RFC: pnpm as the CI engine, and the pnpm CI server

[zkochan]

Two companion RFCs proposing that pnpm compose its existing pieces — the task orchestration of #23, the workspace task cache of #22, and RFC 0007's artifact transport — into a CI engine, and that pnpr host its control plane.

0000-pnpm-ci.md — pnpm as the CI engine. A single command that makes pnpm the engine a CI run delegates to: an unconditionally frozen install, merge-base affected selection as a pre-pass over the cache (the pipeline always covers everything; the cache decides what executes), the task graph under no-bail semantics with the orchestration RFC's exit contract, read/write cache policy falling out of RFC 0007's possession-based write grant, and a machine-readable event stream plus run summary as the stable product surface. The host — GitHub Actions, GitLab, a cron job — keeps events, machines, and secrets; the pipeline's meaning moves into the repository.

0000-pnpm-ci-server.md — the pnpm CI server. The Buildkite shape with even the control plane on the organization's own server: pnpr grows four severable tiers, ordered by risk — signed run records and a UI over logs the artifact store already holds; task leasing to self-provisioning pnpm ci agent fleets (planning is itself a leased task); forge, cron, and registry-native triggers; and secrets pnpr relays but cannot read. One invariant governs every tier: the server is never the root of trust — its compromise stays bounded by verification clients perform, extending the pattern RFC 0007 established. It ships as a feature-gated surface of the pnpr binary, not a new server.

Both documents are grounded in a working proof of concept (draft PR pnpm/pnpm#14233): pnpm pipeline implements the engine's contract Rust-only with a local-tier task cache, and pnpr carries tier 1 of the server — append-only run-record endpoints and a viewer page. Findings from building and dogfooding it are folded into the texts rather than left as claims, including: the pnpm ci name is doubly taken (it is the clean-install command, and ci is a taken setting name); task-cache keys must be computed over a dependency-closed graph or they become selection-dependent; the task cache's restore record needs content hashes, not a path set (feedback that belongs to #22); red runs must be recorded before the failure exit is raised; and run records should stay opaque to the server, which validates identity and bounds only.

Draft, for discussion — the engine RFC is written to be ratifiable on its own, with the server RFC consuming its contract.

---

Written by an agent (Claude Code, claude-fable-5).

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}