Repository navigation
Adopt pnpm/setup v3.0.0 and enforce its reviewed release - #371
Merged
Merged
Conversation
Moves the seven toolchain steps from v2.1.0 to v3.0.0 (fbda4c85, a GitHub-verified signed tag on an immutable release). Dependabot's bump failed because the tests encoded the v2.1.0 commit. The reviewed commit now lives in the toolchain policy, and `pnpm workflows` rejects any other pnpm/setup revision, so a future bump fails with one clear message until it is reviewed. The tests take the commit from the policy. v3 lets an explicit `node-version-file` input override `devEngines.runtime`, so the policy rejects it with the other inputs that would replace the package.json toolchain. Automatic version-file detection does not apply while `devEngines.runtime` declares Node. Store caching stays `cache: true`. v3 saves a new store from every job under a run-unique key and restores the newest store for the lockfile. Aksara's CI has one pnpm job and a 181 MB store: the v3 run on #365 restored main's v2.1.0 store, reused 371 of 372 packages, and saved in about five seconds. The busiest recent day, 21 CI runs, adds about 3.8 GB to a 10 GB quota that holds 3.2 GB today.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces #365. Moves every toolchain step from pnpm/setup v2.1.0 to v3.0.0 (
fbda4c85, a GitHub-verified signed tag on an immutable release) and turns the reviewed commit into policy instead of test fixtures. nakafaai/nakafa.com#732 makes the same move in Nakafa.TOOLCHAIN_SETUP_ACTIONinscripts/workflow/toolchain.tsholds the reviewed commit, andpnpm workflowsrejects any other pnpm/setup revision. build(deps): bump pnpm/setup from 2.1.0 to 3.0.0 #365 failed with ten unrelated-looking test failures, because the tests replaced literal v2.1.0 text that no longer existed. A future bump now fails with one message until it is reviewed. The tests take the commit from the policy.devEngines.runtime: v3 detects.node-version,.nvmrc, and.tool-versionsonly when the manifest declares no Node runtime, and the repository has none of those files. An explicitnode-version-fileinput would override the manifest, so the policy now rejects it with the other inputs that would replace the package.json toolchain. The stricter lockfile check (fix: require-lockfile no longer accepts a lockfile pnpm will not use pnpm/setup#60) applies only withrequire-lockfile; workflows keepinstall: falseand runpnpm install --frozen-lockfile.cache: true: v3 saves a new store from every job under arunId-attempt-uuidkey and restores the newest store for the lockfile. CI has one pnpm job with a 181 MB store. The v3 run on build(deps): bump pnpm/setup from 2.1.0 to 3.0.0 #365 restored main's v2.1.0 store through the prefix fallback, reused 371 of 372 packages, pruned 147 kB, and saved in about five seconds. The busiest recent day, 2026-09-23, had 21 CI runs, about 3.8 GB of saves against a 10 GB quota that holds 3.2 GB today. Main's store is read by every pull request run, so least-recently-used eviction keeps it. Nakafa's five-job CI and 564 MB store would thrash the quota, so nakafa.com#732 restores the store read-only there instead.Verification
pnpm workflows,pnpm lint,pnpm names,pnpm jsdocs,pnpm lines,pnpm locales,pnpm boundaries,pnpm typecheck:root, andpnpm deprecationspass.pnpm test:root: 24 files and 192 tests pass with 100% coverage. The toolchain tests cover an unreviewed pnpm/setup commit and an uppercaseNODE-VERSION-FILEinput.