ci(deps): bump pnpm/action-setup from 4.3.0 to 6.0.9#1276
ci(deps): bump pnpm/action-setup from 4.3.0 to 6.0.9#1276dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
| with: | ||
| persist-credentials: false | ||
| - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 | ||
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 |
There was a problem hiding this comment.
💡 Suggestion: The same pnpm/action-setup pin is repeated across many jobs and workflows. This PR had to touch every occurrence, which makes future action upgrades easy to apply inconsistently. Consider extracting the standard pnpm + setup-node sequence into a local composite action or reusable workflow so the pinned dependency is maintained in one place.
There was a problem hiding this comment.
🟡 Issue: Centralize the pinned pnpm setup step instead of updating 21 copies
What's wrong
This version bump has to touch every job and workflow because the same pinned setup dependency is scattered through the CI YAML. The PR does not create the duplication, but it preserves the exact maintenance problem the change exposes: action pins are dependency configuration, and keeping them copied across a 1,400-line workflow plus several sibling workflows makes routine updates broad, easy to miss, and harder to review than they need to be.
Example
A future pnpm/action-setup bump has to edit .github/workflows/ci.yml lines 184, 314, 342, 391, 467, 534, 589, 637, 691, 726, 780, 841, 911, 960, 1047, 1166, and 1244, plus the four smaller workflows. Any missed copy leaves CI lanes on different setup behavior.
Suggested direction
Introduce one repository-owned CI setup abstraction for the repeated pnpm/action-setup plus actions/setup-node pair, for example a composite action with inputs for cache and node-version-file. Then each job calls that helper and the external action pin lives in one reviewed file.
Confidence note
Assumes this repository is willing to use a local CI helper/composite action in PR workflows. If the trusted-CI policy forbids local actions from the merge candidate, use whatever central CI abstraction the repo already considers acceptable instead.
For Agents
Look at the repeated checkout/pnpm/setup-node blocks in .github/workflows/ci.yml and the four smaller workflows. Preserve SHA pinning, checkout ordering, node-version-file, and pnpm cache behavior. Factor only the common setup path and confirm every affected job still installs pnpm before actions/setup-node enables cache: pnpm.
47824bf to
3eb9c15
Compare
otReviewAgent
left a comment
otReviewAgent
left a comment
There was a problem hiding this comment.
Review Agent completed this review and found no issues.
3eb9c15 to
3f5cc43
Compare
otReviewAgent
left a comment
otReviewAgent
left a comment
There was a problem hiding this comment.
Review Agent completed this review and found no issues.
3f5cc43 to
f4fc738
Compare
otReviewAgent
left a comment
otReviewAgent
left a comment
There was a problem hiding this comment.
Review Agent completed this review and found no issues.
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4.3.0 to 6.0.9. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@b906aff...0ebf471) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
f4fc738 to
56b3325
Compare
1 participant
Bumps pnpm/action-setup from 4.3.0 to 6.0.9.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
0ebf471fix: update pnpm to v11.7.0 (#267)0e279bbfix: update pnpm to 11.1.1 (#248)3e83581fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)551b42edocs(README): fixcache_dependency_pathtype (#257)739bfe4fix: self-update bootstrap to packageManager-pinned version (#233) (#256)f61705dchore: add CODEOWNERS7a5507bfix: restore inputs from state in post (#255)1155470fix: honor devEngines.packageManager.onFail=error (#252) (#254)91ab88efix: bin_dest output points to self-updated pnpm, not bootstrap (#249)e578e19fix: update pnpm to 11.0.4