build: convert repo from npm to pnpm

- pnpm import package-lock.json -> pnpm-lock.yaml; remove package-lock.json
- add packageManager: pnpm@11.15.1 to package.json
- pnpm-workspace.yaml allowBuilds for tree-sitter, tree-sitter-cli, esbuild
  (pnpm blocks dependency install scripts by default)
- ci.yml + release.yml: pnpm/action-setup@v6, cache: pnpm,
  pnpm install --frozen-lockfile, pnpm run
- version script: npm install --package-lock-only -> pnpm install --lockfile-only
- README/tools contributor commands npm/npx -> pnpm
- ignore package-lock.json/yarn.lock

Author: DylanPiercey

.github/workflows/ci.yml

@@ -11,14 +11,16 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 22
-      - run: npm install
-      - run: npm run build
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
       # Fixtures are fetched from marko-js/htmljs-parser with degit; the
       # parser the tests compare against is the published htmljs-parser.
-      - run: npm test
+      - run: pnpm test
 
   prebuild:
     runs-on: ${{ matrix.os }}
@@ -38,17 +40,19 @@ jobs:
           ]
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 22
+          cache: pnpm
       # Skip the package's node-gyp-build install script — prebuildify does the
       # real build, so the install-time compile is redundant.
-      - run: npm install --ignore-scripts
-      - run: npm run prebuild
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - run: pnpm run prebuild
       # macOS runners are arm64; cross-build the Intel (x64) prebuild too so we
       # don't need an Intel runner (N-API addons cross-compile cleanly).
       - if: runner.os == 'macOS'
-        run: npm run prebuild -- --arch x64
+        run: pnpm run prebuild --arch x64
       - uses: actions/upload-artifact@v7
         with:
           name: prebuild-${{ matrix.os }}
@@ -58,13 +62,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 22
+          cache: pnpm
       # tree-sitter-cli downloads the wasi-sdk toolchain automatically.
-      - run: npm install
-      - run: npm run build:wasm
-      - run: npm run test:wasm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build:wasm
+      - run: pnpm run test:wasm
       - uses: actions/upload-artifact@v7
         with:
           name: tree-sitter-marko-wasm

.github/workflows/release.yml

@@ -4,10 +4,10 @@ name: Release
 #
 # Every push to main runs the `release` job (changesets/action):
 #   - if .changeset/*.md files are pending, it opens/updates a "[ci] release"
-#     PR that runs `npm run version` (bumps package.json + tree-sitter.json,
+#     PR that runs `pnpm run version` (bumps package.json + tree-sitter.json,
 #     writes CHANGELOG.md, consumes the changesets);
 #   - when that PR is merged (no changesets left), it runs the publish command
-#     `npm run release:tag`, which tags the release and sets the action's
+#     `pnpm run release:tag`, which tags the release and sets the action's
 #     `published` output to true.
 #
 # The prebuild/wasm/publish jobs are gated on `published`, so they only run on
@@ -38,15 +38,17 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 22
-      - run: npm install
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
       - id: changesets
         uses: changesets/action@v1
         with:
-          version: npm run version
-          publish: npm run release:tag
+          version: pnpm run version
+          publish: pnpm run release:tag
           commit: "[ci] release"
           title: "[ci] release"
         env:
@@ -72,17 +74,19 @@ jobs:
           ]
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 22
+          cache: pnpm
       # Skip the package's node-gyp-build install script — prebuildify does the
       # real build, so the install-time compile is redundant.
-      - run: npm install --ignore-scripts
-      - run: npm run prebuild
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - run: pnpm run prebuild
       # macOS runners are arm64; cross-build the Intel (x64) prebuild too so we
       # don't need an Intel runner (N-API addons cross-compile cleanly).
       - if: runner.os == 'macOS'
-        run: npm run prebuild -- --arch x64
+        run: pnpm run prebuild --arch x64
       - uses: actions/upload-artifact@v7
         with:
           name: prebuild-${{ matrix.os }}
@@ -95,13 +99,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 22
+          cache: pnpm
       # tree-sitter-cli downloads the wasi-sdk toolchain automatically.
-      - run: npm install
-      - run: npm run build:wasm
-      - run: npm run test:wasm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build:wasm
+      - run: pnpm run test:wasm
       - uses: actions/upload-artifact@v7
         with:
           name: wasm
@@ -113,16 +119,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 22
+          cache: pnpm
           registry-url: https://registry.npmjs.org
       # npm >= 11.5.1 is required for OIDC trusted publishing.
       - run: npm install -g npm@latest
-      - run: npm install
+      - run: pnpm install --frozen-lockfile
       # Refresh generated sources (src/parser.c etc.) so the published tree
       # matches grammar.js exactly.
-      - run: npm run generate
+      - run: pnpm run generate
       # Gather every platform's prebuild back into prebuilds/ and the wasm
       # build to the package root, matching package.json "files".
       - uses: actions/download-artifact@v8
@@ -141,6 +149,6 @@ jobs:
       # so this is a no-op unless the version actually changed. Authenticated via
       # npm trusted publishing (OIDC); provenance is enabled via the env var. No
       # token required.
-      - run: npm run release:publish
+      - run: pnpm run release:publish
         env:
           NPM_CONFIG_PROVENANCE: "true"

.gitignore

@@ -5,3 +5,5 @@ prebuilds
 *.dylib
 *.wasm
 .vscode
+package-lock.json
+yarn.lock

README.md

@@ -40,9 +40,9 @@ parser.setLanguage(Marko);
 Building from a checkout:
 
 ```sh
-npm install
-npm run build        # tree-sitter generate && node-gyp rebuild
-npm run build:wasm   # tree-sitter-marko.wasm (the CLI fetches wasi-sdk itself)
+pnpm install
+pnpm run build        # tree-sitter generate && node-gyp rebuild
+pnpm run build:wasm   # tree-sitter-marko.wasm (the CLI fetches wasi-sdk itself)
 ```
 
 For editors, the grammar ships ready-to-use queries: `queries/highlights.scm`
@@ -61,9 +61,9 @@ in the host tool like any other language.
 From this directory:
 
 ```sh
-npx tree-sitter playground            # interactive tree in the browser
-npx tree-sitter parse file.marko      # print the syntax tree
-npx tree-sitter highlight file.marko  # ANSI highlighting (--html for a page)
+pnpm exec tree-sitter playground            # interactive tree in the browser
+pnpm exec tree-sitter parse file.marko      # print the syntax tree
+pnpm exec tree-sitter highlight file.marko  # ANSI highlighting (--html for a page)
 ```
 
 `highlight` resolves the injected languages through the CLI config: run
@@ -82,7 +82,7 @@ and start treesitter for the filetype:
 ```sh
 # from this directory
 mkdir -p ~/.local/share/nvim/site/parser ~/.local/share/nvim/site/queries
-npx tree-sitter build -o ~/.local/share/nvim/site/parser/marko.so
+pnpm exec tree-sitter build -o ~/.local/share/nvim/site/parser/marko.so
 cp -R queries ~/.local/share/nvim/site/queries/marko
 ```
 
@@ -262,7 +262,7 @@ split without lookahead the scanner doesn't have.
 
 Marko's parser is [htmljs-parser](https://github.com/marko-js/htmljs-parser);
 this grammar's external scanner reimplements its state machine, and the test
-suite (`npm test`, Node 22) asserts the tree reproduces the parser's event
+suite (`pnpm test`, Node 22) asserts the tree reproduces the parser's event
 stream with byte-precise ranges across the parser's full fixture suite, plus
 thousands of templates from the Marko ecosystem during development.