adopt pnpm and trusted publishing

.github/workflows/publish.yml

@@ -5,21 +5,22 @@ on:
   release:
     types: [published]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v5
+        with:
+          version: 10
+      - uses: actions/setup-node@v6
         with:
-          node-version: 20
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'yarn'
-      - run: yarn --frozen-lockfile
-      - run: yarn test
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install
+      - run: pnpm run test
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -10,10 +10,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v5
         with:
-          node-version: 20
-          cache: yarn
-      - run: yarn --frozen-lockfile
-      - run: yarn test
+          version: 10
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install
+      - run: pnpm run test

CONTRIBUTING.md

@@ -2,14 +2,14 @@ The Observable runtime is open source and released under the [ISC License](https
 
 ## Development
 
-We use Yarn 1.x (Classic). To install dependencies:
+We use pnpm. To install dependencies:
 
 ```
-yarn
+pnpm i
 ```
 
 To run tests with Mocha:
 
 ```
-yarn test
+pnpm run test
 ```