ci: pin pnpm/action-setup to v6.1.0

The floating v6 major tag hasn't been moved past v6.0.10, one release
behind v6.1.0 (adds pnpm v12 support), so plain @v6 usage was not
actually running the latest available version. Pin to the exact tag,
matching how hendrikmuhs/ccache-action is already handled, and note
why in the same comment block.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017iWrfmJFUyb3g3SyqgAGb8

Author: claude

.github/workflows/check.yml

@@ -37,6 +37,10 @@ concurrency:
 # hendrikmuhs/ccache-action is pinned to an exact patch, not a floating major:
 # its v1 / v1.2 tags still point at a Node.js 20 build, which the runners now
 # warn about. Float again once upstream moves them to >= v1.2.22.
+#
+# pnpm/action-setup is likewise pinned to an exact tag: upstream's floating v6
+# hasn't been moved past v6.0.10 yet, one release behind v6.1.0 (adds pnpm v12
+# support). Move back to floating v6 once it catches up.
 
 jobs:
   lint:
@@ -47,7 +51,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - name: Setup cpp tools
@@ -97,7 +101,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - name: Setup cpp tools
@@ -137,7 +141,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - name: Setup cpp tools
@@ -167,7 +171,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       # Device names change with every Xcode release, so pick one dynamically.
@@ -268,7 +272,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - name: Setup cpp tools
@@ -317,7 +321,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - name: Setup cpp tools
@@ -408,7 +412,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - name: Setup cpp tools

.github/workflows/release.yml

@@ -20,8 +20,9 @@ on:
 # refreshing the "Version Packages" pull request until someone approves. The
 # two jobs that must not overlap carry their own groups instead.
 
-# Node.js is set up before pnpm, and hendrikmuhs/ccache-action is pinned to an
-# exact patch rather than a floating major. See the note in check.yml for why.
+# Node.js is set up before pnpm, and hendrikmuhs/ccache-action and
+# pnpm/action-setup are pinned to exact versions rather than floating majors.
+# See the note in check.yml for why.
 
 jobs:
   # changesets/action's sub-actions split the "what should happen?" decision out
@@ -42,7 +43,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       # select-mode runs the locally installed @changesets/cli, so the workspace
@@ -75,7 +76,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - run: pnpm install
@@ -103,7 +104,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         with:
           cache: true
       - name: Setup cpp tools