache-dependency-path: ${{ inputs.cache-dependency-path }}
       - run: npm install -g @salesforce/change-case-management --omit=dev
       - id: ctc
         run: |

.github/workflows/ctcOpen.yml

@@ -9,6 +9,21 @@ on:
         type: string
         default: lts/*
         required: false
+      package-manager:
+        description: Package manager used by the calling repository (npm, pnpm, or yarn)
+        type: string
+        default: npm
+        required: false
+      package-manager-version:
+        description: pnpm version to use when package-manager is pnpm
+        type: string
+        default: '10'
+        required: false
+      cache-dependency-path:
+        description: Path to the calling repository's package manager lockfile
+        type: string
+        default: package-lock.json
+        required: false
     outputs:
       changeCaseId:
         description: Id for the change case created
@@ -22,11 +37,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        if: inputs.package-manager == 'pnpm'
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ inputs.package-manager-version }}
+
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.nodeVersion }}
-          # No `cache: npm`: it requires an npm lockfile and so hard-fails on
-          # pnpm/yarn consumer repos; the CTC CLI below is a one-off global install.
+          cache: ${{ inputs.package-manager }}
+          cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
       - run: npm install -g @salesforce/change-case-management --omit=dev
 

.github/workflows/npmPublish.yml

@@ -52,10 +52,20 @@ on:
         required: true
         type: string
       packageManager:
-        description: the package manager to use.  Defaults to yarn, but can be set to npm
+        description: the package manager to use. Defaults to yarn; supports npm, pnpm, or yarn
         required: false
         default: yarn
         type: string
+      packageManagerVersion:
+        description: pnpm version to use when packageManager is pnpm
+        required: false
+        default: '10'
+        type: string
+      cacheDependencyPath:
+        description: path to the package manager lockfile; defaults to yarn.lock, so npm and pnpm callers must override it
+        required: false
+        default: yarn.lock
+        type: string
       vulnerabilityCheck:
         description: if true, checks for known vulnerable package versions
         required: false
@@ -81,8 +91,8 @@ jobs:
           ref: ${{ inputs.githubTag }}
       - name: Validate package manager
         run: |
-          if [[ "$INPUTS_PACKAGE_MANAGER" != "yarn" && "$INPUTS_PACKAGE_MANAGER" != "npm" ]]; then
-            echo "Error: packageManager must be 'yarn' or 'npm', got '$INPUTS_PACKAGE_MANAGER'"
+          if [[ "$INPUTS_PACKAGE_MANAGER" != "yarn" && "$INPUTS_PACKAGE_MANAGER" != "npm" && "$INPUTS_PACKAGE_MANAGER" != "pnpm" ]]; then
+            echo "Error: packageManager must be 'npm', 'pnpm', or 'yarn', got '$INPUTS_PACKAGE_MANAGER'"
             exit 1
           fi
       - uses: actions/setup-node@v4
@@ -118,10 +128,13 @@ jobs:
     needs: [check-publish]
     # CTC will only open when publishing to 'latest'
     if: inputs.ctc && needs.check-publish.outputs.published == 'false' && inputs.tag == 'latest'
-    uses: salesforcecli/github-workflows/.github/workflows/ctcOpen.yml@main
+    uses: salesforcecli/github-workflows/.github/workflows/ctcOpen.yml@ph/W-23832274-pnpm-stable-promotion
     with:
       githubTag: ${{ inputs.githubTag }}
       nodeVersion: ${{ inputs.nodeVersion }}
+      package-manager: ${{ inputs.packageManager }}
+      package-manager-version: ${{ inputs.packageManagerVersion }}
+      cache-dependency-path: ${{ inputs.cacheDependencyPath }}
     secrets: inherit
 
   npm-publish:
@@ -136,16 +149,27 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.githubTag }}
+      - name: Setup pnpm
+        if: inputs.packageManager == 'pnpm'
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ inputs.packageManagerVersion }}
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.nodeVersion }}
           cache: ${{ inputs.packageManager }}
+          cache-dependency-path: ${{ inputs.cacheDependencyPath }}
       - name: Install dependencies with yarn
         if: inputs.packageManager == 'yarn'
-        uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@main
+        uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@ph/W-23832274-pnpm-stable-promotion
       - name: Install dependencies with npm
         if: inputs.packageManager == 'npm'
-        uses: salesforcecli/github-workflows/.github/actions/npmInstallWithRetries@main
+        uses: salesforcecli/github-workflows/.github/actions/npmInstallWithRetries@ph/W-23832274-pnpm-stable-promotion
+      - name: Install dependencies with pnpm
+        if: inputs.packageManager == 'pnpm'
+        uses: salesforcecli/github-workflows/.github/actions/retry@main
+        with:
+          command: pnpm install --frozen-lockfile
       - name: Vulnerability check
         if: inputs.vulnerabilityCheck
         # Check for known vulnerable packages from the following supply chain attacks:
@@ -200,18 +224,24 @@ jobs:
   ctcCloseSuccess:
     needs: [ctc-open, npm-publish]
     if: needs.ctc-open.result == 'success' && needs.npm-publish.result == 'success' && needs.ctc-open.outputs.changeCaseId
-    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
+    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@ph/W-23832274-pnpm-stable-promotion
     secrets: inherit
     with:
       changeCaseId: ${{needs.ctc-open.outputs.changeCaseId}}
       nodeVersion: ${{ inputs.nodeVersion }}
+      package-manager: ${{ inputs.packageManager }}
+      package-manager-version: ${{ inputs.packageManagerVersion }}
+      cache-dependency-path: ${{ inputs.cacheDependencyPath }}
 
   ctcCloseFail:
     needs: [ctc-open, npm-publish]
     if: always() && inputs.ctc && needs.ctc-open.outputs.changeCaseId && (needs.ctc-open.result != 'success' || needs.npm-publish.result != 'success')
-    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
+    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@ph/W-23832274-pnpm-stable-promotion
     secrets: inherit
     with:
       changeCaseId: ${{ needs.ctc-open.outputs.changeCaseId }}
       nodeVersion: ${{ inputs.nodeVersion }}
       status: Not Implemented
+      package-manager: ${{ inputs.packageManager }}
+      package-manager-version: ${{ inputs.packageManagerVersion }}
+      cache-dependency-path: ${{ inputs.cacheDependencyPath }}