chore: use pnpm instead of npm

[aimensahnoun]

Summary by CodeRabbit

• Chores
  • Migrated project to pnpm (v10.0.0) as the package manager for consistent installs and caching
  • Renamed package to "request-commerce"
  • Added package manager configuration to enforce stricter dependency resolution, security-focused settings, and deterministic installs
  • Updated ignore rules to exclude pnpm debug logs and related temporary files

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Migrates the repository from npm to pnpm: CI workflows, cache keys, and scripts were switched to pnpm; a .npmrc with pnpm-related settings was added; package.json metadata updated to declare pnpm; .gitignore now ignores pnpm-debug.log*. (49 words)

Changes

Cohort / File(s)	Summary
CI/CD Workflow Migration .github/workflows/build-and-lint.yml	Replaces npm commands with pnpm equivalents (pnpm install --frozen-lockfile, pnpm run ...), adds an Install pnpm step, switches Node cache keys/paths to use pnpm-lock.yaml and node_modules, and removes npm-specific cache entries.
Package Manager Configuration .npmrc	Adds new npm/pnpm configuration options (minimum-age-seconds, strict-peer-dependencies, strict-ssl, ignore-scripts, prefer-offline, save-exact, shamefully-hoist) with explanatory comments.
Metadata & Ignore Rules package.json, .gitignore	Updates package name to request-commerce and adds packageManager: "pnpm@10.0.0" to package.json; adds pnpm-debug.log* to .gitignore.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: use pnpm instead of npm' accurately describes the primary change—migrating the project from npm to pnpm across workflows, configuration, and package management settings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 14f6dab and 5162ce6.

📒 Files selected for processing (1)

• .github/workflows/build-and-lint.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/build-and-lint.yml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Build

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4d82506 and 14f6dab.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• .github/workflows/build-and-lint.yml
• .gitignore
• .npmrc
• package.json

🧰 Additional context used

📓 Path-based instructions (1)

**/*

⚙️ CodeRabbit configuration file

**/*: - Only comment on issues that would block merging — ignore minor or stylistic concerns.

• Restrict feedback to errors, security risks, or functionality-breaking problems.
• Do not post comments on code style, formatting, or non-critical improvements.
• Keep reviews short: flag only issues that make the PR unsafe to merge.
• Limit review comments to 3–5 items maximum, unless additional blockers exist.
• Group similar issues into a single comment instead of posting multiple notes.
• Skip repetition — if a pattern repeats, mention it once at a summary level only.
• Do not add general suggestions; focus strictly on merge-blocking concerns.
• If there are no critical problems, respond with minimal approval (e.g., 'Looks good'). Do not add additional review.
• Avoid line-by-line commentary unless it highlights a critical bug or security hole.
• Highlight only issues that could cause runtime errors, data loss, or severe maintainability issues.
• Ignore minor optimization opportunities — focus solely on correctness and safety.
• Provide a top-level summary of critical blockers rather than detailed per-line notes.
• Comment only when the issue must be resolved before merge — otherwise, remain silent.
• When in doubt, err on the side of fewer comments — brevity and blocking issues only.
• Avoid posting any refactoring issues

Files:

• package.json

🔇 Additional comments (1)

.github/workflows/build-and-lint.yml (1)

39-39: > Likely an incorrect or invalid review comment.