fix: Use pnpm-workspace.yaml instead of .npmrc for pre/post script

[fujidana]

A .npmrc file was added into templates that use pnpm, for the purpose of ensuring pre/post-scripts being executed (Issue #370 and PR #372).

However, pnpm v11 and later do not read these settings in .npmrc; they are instead expected to be defined in pnpm-workspace.yaml in a bit different format. In https://pnpm.io/11.x/settings it is written that:

Only auth and registry settings are read from .npmrc files.

pnpm v10 reads them form both .npmrc and pnpm-workspace.yaml, probably intending to provide the transition period from .npmrc to pnpm-workspace.yaml (See https://pnpm.io/10.x/settings).

pnpm v9 has already reached the EOL. I think most extension developers don't have reasons to use such an old pnpm for a newly created project/workspace using this generator. There is also a minor flow due to the existence of the .npmrc file. The following warning is printed when running vsce package --no-dependencies or vsce publish --no-dependencies for extension publishing:

npm warn Unknown env config "enable-pre-post-scripts".
This will error in a future major version of npm. See npm help npmrc for supported config options.

Also note that pnpm re-enabled the pre/post-scripts by default since v9.0 (See pnpm/pnpm#7634). Therefore, in fact it is usually not necessary to enable it explicitly. However, pnpm-workspace.yaml is often needed for other purposes, such as for allowBuilds setting, and the setting can be disabled globally. Therefore, I think it is better to set it there for clarity.

[fujidana]

@microsoft-github-policy-service agree