all: Migrate to pnpm workspaces with parallel builds

[bwateratmsft]

Summary

Migrates the monorepo from npm (per-package lockfiles) to pnpm 11.8.0 with workspaces, catalog versions, and parallel CI builds.

Key changes

Infrastructure

• Root package.json with packageManager: pnpm@11.8.0 and parallel workspace scripts (sequential for tests via --workspace-concurrency=1)
• pnpm-workspace.yaml with catalog versions for shared deps, publicHoistPattern (minimal: eslint, typescript, mocha, chai), overrides, and allowBuilds
• Deleted all 8 per-package package-lock.json files and .npmrc (settings moved to pnpm-workspace.yaml)

CI Pipelines

• GitHub Actions packages.yml: collapsed from matrix to single job calling jobs.yml with package_manager: pnpm
• GitHub Actions jobs.yml: bumped actions/checkout and actions/setup-node from v3 to v4 for proper pnpm store caching
• AzDO build.yml: collapsed to a single job with packageManager: pnpm (matching vscode-containers approach)

Shared VS Code test download

• Each package's .vscode-test.mjs now sets cachePath to a shared root-level .vscode-test/ directory, so VS Code is downloaded once and reused across all test packages (utils, appservice, azure)

Phantom dependency fixes (exposed by pnpm strict isolation)

Package	Added Dep	Type	Reason
github	dayjs	regular	Used but never declared; resolved via npm hoisting
appservice	@azure/core-auth	regular	Consumed transitively from other Azure SDK pkgs
appservice	@azure/arm-resources	regular	Same — transitive dep needs explicit declaration
webview	@types/react	dev	Types hoisted from react; pnpm isolation broke resolution
webview	@types/react-dom	dev	Same
utils	vscode-jsonrpc	dev	@github/copilot-sdk's .d.ts imports vscode-jsonrpc/node which fails without exports map

Catalog version bumps (where a package got a newer range)

Dep	Old version (in some packages)	Catalog version	Affected
@azure/core-rest-pipeline	^1.10.3	^1.23.0	appservice
@azure/core-client	^1.7.2	^1.10.1	appservice
dayjs	^1.11.2	^1.11.19	appservice

p-retry v3 → v8 (appservice)

Upgraded p-retry from v3 to v8 (ESM-only, built-in types). All 3 call sites rewritten:

• retry() → pRetry(), retry.AbortError → named AbortError import
• Removed @types/p-retry
• Files: syncTriggersPostDeploy.ts, siteFiles.ts, kuduUtils.ts

Azure SDK type casts (appservice)

@azure/arm-appinsights@5-beta, @azure/arm-resources@6, @azure/arm-resourcegraph@5-beta cause type identity mismatches under pnpm's isolated node_modules (duplicate copies of @azure/core-client mean ServiceClient is a different type identity than under npm's flat hoisting). Fixed with as unknown as AzExtClientType<T> casts in azureClients.ts.

skipLibCheck usage

Only one place: utils/package.json build:cjs script. vscode-jsonrpc has no exports map and its type declarations fail under moduleResolution: nodenext in the CJS output. Does not affect the main ESM build or any other package.

Other

• pnpm exec → pnpx in all l10n scripts
• npm run → pnpm run, npm pack → pnpm pack across all packages
• serialize-javascript moved to workspace-level overrides for consistent secure version

Notes

• Packages use published versions of each other (no workspace: protocol)
• auth uses @types/vscode@1.106.0 and webview uses ^1.104.0 — not yet on catalog (1.105.0)