chore: migrate from yarn v1 to pnpm

- Update packageManager field in package.json
- Convert yarn.lock to pnpm-lock.yaml using pnpm import
- Update GitHub Actions workflows to use pnpm
- Update test script to use pnpm in example directory
- Add persist-credentials: false to checkout actions for security
- Add explicit permissions to workflow jobs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: azu

.github/workflows/test.yml

@@ -4,17 +4,24 @@ jobs:
   test:
     name: "Test on Node.js ${{ matrix.node-version }}"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         node-version: [ 18, 20, 22 ]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install
-        run: yarn install
+        run: pnpm install
       - name: Test
-        run: yarn test
+        run: pnpm test

.github/workflows/website.yml

@@ -8,26 +8,33 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
       - name: Set Env
         run: |
           echo "CURRENT_VERSION=$(node -p 'require("./package.json").version')" >> $GITHUB_ENV
       - name: Install
-        run: yarn install
+        run: pnpm install
       - name: Build
         run: |
-          yarn install
-          npm run website -- --metadataVersion="${CURRENT_VERSION}"
+          pnpm install
+          pnpm run website -- --metadataVersion="${CURRENT_VERSION}"
         env:
           CURRENT_VERSION: ${{ env.CURRENT_VERSION }}
         working-directory: example/
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./example/dist

package.json

@@ -29,7 +29,7 @@
     "prepublish": "npm run --if-present build",
     "pretest": "node tool/create-fixtures.js",
     "test": "textlint-scripts test && npm run test:textlint",
-    "test:textlint": "(cd example && yarn install && npm test)",
+    "test:textlint": "(cd example && pnpm install && npm test)",
     "format": "prettier --write \"**/*.{js,jsx,ts,tsx,css}\"",
     "prepare": "git config --local core.hooksPath .githooks"
   },
@@ -68,5 +68,5 @@
       "prettier --write"
     ]
   },
-  "packageManager": "[email protected]+sha256.c17d3797fb9a9115bf375e31bfd30058cac6bc9c3b8807a3d8cb2094794b51ca"
+  "packageManager": "[email protected]+sha512.9fb969fa749b3ade6035e0f109f0b8a60b5d08a1a87fdf72e337da90dcc93336e2280ca4e44f2358a649b83c17959e9993e777c2080879f3801e6f0d999ad3dd"
 }