chore: 🚀 Migrate monorepo from Yarn to pnpm + Turbo integration + Configuration cleanup (#10165)

This PR modernizes the ZITADEL monorepo build system by migrating from
Yarn to pnpm, introducing Turbo for improved build orchestration, and
cleaning up configuration inconsistencies across all apps and packages.

### 🎯 Key Improvements

#### 📦 **Package Manager Migration (Yarn → pnpm)**
- **Performance**: Faster installs with pnpm's efficient symlink-based
node_modules structure
- **Disk space**: Significant reduction in disk usage through
content-addressable storage
- **Lockfile**: More reliable dependency resolution with pnpm-lock.yaml
- **Workspace support**: Better monorepo dependency management

#### ⚡ **Turbo Integration**
- **Build orchestration**: Dependency-aware task execution across the
monorepo
- **Intelligent caching**: Dramatically faster builds on CI/CD and local
development
- **Parallel execution**: Optimal task scheduling based on dependency
graphs
- **Vercel optimization**: Enhanced build performance and caching on
Vercel deployments

#### 🧹 **Configuration Cleanup & Unification**
- **Removed config packages**: Eliminated `@zitadel/*-config` packages
and inlined configurations
- **Simplified dependencies**: Reduced complexity in package.json files
across all apps
- **Consistent tooling**: Unified prettier, ESLint, and TypeScript
configurations
- **Standalone support**: Improved prepare-standalone.js script for
subtree deployments

### 📋 Detailed Changes

#### **🔧 Build System & Dependencies**
- ✅ Updated all package.json scripts to use `pnpm` instead of `yarn`
- ✅ Replaced `yarn.lock` with pnpm-lock.yaml and regenerated
dependencies
- ✅ Added Turbo configuration (turbo.json) to root and individual
packages
- ✅ Configured proper dependency chains: `@zitadel/proto#generate` →
`@zitadel/client#build` → `console#build`
- ✅ Added missing `@bufbuild/protobuf` dependency to console app for
TypeScript compilation

#### **🚀 CI/CD & Workflows**
- ✅ Updated all GitHub Actions workflows to use `pnpm/action-setup@v4`
- ✅ Migrated build processes to use Turbo with directory-based filters
(`--filter=./console`)
- ✅ **New**: Added `docs.yml` workflow for building documentation
locally (helpful for contributors without Vercel access)
- ✅ Fixed dependency resolution issues in lint workflows
- ✅ Ensured proto generation always runs before builds and linting

#### **📚 Documentation & Proto Generation**
- ✅ **Robust plugin management**: Enhanced plugin-download.sh with retry
logic and error handling
- ✅ **Vercel compatibility**: Fixed protoc-gen-connect-openapi plugin
availability in Vercel builds
- ✅ **API docs generation**: Resolved Docusaurus build errors with
OpenAPI plugin configuration
- ✅ **Type safety**: Improved TypeScript type extraction patterns in
Angular components

#### **🛠️ Developer Experience**
- ✅ Updated all README files to reference pnpm commands
- ✅ Improved Makefile targets to use Turbo for consistent builds
- ✅ Enhanced standalone build process for login app subtree deployments
- ✅ Added debug utilities for troubleshooting build issues

#### **🗂️ File Structure & Cleanup**
- ✅ Removed obsolete configuration packages and their references
- ✅ Cleaned up Docker files to remove non-existent package copies
- ✅ Updated workspace references and import paths
- ✅ Streamlined turbo.json configurations across all packages

### 🎉 Benefits

1. **⚡ Faster Builds**: Turbo's caching and parallel execution
significantly reduce build times
2. **🔄 Better Caching**: Improved cache hits on Vercel and CI/CD
environments
3. **🛠️ Simplified Maintenance**: Unified tooling and configuration
management
4. **📈 Developer Productivity**: Faster local development with optimized
dependency resolution
5. **🚀 Enhanced CI/CD**: More reliable and faster automated builds and
deployments
6. **📖 Better Documentation**: Comprehensive build documentation and
troubleshooting guides

### 🧪 Testing

- ✅ All apps build successfully with new pnpm + Turbo setup
- ✅ Proto generation works correctly across console, login, and docs
- ✅ GitHub Actions workflows pass with new configuration
- ✅ Vercel deployments work with enhanced plugin management
- ✅ Local development workflow verified and documented

This migration sets a solid foundation for future development while
maintaining backward compatibility and improving the overall developer
experience.

---------

Co-authored-by: Elio Bischof <elio@zitadel.com>

.github/workflows/build.yml

@@ -33,6 +33,12 @@ jobs:
       node_version: "20"
       buf_version: "latest"
 
+  docs:
+    uses: ./.github/workflows/docs.yml
+    with:
+      node_version: "20"
+      buf_version: "latest"
+
   version:
     uses: ./.github/workflows/version.yml
     with:
@@ -87,7 +93,7 @@ jobs:
       actions: write
       id-token: write
     with:
-      ignore-run-cache:  ${{ github.event_name == 'workflow_dispatch' || fromJSON(github.run_attempt) > 1 }}
+      ignore-run-cache: ${{ github.event_name == 'workflow_dispatch' || fromJSON(github.run_attempt) > 1 }}
       node_version: "20"
     secrets:
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
@@ -126,7 +132,16 @@ jobs:
       issues: write
       pull-requests: write
     needs:
-      [version, core-unit-test, core-integration-test, lint, container, login-container, login-quality, e2e]
+      [
+        version,
+        core-unit-test,
+        core-integration-test,
+        lint,
+        container,
+        login-container,
+        login-quality,
+        e2e,
+      ]
     if: ${{ github.event_name == 'workflow_dispatch' }}
     secrets:
       GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}

.github/workflows/compile.yml

@@ -33,96 +33,59 @@ jobs:
       matrix:
         goos: [linux, darwin, windows]
         goarch: [amd64, arm64]
-    
-    steps:
-    - 
-      uses: actions/checkout@v4
-    - 
-      uses: actions/cache/restore@v4
-      timeout-minutes: 1
-      name: restore console
-      with:
-        path: ${{ inputs.console_cache_path }}
-        key: ${{ inputs.console_cache_key }}
-        fail-on-cache-miss: true
-    - 
-      uses: actions/cache/restore@v4
-      timeout-minutes: 1
-      name: restore core
-      with:
-        path: ${{ inputs.core_cache_path }}
-        key: ${{ inputs.core_cache_key }}
-        fail-on-cache-miss: true
-    -
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: 'go.mod'
-    - 
-      name: compile
-      timeout-minutes: 5
-      run: |
-        GOOS="${{matrix.goos}}" \
-        GOARCH="${{matrix.goarch}}" \
-        VERSION="${{ inputs.version }}" \
-        COMMIT_SHA="${{ github.sha }}" \
-        make compile_pipeline
-    -
-      name: create folder
-      run: |
-        mkdir zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
-        mv zitadel zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
-        cp LICENSE zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
-        cp README.md zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
-        tar -czvf zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
-    - 
-      uses: actions/upload-artifact@v4
-      with:
-        name: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
-        path: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
 
-  login:
-    runs-on: ubuntu-latest
     steps:
-    -
-      uses: actions/checkout@v4
-    -
-      uses: depot/setup-action@v1
-    -
-      run: make login_standalone_out
-      env:
-        DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-        LOGIN_BAKE_CLI: depot bake
-        DEPOT_PROJECT_ID: w47wkxzdtw
-        NODE_VERSION: ${{ inputs.node_version }}
-    -
-      name: move files
-      run: |
-        cp login/LICENSE login/apps/login/standalone/
-        cp login/README.md login/apps/login/standalone/
-        tar -czvf login.tar.gz -C login/apps/login/standalone .
-    -
-      uses: actions/upload-artifact@v4
-      with:
-        name: login
-        path: login.tar.gz
+      - uses: actions/checkout@v4
+      - uses: actions/cache/restore@v4
+        timeout-minutes: 1
+        name: restore console
+        with:
+          path: ${{ inputs.console_cache_path }}
+          key: ${{ inputs.console_cache_key }}
+          fail-on-cache-miss: true
+      - uses: actions/cache/restore@v4
+        timeout-minutes: 1
+        name: restore core
+        with:
+          path: ${{ inputs.core_cache_path }}
+          key: ${{ inputs.core_cache_key }}
+          fail-on-cache-miss: true
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+      - name: compile
+        timeout-minutes: 5
+        run: |
+          GOOS="${{matrix.goos}}" \
+          GOARCH="${{matrix.goarch}}" \
+          VERSION="${{ inputs.version }}" \
+          COMMIT_SHA="${{ github.sha }}" \
+          make compile_pipeline
+      - name: create folder
+        run: |
+          mkdir zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
+          mv zitadel zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
+          cp LICENSE zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
+          cp README.md zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
+          tar -czvf zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
 
   checksums:
     runs-on: ubuntu-latest
-    needs: [executable, login]
+    needs: [executable]
     steps:
-    - 
-      uses: actions/download-artifact@v4
-      with:
-        path: executables
-    - 
-      name: move files one folder up
-      run: mv */*.tar.gz . && find . -type d -empty -delete
-      working-directory: executables
-    -
-      run: sha256sum * > checksums.txt
-      working-directory: executables
-    - 
-      uses: actions/upload-artifact@v4
-      with:
-        name: checksums.txt
-        path: executables/checksums.txt
+      - uses: actions/download-artifact@v4
+        with:
+          path: executables
+      - name: move files one folder up
+        run: mv */*.tar.gz . && find . -type d -empty -delete
+        working-directory: executables
+      - run: sha256sum * > checksums.txt
+        working-directory: executables
+      - uses: actions/upload-artifact@v4
+        with:
+          name: checksums.txt
+          path: executables/checksums.txt

.github/workflows/console.yml

@@ -1,6 +1,6 @@
 name: Build console
 
-on: 
+on:
   workflow_call:
     inputs:
       node_version:
@@ -13,7 +13,7 @@ on:
       cache_key:
         value: ${{ jobs.build.outputs.cache_key }}
       cache_path:
-          value: ${{ jobs.build.outputs.cache_path }}
+        value: ${{ jobs.build.outputs.cache_path }}
 
 env:
   cache_path: console/dist/console
@@ -25,38 +25,37 @@ jobs:
       cache_path: ${{ env.cache_path }}
     runs-on: ubuntu-latest
     steps:
-        - 
-          uses: actions/checkout@v4
-        - 
-          uses: actions/cache/restore@v4
-          timeout-minutes: 1
-          continue-on-error: true
-          id: cache
-          with:
-            key: console-${{ hashFiles('console', 'proto', '!console/dist') }}
-            restore-keys: |
-              console-
-            path: ${{ env.cache_path }}
-        - 
-          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-          uses: bufbuild/buf-setup-action@v1
-          with:
-            github_token: ${{ github.token }}
-            version: ${{ inputs.buf_version }}
-        - 
-          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-          uses: actions/setup-node@v4
-          with:
-            node-version: ${{ inputs.node_version }}
-            cache: 'yarn'
-            cache-dependency-path: console/yarn.lock
-        - 
-          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-          run: make console_build
-        - 
-          if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-          uses: actions/cache/save@v4
-          with:
-            path: ${{ env.cache_path }}
-            key: ${{ steps.cache.outputs.cache-primary-key }}
-        
+      - uses: actions/checkout@v4
+      - uses: actions/cache/restore@v4
+        timeout-minutes: 1
+        continue-on-error: true
+        id: cache
+        with:
+          key: console-${{ hashFiles('console', 'proto', '!console/dist') }}
+          restore-keys: |
+            console-
+          path: ${{ env.cache_path }}
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: bufbuild/buf-setup-action@v1
+        with:
+          github_token: ${{ github.token }}
+          version: ${{ inputs.buf_version }}
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: pnpm/action-setup@v4
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node_version }}
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        name: Install dependencies
+        run: pnpm install
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        name: Build console with Turbo
+        run: pnpm turbo build --filter=./console
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ env.cache_path }}
+          key: ${{ steps.cache.outputs.cache-primary-key }}

.github/workflows/docs.yml

@@ -0,0 +1,61 @@
+name: Build docs
+
+on:
+  workflow_call:
+    inputs:
+      node_version:
+        required: true
+        type: string
+      buf_version:
+        required: true
+        type: string
+    outputs:
+      cache_key:
+        value: ${{ jobs.build.outputs.cache_key }}
+      cache_path:
+        value: ${{ jobs.build.outputs.cache_path }}
+
+env:
+  cache_path: docs/build
+
+jobs:
+  build:
+    outputs:
+      cache_key: ${{ steps.cache.outputs.cache-primary-key }}
+      cache_path: ${{ env.cache_path }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/cache/restore@v4
+        timeout-minutes: 1
+        continue-on-error: true
+        id: cache
+        with:
+          key: docs-${{ hashFiles('docs', 'proto', '!docs/build', '!docs/node_modules', '!docs/protoc-gen-connect-openapi') }}
+          restore-keys: |
+            docs-
+          path: ${{ env.cache_path }}
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: bufbuild/buf-setup-action@v1
+        with:
+          github_token: ${{ github.token }}
+          version: ${{ inputs.buf_version }}
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: pnpm/action-setup@v4
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node_version }}
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        name: Install dependencies
+        run: pnpm install
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        name: Build docs with Turbo
+        run: pnpm turbo build --filter=./docs
+      - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ env.cache_path }}
+          key: ${{ steps.cache.outputs.cache-primary-key }}

.github/workflows/e2e.yml

@@ -12,44 +12,47 @@ jobs:
         browser: [firefox, chrome]
     runs-on: ubuntu-latest
     steps:
-      - 
-        name: Checkout Repository
+      - name: Checkout Repository
         uses: actions/checkout@v4
-      -
-        uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v4
         with:
           path: .artifacts
           name: zitadel-linux-amd64
-      -
-        name: Unpack executable
+      - name: Unpack executable
         run: |
           tar -xvf .artifacts/zitadel-linux-amd64.tar.gz
           mv zitadel-linux-amd64/zitadel ./zitadel
-      -
-        name: Set up QEMU
+      - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
+      - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-      -
-        name: Start DB and ZITADEL
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Install dependencies
+        run: pnpm install
+      - name: Install Cypress binary
+        run: cd ./e2e && pnpm exec cypress install
+      - name: Start DB and ZITADEL
         run: |
           cd ./e2e
           ZITADEL_IMAGE=zitadel:local docker compose up --detach --wait
-      - 
-        name: Cypress run
+      - name: Cypress run
         uses: cypress-io/github-action@v6
         env:
           CYPRESS_BASE_URL: http://localhost:8080/ui/console
           CYPRESS_WEBHOOK_HANDLER_HOST: host.docker.internal
-          CYPRESS_DATABASE_CONNECTION_URL: 'postgresql://root@localhost:26257/zitadel'
+          CYPRESS_DATABASE_CONNECTION_URL: "postgresql://root@localhost:26257/zitadel"
           CYPRESS_BACKEND_URL: http://localhost:8080
         with:
           working-directory: e2e
           browser: ${{ matrix.browser }}
           config-file: cypress.config.ts
-      - 
-        uses: actions/upload-artifact@v4
+          install: false
+      - uses: actions/upload-artifact@v4
         if: always()
         with:
           name: production-tests-${{ matrix.browser }}

.github/workflows/lint.yml

@@ -20,7 +20,6 @@ on:
         type: string
 
 jobs:
-
   lint-skip:
     name: lint skip
     runs-on: ubuntu-latest
@@ -36,64 +35,53 @@ jobs:
     continue-on-error: true
     if: ${{ github.event_name == 'pull_request' }}
     steps:
-    - 
-      uses: actions/checkout@v4
-    - 
-      uses: bufbuild/buf-setup-action@v1
-      with:
-        version: ${{ inputs.buf_version }}
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - 
-      name: lint
-      uses: bufbuild/buf-lint-action@v1
-    - 
-      uses: bufbuild/buf-breaking-action@v1
-      with:
-        against: "https://github.com/${{ github.repository }}.git#branch=${{ github.base_ref }}"
+      - uses: actions/checkout@v4
+      - uses: bufbuild/buf-setup-action@v1
+        with:
+          version: ${{ inputs.buf_version }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: lint
+        uses: bufbuild/buf-lint-action@v1
+      - uses: bufbuild/buf-breaking-action@v1
+        with:
+          against: "https://github.com/${{ github.repository }}.git#branch=${{ github.base_ref }}"
 
   console:
     if: ${{ github.event_name == 'pull_request' }}
     name: console
     runs-on: ubuntu-latest
     steps:
-    -
-      name: Checkout
-      uses: actions/checkout@v4
-    -
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ inputs.node_version }}
-        cache: 'yarn'
-        cache-dependency-path: console/yarn.lock
-    -
-      run: cd console && yarn install
-    -
-      name: lint
-      run: make console_lint
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node_version }}
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+      - run: pnpm install --filter=console
+      - name: lint
+        run: make console_lint
 
   core:
     name: core
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'pull_request' }}
     steps:
-    -
-      name: Checkout
-      uses: actions/checkout@v4
-    - 
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: 'go.mod'
-    - 
-      uses: actions/cache/restore@v4
-      timeout-minutes: 1
-      name: restore core
-      with:
-        path: ${{ inputs.core_cache_path }}
-        key: ${{ inputs.core_cache_key }}
-        fail-on-cache-miss: true
-    - 
-      uses: golangci/golangci-lint-action@v6
-      with:
-        version: ${{ inputs.go_lint_version }}
-        github-token: ${{ github.token }}
-        only-new-issues: true
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+      - uses: actions/cache/restore@v4
+        timeout-minutes: 1
+        name: restore core
+        with:
+          path: ${{ inputs.core_cache_path }}
+          key: ${{ inputs.core_cache_key }}
+          fail-on-cache-miss: true
+      - uses: golangci/golangci-lint-action@v6
+        with:
+          version: ${{ inputs.go_lint_version }}
+          github-token: ${{ github.token }}
+          only-new-issues: true

.github/workflows/login-quality.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       ignore-run-cache:
-        description: 'Ignore run caches'
+        description: "Ignore run caches"
         type: boolean
         required: true
       node_version:
@@ -44,7 +44,16 @@ jobs:
         run: |
           tar -xvf .artifacts/zitadel-linux-amd64.tar.gz
           mv zitadel-linux-amd64/zitadel ./zitadel
-      - run: make login_quality
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node_version }}
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Install dependencies
+        run: pnpm install
+      - name: Run login quality checks with Turbo
+        run: pnpm turbo test:unit --filter=@zitadel/login
         env:
           DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
           LOGIN_BAKE_CLI: depot bake