chore(ci): standardize pnpm-only workflows and guard installs

.github/workflows/audit.yml

@@ -0,0 +1,40 @@
+name: Dependency Audit
+
+on:
+    pull_request:
+    workflow_dispatch:
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    audit:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 20
+
+            - name: Install pnpm
+              uses: pnpm/action-setup@v5
+
+            - name: Install Foundry
+              uses: foundry-rs/foundry-toolchain@v1
+
+            - name: Install dependencies
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
+
+            - name: Audit pnpm dependencies (fail on moderate+)
+              uses: JamesRobertWiseman/pnpm-audit@v3
+              with:
+                  package_json_path: ./
+                  github_token: ${{ secrets.GITHUB_TOKEN }}
+                  level: moderate
+                  fails: true
+                  single_comment: true

.github/workflows/coverage.yml

@@ -6,7 +6,7 @@ on:
     pull_request:
 
 jobs:
-    run-ci:
+    coverage:
         runs-on: ubuntu-latest
 
         steps:
@@ -18,15 +18,14 @@ jobs:
               with:
                   node-version: 20
 
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
+            - uses: pnpm/action-setup@v5
 
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             - name: Build
               run: pnpm run build

.github/workflows/lint.yml

@@ -6,7 +6,7 @@ on:
     pull_request:
 
 jobs:
-    run-ci:
+    lint:
         runs-on: ubuntu-latest
 
         steps:
@@ -18,15 +18,14 @@ jobs:
               with:
                   node-version: 20
 
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
+            - uses: pnpm/action-setup@v5
 
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install Node dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             - name: Run lint check
               run: pnpm run lint:check

.github/workflows/size.yml

@@ -6,7 +6,7 @@ on:
     pull_request:
 
 jobs:
-    run-ci:
+    size-check:
         runs-on: ubuntu-latest
 
         steps:
@@ -18,15 +18,14 @@ jobs:
               with:
                   node-version: 20
 
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
+            - uses: pnpm/action-setup@v5
 
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             # Build will fail if a contract is over the size limit
             - name: Contract Size

.github/workflows/tests-crosschain.yml

@@ -6,7 +6,7 @@ on:
     pull_request:
 
 jobs:
-    run-ci:
+    crosschain-tests:
         runs-on: ubuntu-latest
 
         steps:
@@ -18,15 +18,14 @@ jobs:
               with:
                   node-version: 20
 
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
+            - uses: pnpm/action-setup@v5
 
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             - name: Build
               run: pnpm run build

.github/workflows/tests-fork.yml

@@ -6,7 +6,7 @@ on:
     pull_request:
 
 jobs:
-    run-ci:
+    fork-tests:
         runs-on: ubuntu-latest
 
         steps:
@@ -18,15 +18,14 @@ jobs:
               with:
                   node-version: 20
 
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
+            - uses: pnpm/action-setup@v5
 
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             - name: Build
               run: pnpm run build

.github/workflows/tests-proposals.yml

@@ -6,7 +6,7 @@ on:
     pull_request:
 
 jobs:
-    run-ci:
+    proposal-tests:
         runs-on: ubuntu-latest
 
         steps:
@@ -18,15 +18,14 @@ jobs:
               with:
                   node-version: 20
 
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
+            - uses: pnpm/action-setup@v5
 
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             - name: Build
               run: pnpm run build

.github/workflows/tests-unit.yml

@@ -6,7 +6,7 @@ on:
     pull_request:
 
 jobs:
-    run-ci:
+    unit-tests:
         runs-on: ubuntu-latest
 
         steps:
@@ -18,15 +18,14 @@ jobs:
               with:
                   node-version: 20
 
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
+            - uses: pnpm/action-setup@v5
 
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             - name: Build
               run: pnpm run build

.github/workflows/validate-emergency-config.yml

@@ -35,15 +35,13 @@ jobs:
                   node-version: 20
 
             - name: Install pnpm
-              uses: pnpm/action-setup@v4
-              with:
-                  version: 9
-
+              uses: pnpm/action-setup@v5
             - name: Install Foundry
               uses: foundry-rs/foundry-toolchain@v1
 
             - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+              # Frozen lockfile policy is enforced in .npmrc.
+              run: pnpm install
 
             - name: Run validation script
               run: node shell/validate-emergency-config.js

.npmrc

@@ -1 +1,3 @@
-engine-strict = true
+engine-strict=true
+prefer-frozen-lockfile=true
+frozen-lockfile=true

package.json

@@ -8,11 +8,14 @@
         "type": "git",
         "url": "git+https://github.com/OlympusDAO/olympus-v3.git"
     },
+    "packageManager": "pnpm@10.33.0",
     "engines": {
         "npm": "use-pnpm",
-        "yarn": "use-pnpm"
+        "yarn": "use-pnpm",
+        "pnpm": "10.33.0"
     },
     "scripts": {
+        "preinstall": "npx only-allow pnpm",
         "postinstall": "./shell/postinstall.sh",
         "build": "forge build",
         "prettier": "prettier --no-error-on-unmatched-pattern --write 'src/**/*.sol' '**/*.html' '.*/**/*.{sh,json,yaml,yml,toml}' '**/*.{sh,json,yaml,yml,toml}'",
@@ -45,6 +48,22 @@
         "solhint": "^3.3.7",
         "solidity-code-metrics": "^0.0.25"
     },
+    "pnpm": {
+        "overrides": {
+            "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
+            "cross-spawn@>=7.0.0 <7.0.5": ">=7.0.5",
+            "glob@>=11.0.0 <11.1.0": ">=11.1.0",
+            "js-yaml@>=4.0.0 <4.1.1": ">=4.1.1",
+            "lodash@<=4.17.23": ">=4.18.0",
+            "markdown-it@>=13.0.0 <14.1.1": ">=14.1.1",
+            "minimatch@>=10.0.0 <10.2.3": ">=10.2.3",
+            "minimatch@>=5.0.0 <5.1.8": ">=5.1.8",
+            "picomatch@<2.3.2": ">=2.3.2",
+            "solhint>ajv": "6.14.0",
+            "semver@>=7.0.0 <7.5.2": ">=7.5.2",
+            "smol-toml@<1.6.1": ">=1.6.1"
+        }
+    },
     "prettier": {
         "tabWidth": 4,
         "singleQuote": false,