Skip to content

chore: consolidate the repository into a pnpm workspace and move typeorm into packages - #12854

Merged
michaelbromley merged 18 commits into
masterfrom
assess-monorepo-gap
Sep 18, 2026
Merged

chore: consolidate the repository into a pnpm workspace and move typeorm into packages#12854
michaelbromley merged 18 commits into
masterfrom
assess-monorepo-gap

Conversation

@michaelbromley

@michaelbromley michaelbromley commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What this does

Turns the repository into a real pnpm workspace and moves the typeorm package out of the repository root into packages/typeorm, so that every published package lives in one place and publishing more than one of them stops being a manual, per-package affair.

Before this, the repo already shipped three packages (typeorm, @typeorm/codemod, @typeorm/legacy-naming-strategies) but was not a monorepo in any technical sense: no pnpm-workspace.yaml, a separate pnpm-lock.yaml per sub-package, a root tsconfig.json that excluded packages, and a root eslint config that ignored packages/**. Every workflow enumerated the packages by hand.

@typeorm/legacy-naming-strategies also declared "typeorm": "1.1.1", so it tested against the published package rather than this repository's source. A breaking change to core could not be caught by it.

Layout

Path Package
packages/typeorm typeorm
packages/codemod @typeorm/codemod
packages/legacy-naming-strategies @typeorm/legacy-naming-strategies

The root keeps docs/, docker/, docker-compose.yml, resources/, the markdown files and the shared tooling config. A new private root package.json holds the workspace and delegates compile, package, test and typecheck to packages/typeorm, so the familiar root commands still work.

For anyone with an open pull request

Everything moved as a pure rename, no file contents changed, so git records all 3292 renames at 100% similarity and can usually replay a branch across the move on its own.

There is one catch worth knowing: git's default rename limit is well below the number of files that moved, and without raising it git sees deletes plus adds and every touched file conflicts. So the plain instruction is:

git fetch origin
git -c merge.renameLimit=999999 -c diff.renameLimit=999999 rebase origin/master

scripts/migrate-pr-to-packages-layout.md documents this with a path mapping table, a scripts/migrate-pr-to-packages-layout.sh helper that backs your branch up and does the rebase for you (plus a --replay fallback that rewrites the paths of your net diff when the history is not worth saving), and a prompt you can hand to a coding agent. Both script modes were tested against a simulated pull request branch based on the current master.

Changes

  • Adds pnpm-workspace.yaml covering packages/* and playground. docs is excluded; it is a Docusaurus site with its own dependency tree and deploy workflow.
  • Deletes the two sub-package lockfiles. One root lockfile now covers every project.
  • Moves src, test, extra, package.json, gulpfile.ts, the tsconfigs, .mocharc.json, .c8rc.json, stryker.config.json, ormconfig.sample.json, sonar-project.properties and eslint.config.mjs into packages/typeorm.
  • Splits the root manifest: the published fields stay with the package, the workspace settings and shared tooling move to a new private root manifest.
  • Adds publishConfig.directory pointing at build/package. The package manifest describes the built layout (main is ./index.js, which only exists after a build), so a plain workspace link does not resolve; this points pnpm at the build output instead. copyPackageFile strips the entry so it never reaches the published package.
  • Switches @typeorm/legacy-naming-strategies and playground to "typeorm": "workspace:*".
  • Updates the five workflows and two composite actions for the new paths. The core test workflows now default to working-directory: packages/typeorm; the docker compose steps override back to the repository root.
  • Removes the per-package pnpm install steps. A single install covers the workspace, and root lint now fans out with pnpm -r.
  • Builds the core package in tests-legacy-naming-strategies, and adds the core sources to that job's path filter so a change under src/ actually runs it.
  • Adds pnpm-lock.yaml to the path filters. With the sub-package lockfiles gone, a dependency-only change would otherwise have matched no filter and run no tests.
  • Publishes LICENSE with the package (see below).
  • Marks playground private, adds dist/ to .prettierignore.

The published package

The built tree was compared file by file against a pre-move baseline built from master in a separate worktree:

2949 files, 0 added, 0 removed, 0 with differing content. Byte-identical, by SHA-256 per file, sourcemaps included.

One deliberate change to the published artifact. The real [email protected] tarball on npm contains no LICENSE file, despite the manifest declaring "license": "MIT". Adding pnpm-workspace.yaml made pnpm start copying the root LICENSE into the tarball as a side effect (2948 files to 2949). Rather than leave that to a pnpm heuristic, gulpfile.ts now copies LICENSE explicitly the same way it already copies README.md. Verified deterministic: the tarball is 2949 files with the licence whether or not the workspace file is present, and the only difference against the current npm artifact is that added file.

The resolved dependency graph for core is unchanged: the root importer has zero differences against master, and no package was removed from the graph.

Verification

Beyond the suites, the artifact was published to a local verdaccio registry with the same command CI runs, and installed into clean projects:

  • The registry manifest contains no publishConfig, and no build/ directory leaks into the tarball.
  • npm, pnpm and yarn each installed it and passed: CommonJS require, ESM named and default imports, the deep subpath typeorm/util/StringUtils, a sql.js DataSource round-trip and a QueryBuilder query.
  • All three CLI bins link and cli.js version runs.
  • TypeScript with strict: true and skipLibCheck: false type-checks against decorators and Repository<T> generics.
  • All 22 browser-map targets, browser/index.js, index.mjs, both shims and the react-native condition are present.
  • The nightly path (pnpm version inside the build directory, then publish) works inside a workspace.
  • @typeorm/codemod publishes, installs and runs, with no unresolved workspace: specifier.
  • After the move: core builds, a real sqlite functional suite passes, ormconfig.json still resolves from its new location, and @typeorm/codemod (376) and @typeorm/legacy-naming-strategies (4) pass.

The source linking was confirmed to work by renaming hash in src/util/StringUtils.ts, rebuilding, and watching @typeorm/legacy-naming-strategies fail with TS2305. Under the previous registry pin that rename passed CI.

Known follow-ups, not in this PR

  • Publish ordering. workspace:* resolves its published version from the built package.json, which the nightly step rewrites in place. Packing @typeorm/legacy-naming-strategies after a nightly bump yields devDependencies.typeorm: "1.1.1-nightly.<date>". Inert today, since that package is only a devDependency and nothing in CI publishes it. It stops being inert if that package is ever published from CI, or if any package uses workspace:* in dependencies or peerDependencies.
  • @typeorm/legacy-naming-strategies is on npm but no workflow publishes it. 1.0.0 was pushed by hand.
  • Duplicated per-package config. Each package still carries its own near-identical tsconfig.json, .mocharc.json and .c8rc.json. Hoisting those is the obvious next step.
  • tests-legacy-naming-strategies runs a full core build. The build job produces build/compiled rather than build/package, so its artifact cannot be reused as-is without changing what the Linux and Windows jobs consume.
  • Trusted Publishing and --provenance are untested. A local registry cannot exercise OIDC. The publish command is unchanged apart from its working directory, but a nightly dev run would confirm it before a stable release.
  • Sonar coverage mapping now runs with projectBaseDir: packages/typeorm. The paths inside the uploaded lcov reports should line up, but only a real run on this PR will confirm it.

CI results on this branch

Every database suite passes on Node 20 and 24 plus Windows: Oracle, SAP HANA, Spanner, MSSQL, MongoDB, CockroachDB, Postgres 14 and 17, MySQL/MariaDB, sqljs and better-sqlite3. build, format, preview, tests-codemod and tests-legacy-naming-strategies all pass. Sonar reports new_coverage at 74.5% against a 70% threshold, which confirms coverage reporting still maps correctly under projectBaseDir: packages/typeorm.

Three checks failed. One was a real bug in this branch, now fixed; two are artifacts of the move that need a maintainer decision.

lint (fixed). @typeorm/legacy-naming-strategies is type-checked against typeorm, which resolves to build/package, so eslint reported six no-unsafe-* errors when the core package had not been built. Reproduced locally (exit 1 without the build, exit 0 with it) and fixed by building before linting, the same way tests-legacy-naming-strategies already does.

Sonar quality gate (needs a decision). The gate fails on one condition only: new_duplicated_lines_density at 8.9% against a 3% threshold. Reliability, security, maintainability, coverage and security hotspots all pass. The cause is that Sonar sees new_lines = 290101, because every file has a new path, so the whole codebase counts as new code and its pre-existing duplication (25931 lines, mostly the driver QueryRunner classes) is measured against the new-code gate. The same duplication exists on master today. It will re-baseline once this lands. I have not touched sonar.cpd.exclusions or the gate, since loosening either to get one PR through seems like the wrong trade.

CodeQL (needs a decision). One new high-severity alert, js/weak-cryptographic-algorithm at packages/typeorm/src/platform/PlatformTools.ts:102. It is crypto.createHash("sha1") used to build internal index and alias names, documented in place as not for cryptographic security, and introduced in #12648. Alert #95 is the identical finding at the old path src/platform/PlatformTools.ts and is already dismissed as "won't fix"; the dismissal does not follow a rename, so CodeQL raised it again as #97. It needs the same dismissal.

This is deliberately scoped to layout and plumbing. It does not adopt Nx or Turborepo, and does not add a release tool. Splitting drivers into separate packages (#2479) and replacing gulp (#11691) remain separate conversations.

@pkg-pr-new

pkg-pr-new Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

  • typeorm-sql-js-example

    npm i https://pkg.pr.new/@typeorm/codemod@12854

    npm i https://pkg.pr.new/typeorm@12854

commit: 31a2ed8

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying typeorm with  Cloudflare Pages  Cloudflare Pages

Latest commit: d0f9d05
Status:🚫  Build failed.

View logs

@michaelbromley michaelbromley changed the title chore: consolidate the repository into a pnpm workspace chore: consolidate the repository into a pnpm workspace and move typeorm into packages Sep 9, 2026
@michaelbromley
michaelbromley marked this pull request as ready for review September 10, 2026 05:40
@michaelbromley michaelbromley mentioned this pull request Sep 10, 2026
Merged
@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (18) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

⚠️ 17 lower-priority findings omitted to fit the comment size limit; re-run the review or view the findings in the Qodo portal.

Grey Divider


Action required

1. Legacy nightly releases stop publishing 🐞 Bug ≡ Correctness
Description 
The publish workflow still checks out the unmigrated v0 ref but now changes into
packages/typeorm/build/package for its nightly version step. Scheduled or manually dispatched v0
runs therefore enter a directory absent from that checkout before they can publish the legacy
nightly package.
Code

.github/workflows/publish-package.yml[164]

+        working-directory: packages/typeorm/build/package
Evidence 
The matrix explicitly schedules a v0 checkout, then uses the newly added monorepo-only directory
for the nightly version step. The repository root is now a private workspace while the migrated
package exists only under packages/typeorm, confirming that this path cannot exist on the
pre-migration branch.

.github/workflows/publish-package.yml[62-64]
.github/workflows/publish-package.yml[96-99]
.github/workflows/publish-package.yml[156-169]
package.json[1-5]
packages/typeorm/package.json[1-3]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The publish matrix checks out the old `v0` branch, whose package and build output remain at the repository root. The new `packages/typeorm/build/package` working directory only exists on the migrated branch, so legacy nightly publishing fails.
Fix Focus Areas
- .github/workflows/publish-package.yml[159-169]
Recommended Fix
Choose the package working directory based on the checked-out matrix ref: retain `build/package` for `v0` and use `packages/typeorm/build/package` for migrated refs. Apply the same conditional path to both the nightly version and publish steps.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. Core package changes can merge untested 🐞 Bug ≡ Correctness
Description 
The package-json source filter still tracks only the repository-root package.json, while the
published core manifest now lives at packages/typeorm/package.json. A change limited to that
manifest skips build, Linux and Windows tests, and coverage, while all-passed accepts the skipped
jobs because it fails only when a dependency reports failure.
Code

.github/workflows/tests.yml[R40-43]

+              - packages/typeorm/extra/**/*.js
+              - packages/typeorm/src/**/*.ts
+              - packages/typeorm/gulpfile.ts
+              - packages/typeorm/tsconfig.json
Evidence 
The source filter's only manifest path is root-relative, whereas the core manifest is now
package-local. Every core verification job is gated by the derived src-or-tests filter, and the
final gate intentionally treats skipped jobs as non-failures.

.github/workflows/tests.yml[25-45]
packages/typeorm/package.json[2-4]
.github/workflows/tests.yml[80-93]
.github/workflows/tests.yml[115-129]
.github/workflows/tests.yml[172-207]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The source filter no longer includes the core package manifest after the package moved from the repository root to `packages/typeorm`. As a result, dependency, export, script, or packaging changes made only in that manifest do not run the core build and test matrix.
## Fix Focus Areas
- .github/workflows/tests.yml[25-45]
## Recommended Fix
Add `packages/typeorm/package.json` to the `package-json` or `src` filter used by `src-or-tests`, so core manifest-only changes trigger build, platform tests, and coverage.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. Legacy package changes skip linting 🐞 Bug ≡ Correctness
Description 
lint now delegates to pnpm -r run lint, but the workflow's lint filter still covers the core
and codemod trees rather than packages/legacy-naming-strategies/**/*. A change confined to that
package's source or manifest skips the lint job even though the recursive command would lint it, so
violations can pass the final gate.
Code

package.json[17]

+    "lint": "pnpm -r run lint",
Evidence 
The new root script recursively runs each workspace package's lint script, and the legacy package
defines such a script. However, the CI lint filter includes core inputs, package ESLint
configurations, and the complete codemod tree but not ordinary legacy naming-strategy files; the
final gate accepts skipped jobs unless another dependency reports failure.

package.json[15-18]
packages/legacy-naming-strategies/package.json[32-35]
.github/workflows/tests.yml[60-72]
.github/workflows/tests.yml[194-209]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The root lint command now recursively lints workspace packages, but the CI lint path filter does not react to ordinary changes under the legacy naming-strategies package. Consequently, changes to that package can merge without running its lint script.
## Fix Focus Areas
- .github/workflows/tests.yml[60-64]
- package.json[15-18]
- packages/legacy-naming-strategies/package.json[32-35]
## Recommended Fix
Add `packages/legacy-naming-strategies/**/*` to the `lint` change filter so every change that can affect that package's lint result schedules the recursive lint job.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

View action required (9)
4. Legacy nightly releases stop publishing 🐞 Bug ≡ Correctness
Description 
The publish workflow still checks out the unmigrated v0 ref but now changes into
packages/typeorm/build/package for its nightly version step. Scheduled or manually dispatched v0
runs therefore enter a directory absent from that checkout before they can publish the legacy
nightly package.
Code

.github/workflows/publish-package.yml[164]

+        working-directory: packages/typeorm/build/package
Evidence 
The matrix explicitly schedules a v0 checkout, then uses the newly added monorepo-only directory
for the nightly version step. The repository root is now a private workspace while the migrated
package exists only under packages/typeorm, confirming that this path cannot exist on the
pre-migration branch.

.github/workflows/publish-package.yml[62-64]
.github/workflows/publish-package.yml[96-99]
.github/workflows/publish-package.yml[156-169]
package.json[1-5]
packages/typeorm/package.json[1-3]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The publish matrix checks out the old `v0` branch, whose package and build output remain at the repository root. The new `packages/typeorm/build/package` working directory only exists on the migrated branch, so legacy nightly publishing fails.
Fix Focus Areas
- .github/workflows/publish-package.yml[159-169]
Recommended Fix
Choose the package working directory based on the checked-out matrix ref: retain `build/package` for `v0` and use `packages/typeorm/build/package` for migrated refs. Apply the same conditional path to both the nightly version and publish steps.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

5. Core package changes can merge untested 🐞 Bug ≡ Correctness
Description 
The package-json source filter still tracks only the repository-root package.json, while the
published core manifest now lives at packages/typeorm/package.json. A change limited to that
manifest skips build, Linux and Windows tests, and coverage, while all-passed accepts the skipped
jobs because it fails only when a dependency reports failure.
Code

.github/workflows/tests.yml[R40-43]

+              - packages/typeorm/extra/**/*.js
+              - packages/typeorm/src/**/*.ts
+              - packages/typeorm/gulpfile.ts
+              - packages/typeorm/tsconfig.json
Evidence 
The source filter's only manifest path is root-relative, whereas the core manifest is now
package-local. Every core verification job is gated by the derived src-or-tests filter, and the
final gate intentionally treats skipped jobs as non-failures.

.github/workflows/tests.yml[25-45]
packages/typeorm/package.json[2-4]
.github/workflows/tests.yml[80-93]
.github/workflows/tests.yml[115-129]
.github/workflows/tests.yml[172-207]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The source filter no longer includes the core package manifest after the package moved from the repository root to `packages/typeorm`. As a result, dependency, export, script, or packaging changes made only in that manifest do not run the core build and test matrix.
## Fix Focus Areas
- .github/workflows/tests.yml[25-45]
## Recommended Fix
Add `packages/typeorm/package.json` to the `package-json` or `src` filter used by `src-or-tests`, so core manifest-only changes trigger build, platform tests, and coverage.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

6. Legacy package changes skip linting 🐞 Bug ≡ Correctness
Description 
lint now delegates to pnpm -r run lint, but the workflow's lint filter still covers the core
and codemod trees rather than packages/legacy-naming-strategies/**/*. A change confined to that
package's source or manifest skips the lint job even though the recursive command would lint it, so
violations can pass the final gate.
Code

package.json[17]

+    "lint": "pnpm -r run lint",
Evidence 
The new root script recursively runs each workspace package's lint script, and the legacy package
defines such a script. However, the CI lint filter includes core inputs, package ESLint
configurations, and the complete codemod tree but not ordinary legacy naming-strategy files; the
final gate accepts skipped jobs unless another dependency reports failure.

package.json[15-18]
packages/legacy-naming-strategies/package.json[32-35]
.github/workflows/tests.yml[60-72]
.github/workflows/tests.yml[194-209]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The root lint command now recursively lints workspace packages, but the CI lint path filter does not react to ordinary changes under the legacy naming-strategies package. Consequently, changes to that package can merge without running its lint script.
## Fix Focus Areas
- .github/workflows/tests.yml[60-64]
- package.json[15-18]
- packages/legacy-naming-strategies/package.json[32-35]
## Recommended Fix
Add `packages/legacy-naming-strategies/**/*` to the `lint` change filter so every change that can affect that package's lint result schedules the recursive lint job.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

7. Legacy nightly releases stop publishing 🐞 Bug ≡ Correctness
Description 
The publish workflow still checks out the unmigrated v0 ref but now changes into
packages/typeorm/build/package for its nightly version step. Scheduled or manually dispatched v0
runs therefore enter a directory absent from that checkout before they can publish the legacy
nightly package.
Code

.github/workflows/publish-package.yml[164]

+        working-directory: packages/typeorm/build/package
Evidence 
The matrix explicitly schedules a v0 checkout, then uses the newly added monorepo-only directory
for the nightly version step. The repository root is now a private workspace while the migrated
package exists only under packages/typeorm, confirming that this path cannot exist on the
pre-migration branch.

.github/workflows/publish-package.yml[62-64]
.github/workflows/publish-package.yml[96-99]
.github/workflows/publish-package.yml[156-169]
package.json[1-5]
packages/typeorm/package.json[1-3]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The publish matrix checks out the old `v0` branch, whose package and build output remain at the repository root. The new `packages/typeorm/build/package` working directory only exists on the migrated branch, so legacy nightly publishing fails.
Fix Focus Areas
- .github/workflows/publish-package.yml[159-169]
Recommended Fix
Choose the package working directory based on the checked-out matrix ref: retain `build/package` for `v0` and use `packages/typeorm/build/package` for migrated refs. Apply the same conditional path to both the nightly version and publish steps.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

8. Core package changes can merge untested 🐞 Bug ≡ Correctness
Description 
The package-json source filter still tracks only the repository-root package.json, while the
published core manifest now lives at packages/typeorm/package.json. A change limited to that
manifest skips build, Linux and Windows tests, and coverage, while all-passed accepts the skipped
jobs because it fails only when a dependency reports failure.
Code

.github/workflows/tests.yml[R40-43]

+              - packages/typeorm/extra/**/*.js
+              - packages/typeorm/src/**/*.ts
+              - packages/typeorm/gulpfile.ts
+              - packages/typeorm/tsconfig.json
Evidence 
The source filter's only manifest path is root-relative, whereas the core manifest is now
package-local. Every core verification job is gated by the derived src-or-tests filter, and the
final gate intentionally treats skipped jobs as non-failures.

.github/workflows/tests.yml[25-45]
packages/typeorm/package.json[2-4]
.github/workflows/tests.yml[80-93]
.github/workflows/tests.yml[115-129]
.github/workflows/tests.yml[172-207]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The source filter no longer includes the core package manifest after the package moved from the repository root to `packages/typeorm`. As a result, dependency, export, script, or packaging changes made only in that manifest do not run the core build and test matrix.
## Fix Focus Areas
- .github/workflows/tests.yml[25-45]
## Recommended Fix
Add `packages/typeorm/package.json` to the `package-json` or `src` filter used by `src-or-tests`, so core manifest-only changes trigger build, platform tests, and coverage.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

9. Readers hit a broken event link 📘 Rule violation ≡ Correctness
Description 
docs/docs/listeners-and-subscribers.md still links the event interfaces under the removed
root-level src/subscriber/event path. After the package move documented at DEVELOPER.md:49-55,
readers following that public reference reach a 404 instead of the interfaces now under
packages/typeorm/src/subscriber/event.
Code

DEVELOPER.md[53]

+| `packages/typeorm`                  | `typeorm`                           |
Evidence 
Compliance rule 2 requires documentation to reflect user-facing changes. The PR documents that
TypeORM moved under packages/typeorm, while the public subscriber documentation still points to
the former root-level source directory.

Rule 2: Docs updated for user-facing changes
DEVELOPER.md[49-55]
docs/docs/listeners-and-subscribers.md[381-381]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The public listeners and subscribers documentation still links to the event interfaces at their former root-level source path, which no longer exists after the package move.
## Fix Focus Areas
- docs/docs/listeners-and-subscribers.md[381-381]
## Recommended Fix
Update the GitHub source link to `https://github.com/typeorm/typeorm/tree/master/packages/typeorm/src/subscriber/event` so it resolves to the interfaces in the new package layout.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

10. Legacy nightly releases stop publishing 🐞 Bug ≡ Correctness
Description 
The publish workflow still checks out the unmigrated v0 ref but now changes into
packages/typeorm/build/package for its nightly version step. Scheduled or manually dispatched v0
runs therefore enter a directory absent from that checkout before they can publish the legacy
nightly package.
Code

.github/workflows/publish-package.yml[164]

+        working-directory: packages/typeorm/build/package
Evidence 
The matrix explicitly schedules a v0 checkout, then uses the newly added monorepo-only directory
for the nightly version step. The repository root is now a private workspace while the migrated
package exists only under packages/typeorm, confirming that this path cannot exist on the
pre-migration branch.

.github/workflows/publish-package.yml[62-64]
.github/workflows/publish-package.yml[96-99]
.github/workflows/publish-package.yml[156-169]
package.json[1-5]
packages/typeorm/package.json[1-3]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The publish matrix checks out the old `v0` branch, whose package and build output remain at the repository root. The new `packages/typeorm/build/package` working directory only exists on the migrated branch, so legacy nightly publishing fails.
Fix Focus Areas
- .github/workflows/publish-package.yml[159-169]
Recommended Fix
Choose the package working directory based on the checked-out matrix ref: retain `build/package` for `v0` and use `packages/typeorm/build/package` for migrated refs. Apply the same conditional path to both the nightly version and publish steps.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

11. Core package changes can merge untested 🐞 Bug ≡ Correctness
Description 
The package-json source filter still tracks only the repository-root package.json, while the
published core manifest now lives at packages/typeorm/package.json. A change limited to that
manifest skips build, Linux and Windows tests, and coverage, while all-passed accepts the skipped
jobs because it fails only when a dependency reports failure.
Code

.github/workflows/tests.yml[R40-43]

+              - packages/typeorm/extra/**/*.js
+              - packages/typeorm/src/**/*.ts
+              - packages/typeorm/gulpfile.ts
+              - packages/typeorm/tsconfig.json
Evidence 
The source filter's only manifest path is root-relative, whereas the core manifest is now
package-local. Every core verification job is gated by the derived src-or-tests filter, and the
final gate intentionally treats skipped jobs as non-failures.

.github/workflows/tests.yml[25-45]
packages/typeorm/package.json[2-4]
.github/workflows/tests.yml[80-93]
.github/workflows/tests.yml[115-129]
.github/workflows/tests.yml[172-207]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The source filter no longer includes the core package manifest after the package moved from the repository root to `packages/typeorm`. As a result, dependency, export, script, or packaging changes made only in that manifest do not run the core build and test matrix.
## Fix Focus Areas
- .github/workflows/tests.yml[25-45]
## Recommended Fix
Add `packages/typeorm/package.json` to the `package-json` or `src` filter used by `src-or-tests`, so core manifest-only changes trigger build, platform tests, and coverage.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

12. Legacy package changes skip linting 🐞 Bug ≡ Correctness
Description 
lint now delegates to pnpm -r run lint, but the workflow's lint filter still covers the core
and codemod trees rather than packages/legacy-naming-strategies/**/*. A change confined to that
package's source or manifest skips the lint job even though the recursive command would lint it, so
violations can pass the final gate.
Code

package.json[17]

+    "lint": "pnpm -r run lint",
Evidence 
The new root script recursively runs each workspace package's lint script, and the legacy package
defines such a script. However, the CI lint filter includes core inputs, package ESLint
configurations, and the complete codemod tree but not ordinary legacy naming-strategy files; the
final gate accepts skipped jobs unless another dependency reports failure.

package.json[15-18]
packages/legacy-naming-strategies/package.json[32-35]
.github/workflows/tests.yml[60-72]
.github/workflows/tests.yml[194-209]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The root lint command now recursively lints workspace packages, but the CI lint path filter does not react to ordinary changes under the legacy naming-strategies package. Consequently, changes to that package can merge without running its lint script.
## Fix Focus Areas
- .github/workflows/tests.yml[60-64]
- package.json[15-18]
- packages/legacy-naming-strategies/package.json[32-35]
## Recommended Fix
Add `packages/legacy-naming-strategies/**/*` to the `lint` change filter so every change that can affect that package's lint result schedules the recursive lint job.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Remediation recommended

13. Contributors pack the wrong project 🐞 Bug ⚙ Maintainability
Description 
The bare pnpm pack command in .github/copilot-instructions.md has no workspace filter or
directory change, so it packs the private typeorm-monorepo root manifest rather than the generated
TypeORM package. Following the documented root-level command therefore produces a root-project
tarball instead of the claimed TypeORM artifact.
Code

.github/copilot-instructions.md[197]

+- **Pack**: `pnpm pack` - Creates `.tgz` file in `packages/typeorm/build/`
Evidence 
The instruction explicitly establishes the repository root as the working location for its commands,
while the root manifest has a different private package identity and provides no pack delegation.
The build task writes the publishable package manifest under build/package, so that directory must
be the pack target.

.github/copilot-instructions.md[19-21]
package.json[1-24]
packages/typeorm/gulpfile.ts[95-122]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The documented pack command runs at the workspace root, where `package.json` describes the private `typeorm-monorepo` project rather than the generated `typeorm` package.
Fix Focus Areas
- .github/copilot-instructions.md[195-197]
Recommended Fix
Replace the bare root-level command with `cd packages/typeorm/build/package && pnpm pack` (or an equivalent explicit pnpm directory option), and state that the archive is created in that generated package directory.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

14. Package archives are reported in wrong folder 🐞 Bug ⚙ Maintainability
Description 
DEVELOPER.md changes into packages/typeorm/build/package before running pnpm pack but states
that the resulting archive is in its parent packages/typeorm/build directory. Contributors
following the stated output path cannot find the archive created by that command.
Code

DEVELOPER.md[109]

+This command will generate a distribution package tar in the `packages/typeorm/build` directory (`packages/typeorm/build/typeorm-x.x.x.tgz`).
Evidence 
The preceding changed command establishes build/package as the pack working directory, and the
packaging task writes the generated package manifest to that same directory. The newly added
output-path sentence instead names its parent, contradicting the command's target.

DEVELOPER.md[103-110]
packages/typeorm/gulpfile.ts[95-122]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The pack command executes from `packages/typeorm/build/package`, but the subsequent text identifies its parent directory as the archive location.
Fix Focus Areas
- DEVELOPER.md[103-110]
Recommended Fix
State that `pnpm pack` writes `typeorm-x.x.x.tgz` in `packages/typeorm/build/package`, or change the command to use an explicit destination that matches the documented location.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

15. Mutation reports are no longer uploaded 🐞 Bug ◔ Observability
Description 
The new workflow default runs Stryker from packages/typeorm, while the artifact action still
searches for ./reports/mutation/mutation.html from the repository workspace. Each mutation run
writes its HTML report below the package directory, causing artifact upload to find no report and
fail.
Code

.github/workflows/mutation-test.yml[R8-10]

+defaults:
+  run:
+    working-directory: packages/typeorm
Evidence 
The added default applies to the Stryker run step, and Stryker's configured HTML reporter uses its
standard report location relative to that run directory. The subsequent JavaScript action has no
run-directory setting and still names the former root-level report path.

.github/workflows/mutation-test.yml[8-10]
.github/workflows/mutation-test.yml[53-71]
packages/typeorm/stryker.config.json[13-16]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The mutation workflow now runs commands in `packages/typeorm`, so Stryker creates its default report below that directory. The artifact upload action remains root-relative and no longer finds the generated HTML report.
Fix Focus Areas
- .github/workflows/mutation-test.yml[8-10]
Recommended Fix
Change the artifact path to `packages/typeorm/reports/mutation/mutation.html`, or add an equivalent root-working-directory arrangement that makes the generated and uploaded paths agree.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

View review recommended (4)
16. Workspace edits can bypass codemod tests 🐞 Bug ≡ Correctness
Description 
The codemod filter adds pnpm-lock.yaml but omits pnpm-workspace.yaml, even though the codemod
test job installs and executes within that workspace. Changes to workspace membership or package
resolution can therefore alter whether the codemod package is installed without running
tests-codemod, and the final gate accepts that job as skipped.
Code

.github/workflows/tests.yml[R65-66]

+              - pnpm-lock.yaml
           - packages/codemod/**/*
Evidence 
The workspace file defines which package directories are installed, but the codemod filter has no
path for it. The codemod job invokes the shared root installer before running its package-local test
command, so its execution depends on the omitted workspace configuration.

.github/workflows/tests.yml[64-70]
pnpm-workspace.yaml[4-14]
.github/workflows/tests.yml[133-149]
.github/actions/setup-node/action.yml[22-29]
.github/workflows/tests.yml[192-207]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The codemod path filter does not include the workspace definition even though the codemod test job relies on the root workspace installation. Workspace configuration changes can therefore bypass that package's test job.
## Fix Focus Areas
- .github/workflows/tests.yml[64-70]
## Recommended Fix
Add `pnpm-workspace.yaml` to the `codemod` filter. Also include any other root workspace configuration file that can change codemod installation or dependency resolution.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

17. Fresh workspace linting fails 🐞 Bug ≡ Correctness
Description 
publishConfig.directory makes the workspace:* TypeORM dependencies resolve to build/package,
but that directory and its package.json are created only by the separate gulp package task.
After a clean install, root pnpm lint recursively lints the legacy package, whose type-aware
linting imports typeorm, so it fails unless the user has already run pnpm run package.
Code

packages/typeorm/package.json[R213-215]

+  "publishConfig": {
+    "directory": "build/package"
+  },
Evidence 
The generated lockfile links both workspace consumers to the build output, while TypeORM's ordinary
compile output is a different directory and only the package task writes
build/package/package.json. The CI lint job has already needed to add an explicit package step
before invoking root lint, demonstrating the missing prerequisite in the root command itself.

pnpm-lock.yaml[138-140]
pnpm-lock.yaml[322-334]
packages/typeorm/gulpfile.ts[95-123]
packages/typeorm/gulpfile.ts[139-153]
packages/legacy-naming-strategies/eslint.config.mjs[11-25]
.github/workflows/tests.yml[102-113]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The TypeORM workspace dependency resolves to `packages/typeorm/build/package`, which does not exist after a clean install. Root recursive linting reaches `@typeorm/legacy-naming-strategies`, whose type-aware lint configuration imports TypeORM, so `pnpm lint` fails unless a separate packaging command was run first.
## Fix Focus Areas
- package.json[17-17]
- packages/typeorm/package.json[213-215]
## Recommended Fix
Make the root lint command establish its generated TypeORM package prerequisite before recursively running workspace lint, for example by running the existing root `package` script before `pnpm -r run lint`. Keep the generated package link approach only if every root command that consumes workspace packages performs this setup automatically.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

18. Preview tooling changes skip releases 🐞 Bug ≡ Correctness
Description 
The preview trigger replaces root package.json with only packages/typeorm/package.json, although
the preview job executes pkg-pr-new declared in the root manifest and installs as a root
workspace. Changes confined to the preview tool version or root workspace configuration no longer
start this workflow, so they produce no preview artifact for validation.
Code

.github/workflows/preview.yml[10]

-      - package.json
Evidence 
The pull-request trigger now lists only the moved TypeORM manifest and codemod inputs, while the
preview job calls pnpm exec pkg-pr-new from the workspace root. That executable remains a root
development dependency, making root manifest and workspace resolution changes direct inputs to
preview publishing that are absent from the trigger.

.github/workflows/preview.yml[3-15]
.github/workflows/preview.yml[47-69]
package.json[25-35]
pnpm-workspace.yaml[10-14]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The preview workflow no longer triggers when its root-level tooling manifest changes, despite using tooling declared there and installing through the root workspace. Root preview-tool or workspace configuration changes therefore receive no preview release.
## Fix Focus Areas
- .github/workflows/preview.yml[3-15]
- .github/workflows/preview.yml[47-69]
- package.json[25-35]
## Recommended Fix
Add root `package.json`, `pnpm-lock.yaml`, and `pnpm-workspace.yaml` to both the pull-request path trigger and the relevant change-detection filter so preview-affecting workspace changes execute the workflow.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

19. Contributors pack the wrong project 🐞 Bug ⚙ Maintainability
Description 
The bare pnpm pack command in .github/copilot-instructions.md has no workspace filter or
directory change, so it packs the private typeorm-monorepo root manifest rather than the generated
TypeORM package. Following the documented root-level command therefore produces a root-project
tarball instead of the claimed TypeORM artifact.
Code

.github/copilot-instructions.md[197]

+- **Pack**: `pnpm pack` - Creates `.tgz` file in `packages/typeorm/build/`
Evidence 
The instruction explicitly establishes the repository root as the working location for its commands,
while the root manifest has a different private package identity and provides no pack delegation.
The build task writes the publishable package manifest under build/package, so that directory must
be the pack target.

.github/copilot-instructions.md[19-21]
package.json[1-24]
packages/typeorm/gulpfile.ts[95-122]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The documented pack command runs at the workspace root, where `package.json` describes the private `typeorm-monorepo` project rather than the generated `typeorm` package.
Fix Focus Areas
- .github/copilot-instructions.md[195-197]
Recommended Fix
Replace the bare root-level command with `cd packages/typeorm/build/package && pnpm pack` (or an equivalent explicit pnpm directory option), and state that the archive is created in that generated package directory.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

  • Author self-review: I have reviewed the code review findings, and addressed the relevant ones.

Grey Divider

Tip of the day 
💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Sep 11, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (9) 📘 Rule violations (0) 📜 Skill insights (0)

Grey Divider


Action required

1. Legacy package changes skip linting 🐞 Bug ≡ Correctness ⭐ New
Description 
lint now delegates to pnpm -r run lint, but the workflow's lint filter still covers the core
and codemod trees rather than packages/legacy-naming-strategies/**/*. A change confined to that
package's source or manifest skips the lint job even though the recursive command would lint it, so
violations can pass the final gate.
Code

package.json[17]

+    "lint": "pnpm -r run lint",
Evidence 
The new root script recursively runs each workspace package's lint script, and the legacy package
defines such a script. However, the CI lint filter includes core inputs, package ESLint
configurations, and the complete codemod tree but not ordinary legacy naming-strategy files; the
final gate accepts skipped jobs unless another dependency reports failure.

package.json[15-18]
packages/legacy-naming-strategies/package.json[32-35]
.github/workflows/tests.yml[60-72]
.github/workflows/tests.yml[194-209]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The root lint command now recursively lints workspace packages, but the CI lint path filter does not react to ordinary changes under the legacy naming-strategies package. Consequently, changes to that package can merge without running its lint script.

## Fix Focus Areas
- .github/workflows/tests.yml[60-64]
- package.json[15-18]
- packages/legacy-naming-strategies/package.json[32-35]

## Recommended Fix
Add `packages/legacy-naming-strategies/**/*` to the `lint` change filter so every change that can affect that package's lint result schedules the recursive lint job.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. Legacy nightly releases stop publishing 🐞 Bug ≡ Correctness
Description 
The publish workflow still checks out the unmigrated v0 ref but now changes into
packages/typeorm/build/package for its nightly version step. Scheduled or manually dispatched v0
runs therefore enter a directory absent from that checkout before they can publish the legacy
nightly package.
Code

.github/workflows/publish-package.yml[164]

+        working-directory: packages/typeorm/build/package
Evidence 
The matrix explicitly schedules a v0 checkout, then uses the newly added monorepo-only directory
for the nightly version step. The repository root is now a private workspace while the migrated
package exists only under packages/typeorm, confirming that this path cannot exist on the
pre-migration branch.

.github/workflows/publish-package.yml[62-64]
.github/workflows/publish-package.yml[96-99]
.github/workflows/publish-package.yml[156-169]
package.json[1-5]
packages/typeorm/package.json[1-3]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The publish matrix checks out the old `v0` branch, whose package and build output remain at the repository root. The new `packages/typeorm/build/package` working directory only exists on the migrated branch, so legacy nightly publishing fails.
Fix Focus Areas
- .github/workflows/publish-package.yml[159-169]
Recommended Fix
Choose the package working directory based on the checked-out matrix ref: retain `build/package` for `v0` and use `packages/typeorm/build/package` for migrated refs. Apply the same conditional path to both the nightly version and publish steps.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. Core package changes can merge untested 🐞 Bug ≡ Correctness
Description 
The package-json source filter still tracks only the repository-root package.json, while the
published core manifest now lives at packages/typeorm/package.json. A change limited to that
manifest skips build, Linux and Windows tests, and coverage, while all-passed accepts the skipped
jobs because it fails only when a dependency reports failure.
Code

.github/workflows/tests.yml[R40-43]

+              - packages/typeorm/extra/**/*.js
+              - packages/typeorm/src/**/*.ts
+              - packages/typeorm/gulpfile.ts
+              - packages/typeorm/tsconfig.json
Evidence 
The source filter's only manifest path is root-relative, whereas the core manifest is now
package-local. Every core verification job is gated by the derived src-or-tests filter, and the
final gate intentionally treats skipped jobs as non-failures.

.github/workflows/tests.yml[25-45]
packages/typeorm/package.json[2-4]
.github/workflows/tests.yml[80-93]
.github/workflows/tests.yml[115-129]
.github/workflows/tests.yml[172-207]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The source filter no longer includes the core package manifest after the package moved from the repository root to `packages/typeorm`. As a result, dependency, export, script, or packaging changes made only in that manifest do not run the core build and test matrix.
## Fix Focus Areas
- .github/workflows/tests.yml[25-45]
## Recommended Fix
Add `packages/typeorm/package.json` to the `package-json` or `src` filter used by `src-or-tests`, so core manifest-only changes trigger build, platform tests, and coverage.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Remediation recommended

4. Preview tooling changes skip releases 🐞 Bug ≡ Correctness ⭐ New
Description 
The preview trigger replaces root package.json with only packages/typeorm/package.json, although
the preview job executes pkg-pr-new declared in the root manifest and installs as a root
workspace. Changes confined to the preview tool version or root workspace configuration no longer
start this workflow, so they produce no preview artifact for validation.
Code

.github/workflows/preview.yml[10]

-      - package.json
Evidence 
The pull-request trigger now lists only the moved TypeORM manifest and codemod inputs, while the
preview job calls pnpm exec pkg-pr-new from the workspace root. That executable remains a root
development dependency, making root manifest and workspace resolution changes direct inputs to
preview publishing that are absent from the trigger.

.github/workflows/preview.yml[3-15]
.github/workflows/preview.yml[47-69]
package.json[25-35]
pnpm-workspace.yaml[10-14]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The preview workflow no longer triggers when its root-level tooling manifest changes, despite using tooling declared there and installing through the root workspace. Root preview-tool or workspace configuration changes therefore receive no preview release.

## Fix Focus Areas
- .github/workflows/preview.yml[3-15]
- .github/workflows/preview.yml[47-69]
- package.json[25-35]

## Recommended Fix
Add root `package.json`, `pnpm-lock.yaml`, and `pnpm-workspace.yaml` to both the pull-request path trigger and the relevant change-detection filter so preview-affecting workspace changes execute the workflow.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

5. Contributors pack the wrong project 🐞 Bug ⚙ Maintainability
Description 
The bare pnpm pack command in .github/copilot-instructions.md has no workspace filter or
directory change, so it packs the private typeorm-monorepo root manifest rather than the generated
TypeORM package. Following the documented root-level command therefore produces a root-project
tarball instead of the claimed TypeORM artifact.
Code

.github/copilot-instructions.md[197]

+- **Pack**: `pnpm pack` - Creates `.tgz` file in `packages/typeorm/build/`
Evidence 
The instruction explicitly establishes the repository root as the working location for its commands,
while the root manifest has a different private package identity and provides no pack delegation.
The build task writes the publishable package manifest under build/package, so that directory must
be the pack target.

.github/copilot-instructions.md[19-21]
package.json[1-24]
packages/typeorm/gulpfile.ts[95-122]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The documented pack command runs at the workspace root, where `package.json` describes the private `typeorm-monorepo` project rather than the generated `typeorm` package.
Fix Focus Areas
- .github/copilot-instructions.md[195-197]
Recommended Fix
Replace the bare root-level command with `cd packages/typeorm/build/package && pnpm pack` (or an equivalent explicit pnpm directory option), and state that the archive is created in that generated package directory.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

6. Package archives are reported in wrong folder 🐞 Bug ⚙ Maintainability
Description 
DEVELOPER.md changes into packages/typeorm/build/package before running pnpm pack but states
that the resulting archive is in its parent packages/typeorm/build directory. Contributors
following the stated output path cannot find the archive created by that command.
Code

DEVELOPER.md[109]

+This command will generate a distribution package tar in the `packages/typeorm/build` directory (`packages/typeorm/build/typeorm-x.x.x.tgz`).
Evidence 
The preceding changed command establishes build/package as the pack working directory, and the
packaging task writes the generated package manifest to that same directory. The newly added
output-path sentence instead names its parent, contradicting the command's target.

DEVELOPER.md[103-110]
packages/typeorm/gulpfile.ts[95-122]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The pack command executes from `packages/typeorm/build/package`, but the subsequent text identifies its parent directory as the archive location.
Fix Focus Areas
- DEVELOPER.md[103-110]
Recommended Fix
State that `pnpm pack` writes `typeorm-x.x.x.tgz` in `packages/typeorm/build/package`, or change the command to use an explicit destination that matches the documented location.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

View review recommended (3)
7. Mutation reports are no longer uploaded 🐞 Bug ◔ Observability
Description 
The new workflow default runs Stryker from packages/typeorm, while the artifact action still
searches for ./reports/mutation/mutation.html from the repository workspace. Each mutation run
writes its HTML report below the package directory, causing artifact upload to find no report and
fail.
Code

.github/workflows/mutation-test.yml[R8-10]

+defaults:
+  run:
+    working-directory: packages/typeorm
Evidence 
The added default applies to the Stryker run step, and Stryker's configured HTML reporter uses its
standard report location relative to that run directory. The subsequent JavaScript action has no
run-directory setting and still names the former root-level report path.

.github/workflows/mutation-test.yml[8-10]
.github/workflows/mutation-test.yml[53-71]
packages/typeorm/stryker.config.json[13-16]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
Issue description
The mutation workflow now runs commands in `packages/typeorm`, so Stryker creates its default report below that directory. The artifact upload action remains root-relative and no longer finds the generated HTML report.
Fix Focus Areas
- .github/workflows/mutation-test.yml[8-10]
Recommended Fix
Change the artifact path to `packages/typeorm/reports/mutation/mutation.html`, or add an equivalent root-working-directory arrangement that makes the generated and uploaded paths agree.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

8. Workspace edits can bypass codemod tests 🐞 Bug ≡ Correctness
Description 
The codemod filter adds pnpm-lock.yaml but omits pnpm-workspace.yaml, even though the codemod
test job installs and executes within that workspace. Changes to workspace membership or package
resolution can therefore alter whether the codemod package is installed without running
tests-codemod, and the final gate accepts that job as skipped.
Code

.github/workflows/tests.yml[R65-66]

+              - pnpm-lock.yaml
            - packages/codemod/**/*
Evidence 
The workspace file defines which package directories are installed, but the codemod filter has no
path for it. The codemod job invokes the shared root installer before running its package-local test
command, so its execution depends on the omitted workspace configuration.

.github/workflows/tests.yml[64-70]
pnpm-workspace.yaml[4-14]
.github/workflows/tests.yml[133-149]
.github/actions/setup-node/action.yml[22-29]
.github/workflows/tests.yml[192-207]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The codemod path filter does not include the workspace definition even though the codemod test job relies on the root workspace installation. Workspace configuration changes can therefore bypass that package's test job.
## Fix Focus Areas
- .github/workflows/tests.yml[64-70]
## Recommended Fix
Add `pnpm-workspace.yaml` to the `codemod` filter. Also include any other root workspace configuration file that can change codemod installation or dependency resolution.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

9. Fresh workspace linting fails 🐞 Bug ≡ Correctness
Description 
publishConfig.directory makes the workspace:* TypeORM dependencies resolve to build/package,
but that directory and its package.json are created only by the separate gulp package task.
After a clean install, root pnpm lint recursively lints the legacy package, whose type-aware
linting imports typeorm, so it fails unless the user has already run pnpm run package.
Code

packages/typeorm/package.json[R213-215]

+  "publishConfig": {
+    "directory": "build/package"
+  },
Evidence 
The generated lockfile links both workspace consumers to the build output, while TypeORM's ordinary
compile output is a different directory and only the package task writes
build/package/package.json. The CI lint job has already needed to add an explicit package step
before invoking root lint, demonstrating the missing prerequisite in the root command itself.

pnpm-lock.yaml[138-140]
pnpm-lock.yaml[322-334]
packages/typeorm/gulpfile.ts[95-123]
packages/typeorm/gulpfile.ts[139-153]
packages/legacy-naming-strategies/eslint.config.mjs[11-25]
.github/workflows/tests.yml[102-113]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The TypeORM workspace dependency resolves to `packages/typeorm/build/package`, which does not exist after a clean install. Root recursive linting reaches `@typeorm/legacy-naming-strategies`, whose type-aware lint configuration imports TypeORM, so `pnpm lint` fails unless a separate packaging command was run first.
## Fix Focus Areas
- package.json[17-17]
- packages/typeorm/package.json[213-215]
## Recommended Fix
Make the root lint command establish its generated TypeORM package prerequisite before recursively running workspace lint, for example by running the existing root `package` script before `pnpm -r run lint`. Keep the generated package link approach only if every root command that consumes workspace packages performs this setup automatically.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

  • Author self-review: I have reviewed the code review findings, and addressed the relevant ones.

Grey Divider

Context sources
Review mode: 🧠 Deep: This workspace migration has broad cross-cutting CI, packaging, dependency-resolution, and path changes across many independent edit sites, making multiple subtle defects plausibly easy to miss in a single review.

Grey Divider

Tip of the day 
💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

alumni
alumni reviewed Sep 16, 2026
View reviewed changes
Comment thread .vscode/settings.json
"editor.formatOnSave": true,
"git.branchProtection": ["master"],
"js/ts.tsdk.path": "node_modules/typescript/lib"
"js/ts.tsdk.path": "packages/typeorm/node_modules/typescript/lib"

@alumni alumni Sep 16, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't we have node_modules in the workspace root?

@michaelbromley michaelbromley Sep 18, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workspace root does have a node_modules, but it only holds what the root manifest itself declares: prettier and its plugins, husky, lint-staged, eslint and standard-changelog. TypeScript is a devDependency of packages/typeorm, so pnpm installs it at packages/typeorm/node_modules/typescript and there is no copy at the root for the old path to resolve against.

I pointed the setting at the package so the TypeScript version stays declared in one place. The alternative is adding typescript to the root devDependencies, which would let the setting go back to node_modules/typescript/lib at the cost of a second version spec to keep in sync with the package. Happy to switch if you prefer that.

Related, in case it looks odd: eslint is still a root devDependency because lint-staged runs eslint --fix from the repository root on pre-commit. eslint 10 resolves the config from the file being linted, so it picks up packages/typeorm/eslint.config.mjs. I checked that path works.

@sonarqubecloud

sonarqubecloud Bot commented Sep 18, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed for 'typeorm-legacy-naming-strategies'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@sonarqubecloud

sonarqubecloud Bot commented Sep 18, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This was referenced Sep 18, 2026
Open
Draft
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Draft
Open
Open
Open
Open
Open
Merged
@gglee-cheeseade gglee-cheeseade mentioned this pull request Sep 23, 2026
Merged
@Cprakhar Cprakhar mentioned this pull request Sep 28, 2026
Merged
1 of 4 tasks
aayushbaluni added a commit to aayushbaluni/typeorm that referenced this pull request Sep 30, 2026
@aayushbaluni
test: move issue-12330 tests into the packages/typeorm layout
f2891e6 
The pnpm-workspace migration (typeorm#12854) moved tests from the repo root to
packages/typeorm/test. Rename detection carried the source change across,
but these files are added by this branch so they kept the old root path.
@naorpeled naorpeled mentioned this pull request Sep 30, 2026
Merged
1 of 4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alumni alumni alumni approved these changes
@gioboa gioboa gioboa approved these changes

Assignees

No one assigned

Labels

Compliance violation

Milestone

2.0.next

Development

Successfully merging this pull request may close these issues.

3 participants

@michaelbromley @alumni @gioboa