chore(calm-suite): migrate calm-guard to npm workspaces

[gjs-opsflo]

Summary

Migrates calm-suite/calm-guard (and its docs/ sub-package) from a standalone pnpm workspace into the root npm workspaces. This is the first half of the pnpm→npm migration tracked by #2328 — a smaller, lower-risk PR landed first as a proof-of-concept. The calm-studio half follows in a separate PR.

Resolves #2328 (calm-guard portion).

Changes

• Root package.json: Added calm-suite/calm-guard and calm-suite/calm-guard/docs to the workspaces array.
• calm-suite/calm-guard/package.json: Removed "packageManager": "pnpm@10.23.0". Rewrote docs:dev/docs:build scripts to call npm run --workspace=calmguard-docs.
• calm-suite/calm-guard/docs/package.json: Renamed "name": "docs" → "name": "calmguard-docs" to avoid collision with the root docs/ workspace. Widened typescript range from ~5.6.2 to ^5.6.2 to align with the hoisted root version. Removed pnpm.overrides (root overrides cover them).
• Deleted: calm-suite/calm-guard/pnpm-lock.yaml, calm-suite/calm-guard/docs/pnpm-lock.yaml.
• Regenerated: root package-lock.json (single source of truth).
• .github/workflows/build-calm-guard.yml: Removed pnpm/action-setup steps; switched cache to npm with cache-dependency-path: package-lock.json; replaced pnpm install --frozen-lockfile with npm ci; replaced pnpm <script> with npm run <script> --workspace=calmguard.
• calm-suite/calm-guard/src/lib/calm/cli-validator.ts: Defeat webpack static analysis of require.resolve('@finos/calm-cli/dist/index.js') by concatenating the path at runtime. Required because npm hoists uri-js differently than pnpm strict isolation, exposing the bundled CLI's transitive submodule references (./IPv6, ./SecondLevelDomains, ./punycode) to webpack's static analysis. serverExternalPackages alone is insufficient when a static require.resolve is present in the source.

Validation evidence

Local validation from a clean checkout (run from repo root):

• rm -rf node_modules && CYPRESS_INSTALL_BINARY=0 npm ci — exits 0, no EUNSUPPORTEDPROTOCOL.
• npm run lint --workspace=calmguard — green.
• npm run typecheck --workspace=calmguard — green.
• npm run test:run --workspace=calmguard — green (111 tests).
• npm run build --workspace=calmguard — green (Next.js production build).
• npm run test --workspaces --if-present — 634/635 tests pass; the single failure (shared/src/docify/template-bundles/docusaurus/package.spec.ts) is pre-existing on origin/main and unrelated to this migration.
• ! rg 'pnpm' calm-suite/calm-guard/ .github/workflows/build-calm-guard.yml — zero matches inside calm-guard scope.

CI on this PR will run the rewritten Build CALM Guard workflow and must be green before merge.

Breaking-change notes

• pnpm is no longer the package manager for calm-guard. Contributors must run npm ci from the repo root (not pnpm install inside calm-suite/calm-guard/).
• The docs sub-package name changed from docs to calmguard-docs. Any downstream tooling that referenced it by name (none known in-repo) must update.
• Renovate/Dependabot will start scanning calm-guard deps via the root package-lock.json (previously not scanned). Expect a small wave of automated dep PRs after merge.

Out of scope (follow-up)

• calm-suite/calm-studio migration — separate PR (also against Migrate calm-suite projects from pnpm to npm workspaces #2328).
• Renovate/Dependabot CVE/license-scan matrix expansion to include calm-suite — separate PR.

[Copilot]

Pull request overview

Migrates calm-suite/calm-guard (including its docs/ package) from a standalone pnpm setup into the repo’s root npm workspaces, aligning calm-guard’s dependency installation and CI workflow with the monorepo’s standard npm workspace pattern.

Changes:

• Added calm-suite/calm-guard and calm-suite/calm-guard/docs to the root npm workspaces.
• Updated calm-guard and its docs package metadata/scripts to work under npm workspaces (including renaming the docs workspace package).
• Reworked the Build CALM Guard GitHub Actions workflow to use npm ci and npm run ... --workspace=... instead of pnpm.

Reviewed changes

Copilot reviewed 5 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Registers calm-guard and its docs as root npm workspaces.
calm-suite/calm-guard/package.json	Removes pnpm packageManager pin; rewires docs scripts to npm workspaces.
calm-suite/calm-guard/docs/package.json	Renames docs workspace package; adjusts TypeScript range; removes pnpm overrides.
.github/workflows/build-calm-guard.yml	Switches CI from pnpm-in-subdir to root npm ci + workspace-scoped commands and npm caching.
calm-suite/calm-guard/src/lib/calm/cli-validator.ts	Attempts to avoid webpack static tracing of require.resolve for calm-cli entrypoint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rocketstack-matt]

Looks good - just need to update the docs README and calm-guard AGENTS.md to instruct use of npm instead on pnpm

[gjs-opsflo]

@Copilot good catch. You're right that webpack 5 can constant-fold simple string concatenation. Pushed an amended commit using process.env.CALM_CLI_MODULE ?? '@finos/calm-cli/dist/index.js' instead — process.env is genuinely runtime, so webpack cannot fold the expression to a literal. As a side benefit, deployments now have an env-var escape hatch to override the CLI path without code changes.

Verified locally: build still emits the expected Critical dependency: the request of a dependency is an expression warning (proof webpack stayed opaque), and lint/typecheck/111 tests/build are all green.

[gjs-opsflo]

Pushed faa4e3b updating the docs to instruct npm usage instead of pnpm:

• calm-suite/calm-guard/README.md — badge swap, prerequisites, clone target now points at finos/architecture-as-code, install/run commands rewritten with npm ... --workspace=calmguard
• calm-suite/calm-guard/AGENTS.md — package manager row + Key Commands block
• calm-suite/calm-guard/docs/README.md — Docusaurus site install/start/build commands
• calm-suite/calm-guard/docs/docs/getting-started.md — prereqs, install, run
• calm-suite/calm-guard/docs/docs/contributing.md — install, test, full-check command list
• calm-suite/calm-guard/docs/docs/security.md — npm audit, npm run license-check --workspace=calmguard
• calm-suite/calm-guard/docs/docs/api/reference.md — auto-regen command
• calm-suite/calm-guard/docs/docs/architecture/system-overview.md — package manager row
• calm-suite/calm-guard/docs/docs/uploading-architectures.md — npm run dev --workspace=calmguard

Verified zero remaining pnpm references in calm-suite/calm-guard/**/*.{md,mdx}.