Remove build dependency on node; add lock for every package manager (#38)

.github/workflows/ci.yml

@@ -46,12 +46,12 @@ jobs:
         uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
-      - name: Install requirements
+      - name: Install Deno requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          deno install --frozen
       - name: Run Prettier check
         run: |
-          python pnpm.py fmt:check
+          deno task fmt:check
 
   eslint:
     name: ESLint check
@@ -62,12 +62,12 @@ jobs:
         uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
-      - name: Install requirements
+      - name: Install Deno requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          deno install --frozen
       - name: Run ESLint check
         run: |
-          python pnpm.py lint
+          deno task lint
 
   python_tests:
     name: Python tests
@@ -113,13 +113,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v4  # respects packageManager version in package.json
-      - name: Install requirements
+      - name: Install Deno v2.x (latest)
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+      - name: Install Deno requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          deno install --frozen
       - name: Build control bundle
         run: |
-          python pnpm.py run bundle
+          deno task bundle
       - name: Generate bundle hashes
         run: |
           pushd dist
@@ -140,10 +143,6 @@ jobs:
           path: |
             src/yt/solver/test/players
           key: test-player-js-${{ hashFiles('src/yt/solver/test/tests.ts') }}
-      - name: Install Deno v2.x (latest)
-        uses: denoland/setup-deno@v2
-        with:
-          deno-version: v2.x
       - name: Download player JS files
         run: |
           deno run \
@@ -161,6 +160,62 @@ jobs:
             src/yt/solver/test/players/*
           compression-level: 0
 
+  pnpm_build:
+    name: Test pnpm build
+    needs: [prepare]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - uses: actions/setup-python@v6
+        with:
+          # minimum supported version
+          python-version: "3.10"
+      - name: Install Python requirements
+        run: |
+          python -m pip install -U build
+      - name: Test pnpm build
+        run: |
+          python -m build
+      - name: Verify artifact contents
+        run: |
+          tar -tvzf dist/yt_dlp_ejs-*.tar.gz
+          unzip -l dist/yt_dlp_ejs-*.whl | tee .wheel_contents
+          grep -q 'yt_dlp_ejs/yt/solver/core\.min\.js' .wheel_contents
+          grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
+      - name: Install pnpm requirements
+        run: |
+          pnpm install --frozen-lockfile
+      - name: Bundle with pnpm
+        run: |
+          pnpm run bundle
+      - name: Download bundle hashes
+        uses: actions/download-artifact@v5
+        with:
+          path: dist
+          name: bundle-hashes
+      - name: Verify bundle hashes
+        run: |
+          cd dist
+          sha256sum -c SHA2-256SUMS
+
+  deno_lock_check:
+    name: Test Deno lockfile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v6
+      - name: Verify lockfile
+        run: |
+          python ./check.py
+
   deno_build:
     name: Test Deno build
     needs: [prepare]
@@ -190,7 +245,7 @@ jobs:
           grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
       - name: Install Deno requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          deno install --frozen
       - name: Bundle with Deno
         run: |
           deno task bundle
@@ -216,7 +271,7 @@ jobs:
           deno-version: "2.0.0"  # minimum supported version
       - name: Install Deno requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          deno install --frozen
       - name: Download player JS artifact
         uses: actions/download-artifact@v5
         with:
@@ -257,7 +312,7 @@ jobs:
           grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
       - name: Install Bun requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          bun install --frozen-lockfile
       - name: Bundle with Bun
         run: |
           bun --bun run bundle
@@ -283,7 +338,7 @@ jobs:
           bun-version: "1.2.11"  # XXX: We support 1.0.31, but test suite requires 1.2.11+
       - name: Install Bun requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          bun install --frozen-lockfile
       - name: Download player JS artifact
         uses: actions/download-artifact@v5
         with:
@@ -322,7 +377,7 @@ jobs:
           grep -q 'yt_dlp_ejs/yt/solver/lib\.min\.js' .wheel_contents
       - name: Install Node requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          npm ci
       - name: Bundle with Node
         run: |
           npm run bundle
@@ -348,7 +403,7 @@ jobs:
           node-version: "22.18"  # XXX: We support 20.0, but test suite requires 22.18+
       - name: Install Node requirements
         run: |
-          python pnpm.py install --frozen-lockfile
+          npm ci
       - name: Download player JS artifact
         uses: actions/download-artifact@v5
         with:
@@ -365,6 +420,8 @@ jobs:
       - prettier
       - eslint
       - python_tests
+      - pnpm_build
+      - deno_lock_check
       - deno_build
       - deno_tests
       - bun_build

.github/workflows/release.yml

@@ -37,7 +37,7 @@ jobs:
           compression-level: 0
       - name: Build JavaScript artifacts
         run: |
-          python pnpm.py install --frozen-lockfile
+          deno install --frozen
           deno task bundle
       - name: Upload JavaScript artifacts
         uses: actions/upload-artifact@v4