ci: replace lerna + yarn + CircleCI with pnpm and npm trusted publishing

.devcontainer/Dockerfile

@@ -37,9 +37,13 @@ RUN apt-get update \
     && apt-get clean -y \
     && rm -rf /var/lib/apt/lists/*
 
-RUN curl -fsSL https://deb.nodesource.com/setup_16.x | bash -
+# node 22 to match CI: pnpm 11 requires >=22.13, and vitest 3 (via vite 7)
+# requires >=20.19, so the old node 16 here could run neither.
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
 RUN apt-get install -y nodejs
-RUN npm install --global yarn
+# Corepack reads the pinned pnpm version from the repo's package.json
+# "packageManager" field on first use, so there is nothing to pin here.
+RUN corepack enable pnpm
 
 # Switch back to dialog for any ad-hoc use of apt-get
 ENV DEBIAN_FRONTEND=dialog

.github/CODEOWNERS

@@ -12,5 +12,11 @@
 # No default (catch-all) owner: paths not listed here keep the normal review
 # flow.
 
-/.github/   @jbocce @sedghi @wayfarer3130
-/tools/ci/  @jbocce @sedghi @wayfarer3130
+/.github/            @jbocce @sedghi @wayfarer3130
+/tools/ci/           @jbocce @sedghi @wayfarer3130
+# Release-critical: the versioning script the release workflow runs, and the
+# root manifests that decide what CI installs and what npm publishes.
+/tools/release/      @jbocce @sedghi @wayfarer3130
+/package.json        @jbocce @sedghi @wayfarer3130
+/pnpm-workspace.yaml @jbocce @sedghi @wayfarer3130
+/pnpm-lock.yaml      @jbocce @sedghi @wayfarer3130

.github/workflows/bench.yml

@@ -97,17 +97,22 @@ jobs:
           # bench orchestration there.
           ci_touched=false
           # Toolchain paths force a full bench sweep — same list as
-          # detect-changes in pr-checks.yml.
+          # TOOLCHAIN_PATHS in pr-checks.yml's detect-changes job. The
+          # duplication is deliberate: this workflow is what the self-hosted
+          # nashua runner has to trust, so it stays short and rarely changes
+          # rather than being folded back into pr-checks.yml. It does mean both
+          # lists must be edited together — a path here but not there skips the
+          # full pipeline, and there but not here skips the bench sweep.
           toolchain_touched=false
           changed=()
           while IFS= read -r f; do
             [ -n "$f" ] || continue
             case "$f" in
-              .github/*|tools/ci/*|package.json|yarn.lock|vitest.workspace.mjs|babel.config.json|lerna.json)
+              .github/*|tools/ci/*|tools/csp/*|package.json|pnpm-lock.yaml|pnpm-workspace.yaml|vitest.workspace.mjs|babel.config.json)
                 ci_touched=true ;;
             esac
             case "$f" in
-              .github/workflows/*|package.json|yarn.lock|vitest.workspace.mjs|babel.config.json|lerna.json|tools/ci/*|tools/dist-size/*|tools/browser-smoke/*|tools/fixture-verification/*)
+              .github/workflows/*|package.json|pnpm-lock.yaml|pnpm-workspace.yaml|vitest.workspace.mjs|babel.config.json|tools/ci/*|tools/csp/*|tools/dist-size/*|tools/browser-smoke/*|tools/fixture-verification/*|tools/release/*)
                 toolchain_touched=true ;;
               packages/*)
                 pkg=${f#packages/}; pkg=${pkg%%/*}
@@ -211,7 +216,7 @@ jobs:
     # it wraps the bench command in the "Run CodSpeed benchmarks" step below.
     # See docs/ci/self-hosted-runner.md for what the box must provide: CodSpeed's
     # own patched valgrind (NOT the distro valgrind package), libc6-dbg, flock and
-    # a fixed CPU model — node and yarn are provisioned per-job below. That doc
+    # a fixed CPU model — node and pnpm are provisioned per-job below. That doc
     # also covers how the shared mutex works and the cutover steps.
     # IMPORTANT: moving the bench between workflow files (or runners) is a
     # baseline re-seed event: one main run must complete here before PR
@@ -246,20 +251,22 @@ jobs:
           # 22.23.1 is what the current main baseline was measured on; changing
           # it is a deliberate re-seed event (see docs/ci/self-hosted-runner.md).
           node-version: '22.23.1'
-      # nashua has no yarn: setup-node ships node + npm only, GitHub's hosted
-      # images preinstall yarn 1, and the other two repos on this box use pnpm.
-      # Corepack is bundled with node 22 and fetches over Node's own https, so it
-      # works where `npm i -g yarn` is unreliable here — the runner's bundled node
-      # has a corrupted npm ("Cannot find module '../lib/cli.js'"), which is why
-      # OHIF's workflow also went the Corepack route on this box. Pinned to the
-      # same yarn the build job uses rather than Corepack's bundled default, and
-      # activated AFTER setup-node so the shim lands in that node's bin dir.
+      # nashua has no package manager beyond npm: setup-node ships node + npm
+      # only, and GitHub's hosted images are not what runs here. Corepack is
+      # bundled with node 22 and fetches over Node's own https, so it works
+      # where `npm i -g <pm>` is unreliable on this box — the runner's bundled
+      # node has a corrupted npm ("Cannot find module '../lib/cli.js'"), which
+      # is why OHIF's workflow also went the Corepack route here. `corepack
+      # prepare --activate` with no argument installs exactly the version in
+      # the root package.json "packageManager" field, so the bench box can
+      # never drift from the build jobs. Activated AFTER setup-node so the shim
+      # lands in that node's bin dir.
       # NOTE: node 25 unbundles corepack — revisit this step before any such bump.
-      - name: Provide yarn 1 via Corepack
+      - name: Provide pnpm via Corepack
         run: |
-          corepack enable yarn
-          corepack prepare yarn@1.22.22 --activate
-          yarn --version
+          corepack enable pnpm
+          corepack prepare --activate
+          pnpm --version
       - name: Download all built dists
         uses: actions/download-artifact@v4
         with:
@@ -286,10 +293,14 @@ jobs:
           path: |
             node_modules
             packages/*/node_modules
-          key: modules-node22-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock') }}
+          # pnpm-workspace.yaml is in the key because the lockfile does not
+          # record nodeLinker/allowBuilds/linkWorkspacePackages — without it a
+          # layout change hits the cache and the install step is skipped.
+          # Keep in step with the cache keys in pr-checks.yml.
+          key: pnpm-modules-node22-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml') }}
       - name: Install dependencies
         if: steps.modules-cache.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - name: Log CPU info
         # GitHub standard runners are randomly assigned different physical
         # CPUs (e.g. Intel Xeon 8370C vs AMD EPYC 7763) with different cache
@@ -301,7 +312,7 @@ jobs:
         # https://codspeed.io/blog/unrelated-benchmark-regression).
         run: lscpu | grep -E "Model name|Cache|Flags" | head -5 || true
       - name: Compute bench scope
-        # Translate the changed-package directory names into lerna --scope
+        # Translate the changed-package directory names into pnpm --filter
         # flags so PRs only bench what they touched. Baseline runs (main /
         # workflow_dispatch) get the full list from the gate, which makes
         # this a no-op filter there.
@@ -326,7 +337,7 @@ jobs:
               }
               process.stdout.write(name);
             ' "$pkg")
-            flags="$flags --scope $name"
+            flags="$flags --filter $name"
           done
           echo "Bench scope flags:$flags"
           echo "flags=$flags" >> "$GITHUB_OUTPUT"
@@ -373,14 +384,15 @@ jobs:
         # benches complete. The vitest configs set
         # dangerouslyIgnoreUnhandledErrors when CODSPEED_RUNNER_MODE is
         # "simulation" to keep that exit-code noise from failing the job
-        # (config-level because yarn 1 mangles `--`-forwarded CLI flags).
+        # (config-level rather than a `--`-forwarded CLI flag, which package
+        # managers have historically mangled).
         uses: CodSpeedHQ/action@4e969336ab9acd4f6f8d025fdd793292b0835df0 # v4.18.2
         env:
           # Keep this in env, NOT `${{ }}` in the run: below — an env value is
           # expanded by the shell after the command line is parsed, so it stays
           # data. Unquoted below on purpose: the flags must word-split into
-          # repeated `--scope <name>` pairs.
+          # repeated `--filter <name>` pairs.
           SCOPE_FLAGS: ${{ steps.scope.outputs.flags }}
         with:
           mode: simulation
-          run: bash tools/ci/with-nashua-lock.sh yarn lerna run bench --parallel --stream $SCOPE_FLAGS
+          run: bash tools/ci/with-nashua-lock.sh pnpm --parallel $SCOPE_FLAGS run bench