Project: docto-crypt · Branch: COREFRONT-1129_pnpm-phase1-migration · Mode:  · Model: claude-haiku-4-5-20251001

Stats: 1 user messages, 9 tool calls, tools used: Read, Glob, Bash.

Conversation

Turn 1 — User

Explore how doctolib/actions/setup-node installs Node.js:

1. What does it use for Node.js installation? (actions/setup-node or custom logic?)
2. What Node.js-specific configurations does it apply?
3. What Doctolib-specific infrastructure does it set up (S3, CodeArtifact, etc.)?
4. Could those Doctolib-specific parts benefit pnpm workflows even without npm?

Also check:
- Does setup-node do anything besides Node.js + npm setup that would benefit all Node-based workflows?
- Are there any environment variables, registry configs, or authentication setups that pnpm would need?

This will help determine if extending setup-pnpm to include Node.js installation (but skip npm) is viable and beneficial.

File to focus on: /Users/USER/workspace/doctolib/actions/setup-node/action.yml

Turn 1 — Assistant

I'll help you explore how doctolib/actions/setup-node installs Node.js and its configurations. Let me start by examining the action file and related code.

Tools used:

- Read: /Users/USER/workspace/doctolib/actions/setup-node/action.yml

Tools used:

- Glob: /Users/USER/workspace/doctolib/actions/setup-node//

Tools used:

- Glob: /Users/USER/workspace/doctolib/actions/setup-pnpm//

Tool results:

  → result (ok): 1→name: "Setup Node.JS"
     2→description: "Setup Node.JS environment and install dependencies, with cache (stored in S3)"
     3→author: "Doctolib"
     4→branding:
     5→  icon: "package"
     6→  color: "blue"
     7→inputs:
     8→  node-version:
     9→    description: "Version Spec of the version to use. Examples: 12.x, 10.15.1, >=10.15.0."
    10→  node-version-file:
    11→    description: "File containing the version Spec of the version to use.  Examples: package.json, .nvmrc, .node-v
…(truncated, 10581 more chars)

Tool results:

  → result (ok): /Users/USER/workspace/doctolib/actions/setup-node/catalog-info.yaml
/Users/USER/workspace/doctolib/actions/setup-node/fixtures/.nvmrc
/Users/USER/workspace/doctolib/actions/setup-node/fixtures/package-lock.json
/Users/USER/workspace/doctolib/actions/setup-node/fixtures/package.json
/Users/USER/workspace/doctolib/actions/setup-node/fixtures/packages/package-one/package.json
/Users/USER/workspace/doctolib/actions/setup-node/fixtures/packages/package-two/package.json
/Users/USER/workspace/doctolib/
…(truncated, 152 more chars)

Tool results:

  → result (ok): /Users/USER/workspace/doctolib/actions/setup-pnpm/CHANGELOG.md
/Users/USER/workspace/doctolib/actions/setup-pnpm/action.yml
/Users/USER/workspace/doctolib/actions/setup-pnpm/README.md

Now let me read the setup-pnpm action to compare and the README files for more context:

Tools used:

- Read: /Users/USER/workspace/doctolib/actions/setup-pnpm/action.yml

Tools used:

- Read: /Users/USER/workspace/doctolib/actions/setup-node/README.md

Tools used:

- Read: /Users/USER/workspace/doctolib/actions/setup-pnpm/README.md

Tool results:

  → result (ok): 1→# yaml-language-server: $schema=https://json.schemastore.org/github-action.json
     2→name: "Setup pnpm"
     3→description: "Setup pnpm with caching support for Doctolib projects"
     4→author: "Doctolib"
     5→branding:
     6→  icon: "package"
     7→  color: "blue"
     8→inputs:
     9→  pnpm-version:
    10→    description: "pnpm version to install"
    11→    required: false
    12→    default: "9"
    13→  run-install:
    14→    description: "Whether to run pnpm install"
    15→   
…(truncated, 2309 more chars)

Tool results:

  → result (ok): 1→# doctolib/actions/setup-node
     2→
     3→## Description
     4→
     5→
     6→
     7→Setup Node.JS environment and install dependencies, with cache (stored in S3)
     8→
     9→
    10→
    11→## Breaking Changes in v1.0.0
    12→
    13→If specified, all path-based inputs (node-version-file, lock-file, node-modules-paths, ...) must now be relative to working-directory.
…(truncated, 8339 more chars)

Tool results:

  → result (ok): 1→# Setup pnpm
     2→
     3→Composite action to setup pnpm with caching support for Doctolib projects.
     4→
     5→## Features
     6→
     7→- Installs pnpm using the official pnpm/action-setup action
     8→- Caches pnpm store for improved performance
     9→- Configurable pnpm version
    10→- Optional automatic dependency installation
    11→- Compatible with projects that have no dependencies
    12→
    13→## Usage
    14→
    15→### Basic Usage
    16→
    17→yaml
    18→- name:
…(truncated, 3001 more chars)

Let me also check if there's documentation about the codeartifact-login action and check what else is in the actions directory:

Tools used:

- Bash: find /Users/USER/workspace/doctolib/actions -maxdepth 2 -name "action.yml" -type f | head -20

Tools used:

- Glob: /Users/USER/workspace/doctolib/actions/codeartifact-login/action.yml

Tool results:

  → result (ok): /Users/USER/workspace/doctolib/actions/setup-yak/action.yml
/Users/USER/workspace/doctolib/actions/create-tag/action.yml
/Users/USER/workspace/doctolib/actions/cancel-test-suites/action.yml
/Users/USER/workspace/doctolib/actions/generate-trunkver/action.yml
/Users/USER/workspace/doctolib/actions/terraform-lint/action.yml
/Users/USER/workspace/doctolib/actions/load-secrets/action.yml
/Users/USER/workspace/doctolib/actions/slack-message-with-level/action.yml
/Users/USER/workspace/doctolib/actions/
…(truncated, 851 more chars)

Tool results:

  → result (ok): /Users/USER/workspace/doctolib/actions/codeartifact-login/action.yml

Now let me read the codeartifact-login action:

Tools used:

- Read: /Users/USER/workspace/doctolib/actions/codeartifact-login/action.yml

Tool results:

  → result (ok): 1→name: "CodeArtifact login"
     2→description: "CodeArtifact login"
     3→author: "Doctolib"
     4→branding:
     5→  icon: "package"
     6→  color: "blue"
     7→inputs:
     8→  iam_role:
     9→    description: "The AWS IAM role to assume"
    10→    default: "arn:aws:iam::580698825394:role/gha_${{ github.event.repository.name }}_br_all"
    11→  duration_seconds:
    12→    description: "The duration in seconds for which the credentials will be valid"
    13→    default: "3600"
    14→ 
…(truncated, 3303 more chars)

Perfect! Now I have a comprehensive view. Let me create a detailed analysis report.

Analysis Report: doctolib/actions/setup-node Installation and Configuration

1. Node.js Installation Method

Uses: actions/setup-node (GitHub's official action, v4)
- Step at line 110-117 of action.yml
- Implementation: uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- Accepts: node-version, node-version-file, architecture, check-latest inputs
- No custom Node.js installation logic—delegates to the official GitHub action

---

2. Node.js-Specific Configurations Applied

A. Node Version Management
- Reads version from .nvmrc (default) or custom version file
- Supports version specs: 12.x, 10.15.1, >=10.15.0, etc.
- Can be overridden via node-version input

B. npm Version Management (Lines 119-132)
- Installs specific npm version if provided via npm-version input
- Falls back to version in package.json's .engines.npm field
- Converts open-majors (e.g., >=X.X.X) to latest (see COREFRONT-728 issue comment)
- Defaults to npm version shipped with Node.js if none specified
- Command: npm install -g npm@<version>

C. Architecture Support
- Includes runner.arch in cache keys (line 95) to prevent ARM64/AMD64 conflicts
- Native binaries (esbuild, swc, etc.) in node_modules are architecture-specific

---

3. Doctolib-Specific Infrastructure Setup

A. CodeArtifact Authentication (Lines 99-108)
Purpose: Access private Doctolib npm packages

Steps:
1. CodeArtifact Login (Line 99-100)
   - Calls doctolib/actions/codeartifact-login action
   - Uses AWS IAM role for authentication
   - Generates temporary CodeArtifact token (expires in 3600 seconds by default)
   - Sets environment variable: CODEARTIFACT_AUTH_TOKEN

2. Setup .npmrc (Lines 102-108)
   - Configures npm registry for @doctolib scoped packages
   - Registry URL: https://doctolib-580698825394.d.codeartifact.eu-west-1.amazonaws.com/npm/meta/
   - Injects CodeArtifact auth token into .npmrc

Key Details:
- AWS Account ID: 580698825394
- Region: eu-west-1
- Scope: @doctolib packages only
- Auth method: Token-based (generated from AWS credentials)

B. S3-Based Caching (Lines 134-202)
Uses: Custom doctolib/actions/cache/* actions, NOT GitHub's native caching

Cache Strategy:
1. node_modules cache (Lines 140-147, 197-202)
   - Key: node-modules-${{ runner.arch }}-${{ node-version }}-${{ lockfile-hash }}
   - Paths: Auto-detected or manually specified
   - Saves build time by avoiding re-installation

2. npm cache (Lines 149-158, 189-194)
   - Key: setup-node-npm-${{ runner.arch }}-${{ node-version }}-${{ lockfile-hash }}
   - Restore keys support partial matches for flexibility
   - Fallback chain: primary key → partial match → fresh cache

Cache Behavior:
- Restored from custom S3 backend via doctolib/actions/cache/restore and doctolib/actions/cache/save
- Architecture-aware to prevent cross-platform incompatibilities
- Conditional logic to skip saving if cache already hit (optimization)

C. Lock File Validation (Lines 173-186)
Optional lock file drift detection:
- Runs npm i with --no-audit, --no-fund, --ignore-scripts flags
- Compares git diff to detect if lock file changed
- Fails CI if lock file is stale (via enable-lock-check input)
- Helps prevent silent dependency mismatches

---

4. What Benefits pnpm Workflows?

Could Be Reused:
1. CodeArtifact Authentication
   - pnpm can use .npmrc configuration (same as npm)
   - The CodeArtifact token setup is package-manager agnostic
   - pnpm respects .npmrc registry settings for scoped packages

2. S3-Based Caching Infrastructure
   - Doctolib's cache actions likely support caching any path
   - Could cache pnpm store directory instead of node_modules
   - Current setup-pnpm uses GitHub's actions/cache instead

3. Lock File Validation Logic
   - pnpm equivalent: pnpm-lock.yaml drift detection
   - Same principle applies: run install with strict flags, check git diff
   - Could be adapted for pnpm

4. Architecture-Aware Cache Keys
   - Already implemented in setup-node
   - setup-pnpm also uses runner.arch (line 52)

NOT Reusable:
1. npm-Specific Version Management (lines 119-132)
   - pnpm version is specified separately (not tied to Node.js version)
   - Different .engines handling

2. npm Postinstall Command (line 171)
   - Only relevant for npm projects

---

5. Environment Variables & Configuration for pnpm

| Variable/Config | setup-node | pnpm Needs? | Notes |
|---|---|---|---|
| CODEARTIFACT_AUTH_TOKEN | Sets (line 55) | ✅ YES | pnpm reads .npmrc for auth |
| .npmrc registry config | Sets (lines 105-108) | ✅ YES | Scoped package registry |
| Node.js version | Installs (line 110) | ✅ YES | pnpm requires Node.js runtime |
| npm version | Installs (line 124-130) | ❌ NO | pnpm doesn't need npm |
| node_modules cache | Manages | ⚠️ OPTIONAL | pnpm uses store cache, not node_modules |
| Architecture in cache key | Included (line 95) | ✅ YES | Native binaries architecture-sensitive |

---

6. What setup-node Does Beyond npm

1. Node.js Installation ✅ Needed by all Node-based workflows
2. CodeArtifact Registry Setup ✅ Needed by Doctolib projects (regardless of package manager)
3. S3 Caching Infrastructure ✅ Beneficial for any Node-based build (not npm-specific)
4. Lock File Validation ✅ Applicable to pnpm (different file, same concept)
5. Architecture-Aware Cache Keys ✅ Critical for both npm and pnpm

---

7. Viability of Extending setup-pnpm to Include Node.js

Recommendation: YES, with caveats

Benefits:
- Single action for Node.js + pnpm setup with Doctolib infrastructure
- Consistent CodeArtifact authentication across package managers
- Unified caching strategy (though pnpm uses different cache paths)
- Centralized lock file validation

Implementation Considerations:
- Add pnpm-version input to setup-node OR
- Create setup-node-and-pnpm composite action that:
  1. Calls actions/setup-node (skip npm version management)
  2. Installs pnpm via pnpm/action-setup
  3. Shares CodeArtifact login + .npmrc setup
  4. Uses appropriate cache paths for pnpm store

What to Skip for pnpm:
- postinstall-command (npm-specific)
- install-command (could adapt, but pnpm defaults to pnpm install)
- npm-version management

Shared Across Both:
- codeartifact-login
- .npmrc scoped package registry configuration
- S3 caching (with different paths)
- Working directory support
- Lock file validation (adapt to pnpm-lock.yaml)

---

Key Files Referenced

- Primary: /Users/USER/workspace/doctolib/actions/setup-node/action.yml (203 lines)
- Comparison: /Users/USER/workspace/doctolib/actions/setup-pnpm/action.yml (62 lines)
- Dependencies: /Users/USER/workspace/doctolib/actions/codeartifact-login/action.yml` (72 lines)