chore: migrate from npm to pnpm with supply chain hardening

[Kabidoye-17]

Why?

This repo was surfaced in a follow-up audit as part of the org-wide effort to bring active npm repos onto a supply-chain-hardened footing (per-package script gating, install cooldown, pnpm's stricter dependency graph). Migrating to pnpm 10 aligns Intercom-OpenAPI with the target config already applied across the sibling repos in FE-3214.

How?

pnpm import was used to convert package-lock.json to pnpm-lock.yaml verbatim, preserving every resolved version so no transitive dependency drift shipped alongside the tooling swap. Supply-chain settings (minimumReleaseAge: 10080, trustPolicy: no-downgrade) live in pnpm-workspace.yaml; the es5-ext cosmetic postinstall is silenced via pnpm.ignoredBuiltDependencies. Registry-source lockdown is already handled at the infra layer by Socket Firewall, so no pnpm-side config is needed here. Disabled workflows under .github/workflows-disabled/ were updated so they continue to work if re-enabled — the new pnpm/action-setup refs are SHA-pinned. Pre-existing GHA hardening gaps (unpinned actions/checkout, missing top-level permissions: blocks) were left out of scope; whoever re-enables any workflow should run the security-review skill end-to-end first.

Follow-up

fern-api is pinned to 5.65.3 in workflows. pnpm add -g fern-api (unpinned) fails through Intercom's registry proxy because the proxy serves the fern-api manifest without a dist-tags block, and pnpm has no fallback resolver for a missing latest tag. Upstream issues, both open:

• pnpm/pnpm#5564
• pnpm/pnpm#9944

When those are fixed (or the proxy is fixed to include dist-tags), the pin can be dropped.

_{Generated with Claude Code}

[Kabidoye-17]

Local Verification — no regressions

Same fern flow run on both sides. The same 3 pre-existing spec errors and 295 warnings appear on main and on this branch — no new errors introduced by the migration.

Master (npm install)

rm -rf node_modules && npm install — 550 packages in 6s; 6 deprecation warnings; 12 vulnerabilities (4 moderate, 8 high) reported by npm audit.

npm install -g fern-api → fern check → fern generate --preview --group ts-sdk — 3 errors, 295 warnings.

This branch (pnpm install)

rm -rf node_modules && pnpm install — 522 packages in 3.3s; preinstall guard runs and exits 0. The ${GITHUB_TOKEN} .npmrc warning is pre-existing (harmless — no @intercom/* runtime deps consume it).

fern check — 3 errors, 295 warnings (identical to master).

fern generate --preview --group ts-sdk — 3 errors, 295 warnings (identical to master).

Errors — identical on both sides

File	Error
preview/conversationsAttributes.yml	CreateConversationAttributeOptionRequest already declared in preview/__package__.yml
preview/articles.yml	PublishArticleDraftRequest already declared in preview/__package__.yml
preview/articles.yml	UpdateArticleRequestBody is not defined

Pre-existing spec issues, unrelated to the migration.

~ Automated via Claude

[shrek-intercom]

❌ PR Review Summary: NEEDS HUMAN REVIEW

	Summary
✅	🎯 Problem — The PR title and description are excellent, clearly articulating the motivation (org-wide supply chain hardening audit), referencing the broader initiative (FE-3214), and documenting key implementation decisions and follow-up considerations.
✅	📝 Alignment — All substantive claims in the description are confirmed by the diff, including the npm-to-pnpm migration, supply-chain settings in pnpm-workspace.yaml, es5-ext silencing, SHA-pinned pnpm/action-setup in disabled workflows, fern-api pinned to 5.65.3, and explicitly scoped-out GHA hardening gaps.
ℹ️	🧠 Correctness — Disabled for this repository.
❌	🦺 Safety — The PR touches multiple categories requiring mandatory human review: seven CI/CD workflow files under .github/, dependency manifests and lockfiles (package.json modified, package-lock.json deleted, pnpm-lock.yaml and pnpm-workspace.yaml added), and the sensitive CLAUDE.md configuration file.
❌	🚦 Auto-approval — Touches AI config files (CLAUDE.md); Exceeds LOC limit (10800 meaningful LOC > 150, raw 10800)

Per-criterion details

Problem

Excellent PR description that clearly explains the why (org-wide supply chain hardening audit), provides context about the broader initiative (FE-3214), and documents important follow-up considerations. While the How section is detailed, it's justified for a security-related infrastructure change where implementation decisions matter.

Alignment

The PR description claims a migration from npm to pnpm with supply chain hardening. Checking each claim against the diff:

1. npm to pnpm migration: ✅ The diff shows package-lock.json deleted, pnpm-lock.yaml created, package.json updated with "packageManager": "pnpm@10.23.0", all workflow files changed from npm install -g fern-api to pnpm add -g fern-api@5.65.3, and documentation (CLAUDE.md, CONTRIBUTING.md) updated with pnpm commands.

2. Supply-chain settings (minimumReleaseAge: 10080, trustPolicy: no-downgrade) in pnpm-workspace.yaml: ✅ Confirmed exactly in the new pnpm-workspace.yaml file.

3. es5-ext silenced via pnpm.ignoredBuiltDependencies: ✅ Confirmed in the package.json changes.

4. Disabled workflows updated with SHA-pinned pnpm/action-setup: ✅ All 7 workflow files under .github/workflows-disabled/ use pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.1.0.

5. Pre-existing GHA hardening gaps left out of scope: ✅ The diff shows actions/checkout@v4 and @v3 remain unpinned, consistent with the claim.

6. fern-api pinned to 5.65.3: ✅ All workflows use pnpm add -g fern-api@5.65.3.

7. pnpm import used: The diff shows package-lock.json deleted and pnpm-lock.yaml created as new file, consistent with this claim (we can't verify the exact command from the diff alone, but the outcome matches).

No significant changes in the diff are omitted from the description. The CONTRIBUTING.md additions (pnpm setup instructions) are a minor doc update that's implicitly part of the migration. All substantive changes are accurately described.

Safety

This PR is a tooling migration from npm to pnpm that touches multiple categories of files explicitly listed as requiring human review in the safety criteria. The changes include:

1. CI/CD workflow files (.github/workflows-disabled/): Seven workflow files are modified. Even though they're currently in a "disabled" directory, they are under .github/ and represent CI/CD configuration.

2. Dependency manifests and lockfiles: package.json is modified (adding packageManager field and pnpm.ignoredBuiltDependencies), package-lock.json is deleted entirely, and new pnpm-lock.yaml and pnpm-workspace.yaml files are added. These are explicitly called out as unsafe in the criteria.

3. CLAUDE.md: The project instructions file is modified (changing npm install to pnpm install references). The criteria note that "CLAUDE.md and .claude/ config are treated as sensitive."

None of the changes touch the safe categories (Unstable/Preview spec, generated Postman collections, or general documentation like README). While CONTRIBUTING.md changes alone might qualify as safe documentation, the PR as a whole is clearly infrastructure/tooling work that requires human review.

<violated_criteria>
CI/CD and repo config — changes to files under .github/ (seven workflow files in .github/workflows-disabled/ are modified)
Dependency manifests / lockfiles — package.json modified, package-lock.json deleted, new pnpm-lock.yaml and pnpm-workspace.yaml added
CLAUDE.md modification — sensitive project configuration file edited
</violated_criteria>

_{Rate this comment 👍 / 👎 to help us improve 🙏 · Disagree with assessment? Establish ground truth here}