chore: Support npm, yarn, and pnpm across reusable workflows - W-23613503

[mshanemc]

What issues does this PR fix or reference?

@W-23613503@

What changed and why?

• Parameterized unit-test and NUT reusable workflows so callers can use npm, Yarn, or pnpm.
• Routed Node setup, caching, and installs through .github/actions/setupNodeAndInstall/action.yml.
• Replaced hard-coded Yarn build/test/compile/manifest steps with caller-provided commands.
• Kept Yarn defaults so existing callers keep working without new inputs.
• Documented npm and pnpm caller examples in README.md.

CLI publish/pack/docs workflows (tarballs, packUpload*, publishTypedoc) are unchanged.

[madhur310]

Why yarn as default and not npm ci? The shared composite action setupNodeAndInstall has smart auto-substitution logic but it only fires when the incoming install-command is exactly "npm ci", so if someone chooses npm/pnpm but misses passing the install command then yarn would still run.

[mshanemc]

Yarn is the default on that input because unitTestsWindows.yml still always installs with Yarn. setupNodeAndInstall only rewrites an install command when it is exactly npm ci, so a Yarn default does not get rewritten when package-manager is npm or pnpm.

The reviewed default: yarn / default: yarn install --network-timeout 600000 inputs are on PR head 5468051, not in this checkout. This worktree is cd2eafc. Here the workflow has no install-command input and hardcodes Yarn:

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node_version }}
          cache: yarn
      # ...
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/yarn.lock') }}

      - uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@main
        if: ${{ steps.cache-nodemodules.outputs.cache-hit != 'true' }}
      # ...
        run: yarn add wireit@^0.14.12

      - run: yarn build
      # ...
          command: yarn test

Current callers pass no package-manager inputs. A workflow default of npm ci would change those runs. The Yarn default keeps that behavior.

The substitution claim matches the composite action in this tree. Its own defaults are npm and npm ci, and the rewrite runs only for that exact command:

    description: 'Package manager to use: npm, pnpm, or yarn.'
    required: false
    default: npm
  # ...
  install-command:
    description: 'Command used to install repository dependencies.'
    required: false
    default: npm ci

        if [ "$INSTALL_COMMAND" = "npm ci" ]; then
          case "$PACKAGE_MANAGER" in
            pnpm) INSTALL_COMMAND="pnpm install --frozen-lockfile" ;;
            yarn) INSTALL_COMMAND="yarn install --network-timeout 600000" ;;
          esac
        fi

There is no reverse case. yarn install --network-timeout 600000 is passed through. Setting package-manager to npm or pnpm and leaving install-command at the workflow default still runs Yarn.

[madhur310]

Ahgot it. It would be nice add something like below to avoid the case of mismatching package-manager and install command:

    - name: Validate package manager
      shell: bash
      env:
        PACKAGE_MANAGER: ${{ inputs.package-manager }}
      run: |
        if [ "$PACKAGE_MANAGER" != "npm" ] && [ "$PACKAGE_MANAGER" != "pnpm" ] && [ "$PACKAGE_MANAGER" != "yarn" ]; then
          echo "::error::Unsupported package manager: $PACKAGE_MANAGER. Expected npm, pnpm, or yarn."
          exit 1
        fi

    - name: Validate cache-dependency-path and install-command match package-manager
      shell: bash
      env:
        PACKAGE_MANAGER: ${{ inputs.package-manager }}
        CACHE_DEPENDENCY_PATH: ${{ inputs.cache-dependency-path }}
        INSTALL_COMMAND: ${{ inputs.install-command }}
      run: |
        case "$PACKAGE_MANAGER" in
          npm)  expected_lockfile="package-lock.json"; expected_bin="npm" ;;
          yarn) expected_lockfile="yarn.lock";          expected_bin="yarn" ;;
          pnpm) expected_lockfile="pnpm-lock.yaml";     expected_bin="pnpm" ;;
        esac

        actual_lockfile=$(basename "$CACHE_DEPENDENCY_PATH")
        if [ "$actual_lockfile" != "$expected_lockfile" ]; then
          echo "::error::package-manager is '$PACKAGE_MANAGER' but cache-dependency-path points at '$CACHE_DEPENDENCY_PATH' (expected a '$expected_lockfile' file). Pass a matching cache-dependency-path for '$PACKAGE_MANAGER'."
          exit 1
        fi

        install_bin=$(echo "$INSTALL_COMMAND" | awk '{print $1}')
        if [ "$install_bin" != "$expected_bin" ]; then
          echo "::error::package-manager is '$PACKAGE_MANAGER' but install-command '$INSTALL_COMMAND' runs '$install_bin'. Pass an install-command that starts with '$expected_bin' (or leave it unset to use the default)."
          exit 1
        fi