pnpm vs bun install 对比

// pnpm 12.3 — 通过 allowBuilds 进行受控安装与 workspace 过滤
// package.json(根目录)
{
  "name": "monorepo-root",
  "private": true,
  "packageManager": "[email protected]"
}

// pnpm-workspace.yaml — allowBuilds 在 v10.26.0 中引入，v11 移除了旧名称(onlyBuiltDependencies 等)
packages:
  - "apps/*"
  - "packages/*"

allowBuilds:
  esbuild: true
  sharp: true
  core-js: false

catalog:
  react: ^19.2.3
  typescript: ^5.7.0

// CI 安装步骤(GitHub Actions)
- name: Install dependencies
  run: pnpm install --frozen-lockfile --trust-policy=no-downgrade

// 移除包时,整份 lockfile 会针对当前策略重新校验
pnpm remove left-pad --filter ./apps/web --trust-lockfile

// 仅对发生变更的 workspace 包执行安装
pnpm install --filter "...[origin/main]"

// 把 store 路径加入 CI 缓存键
pnpm store path

// Bun 1.4 — isolated installs + global virtual store + 离线安装
// bunfig.toml(根目录)
[install]
linker = "isolated"
globalStore = true
exact = false

// package.json
{
  "name": "monorepo-root",
  "private": true,
  "workspaces": ["apps/*", "packages/*"],
  "trustedDependencies": [
    "esbuild",
    "sharp",
    "@prisma/client"
  ]
}

// CI 安装步骤(GitHub Actions)— 锁定且兼容离线
- name: Install dependencies
  run: bun install --frozen-lockfile --prefer-offline

// 查看被阻止的 postinstall 脚本
bun pm untrusted

// 将某个包标记为可信
bun pm trust sharp

// 对特定 workspace 包执行安装
bun install --filter "./apps/web"

// 完全离线安装(不会访问网络)
bun install --offline