fix: drop Changesets from the vland monorepo template and allow lefthook's build with allowBuilds

.changeset/vland-monorepo-no-changesets.md

@@ -0,0 +1,5 @@
+---
+"@variablelab/vland": patch
+---
+
+`vland init -t monorepo` no longer ships Changesets (`.changeset/` and the `@changesets/*` devDependencies). Every package in the monorepo is private and it has no release workflow, so Changesets had nothing to version or publish. Only the `library` template ships ready to publish to npm.

.changeset/vland-templates-allow-builds.md

@@ -0,0 +1,5 @@
+---
+"@variablelab/vland": patch
+---
+
+Projects from `vland init` let lefthook's install script run through pnpm's `allowBuilds` setting, which pnpm prefers since 10.26, instead of `onlyBuiltDependencies`, which pnpm 11 removed. A generated project that moved to pnpm 11 would have had its `onlyBuiltDependencies` ignored, so `pnpm install` failed with `ERR_PNPM_IGNORED_BUILDS` and the git hooks never got installed. The monorepo no longer lists `@biomejs/biome`, which has had no install script since Biome 2.

vland/cli/test/integration/init-templates.test.ts

@@ -126,8 +126,28 @@ describe("vland init (template scaffolding)", () => {
 
     const typesPkg = JSON.parse(await readFile(path.join(projectDir, "packages", "types", "package.json"), "utf8"));
     expect(typesPkg.name).toBe(`@${name}/types`);
+  });
+
+  test("monorepo: ships no Changesets, since every package is private and nothing publishes", async () => {
+    const name = "no-release";
+    const r = cli(`init ${name} -t monorepo --no-install --no-git`, { cwd: fixture.dir });
+    expect(r.status).toBe(0);
+
+    // Changesets skips private packages, so a release setup here would have nothing to version or publish.
+    const projectDir = path.join(fixture.dir, name);
+    for (const dir of ["", "apps/api", "apps/web", "packages/types"]) {
+      const pkg = JSON.parse(await readFile(path.join(projectDir, dir, "package.json"), "utf8"));
+      expect(pkg.private, `${dir || "root"} package.json`).toBe(true);
+    }
 
-    expect(await readChangelogRepo(projectDir)).toBe(`variableland/${name}`);
+    const mentions: string[] = [];
+    for (const entry of await readdir(projectDir, { recursive: true, withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      const file = path.join(entry.parentPath, entry.name);
+      const relative = path.relative(projectDir, file);
+      if (/changeset/i.test(relative) || /changeset/i.test(await readFile(file, "utf8"))) mentions.push(relative);
+    }
+    expect(mentions).toEqual([]);
   });
 
   test.each(TEMPLATES)("%s: pins node and pnpm with mise and a lockfile", async (template) => {
@@ -153,6 +173,20 @@ describe("vland init (template scaffolding)", () => {
     }
   });
 
+  test.each(TEMPLATES)("%s: lets lefthook's postinstall run with allowBuilds, which pnpm 11 still reads", async (template) => {
+    const name = `builds-${template}`;
+    const r = cli(`init ${name} -t ${template} --no-install --no-git`, { cwd: fixture.dir });
+    expect(r.status).toBe(0);
+
+    // pnpm 11 drops onlyBuiltDependencies, then fails the install on lefthook's unapproved build script.
+    const workspace = await readFile(path.join(fixture.dir, name, "pnpm-workspace.yaml"), "utf8");
+    expect(workspace).toMatch(/^allowBuilds:\n {2}lefthook: true$/m);
+    expect(workspace).not.toContain("onlyBuiltDependencies");
+    expect(workspace).not.toContain("@biomejs/biome");
+    // A lefthook restored from the side-effects cache skips its postinstall, so no git hooks get installed.
+    expect(workspace).toMatch(/^sideEffectsCache: false$/m);
+  });
+
   test.each([
     ["library", ""],
     ["library", "--visibility=private"],

vland/templates/backend/pnpm-workspace.yaml

@@ -1,5 +1,6 @@
-onlyBuiltDependencies:
-  - lefthook
+# Dependencies whose build scripts pnpm runs on install; allowBuilds needs pnpm >= 10.26.
+allowBuilds:
+  lefthook: true
 
 # lefthook's postinstall installs the git hooks, so it has to run on every install:
 # with the side-effects cache on, a lefthook already built for another project skips it.

vland/templates/library/pnpm-workspace.yaml

@@ -1,5 +1,6 @@
-onlyBuiltDependencies:
-  - lefthook
+# Dependencies whose build scripts pnpm runs on install; allowBuilds needs pnpm >= 10.26.
+allowBuilds:
+  lefthook: true
 
 # lefthook's postinstall installs the git hooks, so it has to run on every install:
 # with the side-effects cache on, a lefthook already built for another project skips it.

vland/templates/monorepo/package.json

@@ -12,8 +12,6 @@
     "test": "turbo run test"
   },
   "devDependencies": {
-    "@changesets/changelog-github": "1.0.1",
-    "@changesets/cli": "3.0.3",
     "@rrlab/cli": "^1.3.4",
     "@types/node": "^24.0.0",
     "lefthook": "2.1.1",

vland/templates/monorepo/pnpm-workspace.yaml

@@ -1,9 +1,10 @@
 packages:
   - apps/*
   - packages/*
-onlyBuiltDependencies:
-  - "@biomejs/biome"
-  - lefthook
+
+# Dependencies whose build scripts pnpm runs on install; allowBuilds needs pnpm >= 10.26.
+allowBuilds:
+  lefthook: true
 
 # lefthook's postinstall installs the git hooks, so it has to run on every install:
 # with the side-effects cache on, a lefthook already built for another project skips it.