feat: Replace npm with pnpm (#4932)

Replace npm with a modern alternative, a lot faster for local dev, and
doesn't run install scripts automatically

Closes #4905

Author: another-rex

CONTRIBUTING.md

@@ -52,7 +52,8 @@ You must install:
 2.  [Google Cloud SDK](https://cloud.google.com/sdk)
 3.  [Hugo](https://gohugo.io/installation/)
 4.  [Node JS](https://nodejs.org/) >= 18.17.x
-5.  [Terraform](https://developer.hashicorp.com/terraform/install) >= 1.5 (for infrastructure changes)
+5.  [pnpm](https://pnpm.io/installation) (install via `npm install -g pnpm --prefix ~/.local` or `corepack enable pnpm`)
+6.  [Terraform](https://developer.hashicorp.com/terraform/install) >= 1.5 (for infrastructure changes)
 
 Then you can set up the development environment by cloning the OSV repo and
 installing the Poetry dependencies.

Makefile

@@ -89,17 +89,17 @@ build-api-protos:
 build-protos: build-osv-protos build-api-protos
 
 run-website:
-	cd gcp/website/frontend3 && npm install && npm run build
+	cd gcp/website/frontend3 && pnpm install && pnpm run build
 	cd gcp/website/blog && hugo --buildFuture -d ../dist/static/blog
 	cd gcp/website && $(install-cmd) && GOOGLE_CLOUD_PROJECT=oss-vdb OSV_VULNERABILITIES_BUCKET=osv-vulnerabilities $(run-cmd) python main.py
 
 run-website-staging:
-	cd gcp/website/frontend3 && npm install && npm run build
+	cd gcp/website/frontend3 && pnpm install && pnpm run build
 	cd gcp/website/blog && hugo --buildFuture -d ../dist/static/blog
 	cd gcp/website && $(install-cmd) && GOOGLE_CLOUD_PROJECT=oss-vdb-test OSV_VULNERABILITIES_BUCKET=osv-test-vulnerabilities $(run-cmd) python main.py
 
 run-website-emulator:
-	cd gcp/website/frontend3 && npm install && npm run build
+	cd gcp/website/frontend3 && pnpm install && pnpm run build
 	cd gcp/website/blog && hugo --buildFuture -d ../dist/static/blog
 	cd gcp/website && $(install-cmd) && DATASTORE_EMULATOR_PORT=5002 $(run-cmd) python frontend_emulator.py
 

gcp/website/Dockerfile

@@ -3,14 +3,15 @@ FROM node:24.14@sha256:dcac36e9d0d3049214862dac30af9f1ee86fccaa8d3bd3a0399b59d6f
 WORKDIR /build/frontend3
 
 # Install dependencies first for better caching
-COPY gcp/website/frontend3/package.json gcp/website/frontend3/package-lock.json ./
-RUN npm ci
+RUN corepack enable pnpm
+COPY gcp/website/frontend3/package.json gcp/website/frontend3/pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
 
 COPY gcp/website/frontend3/webpack.prod.js ./
 COPY gcp/website/frontend3/img img
 COPY gcp/website/frontend3/src src
 
-RUN npm run build:prod
+RUN pnpm run build:prod
 
 # Build hugo blogs
 # Use the ci image, since it already built the version of hugo we want from source