chore(ci): Bump pnpm/action-setup to v5 and pin to commit SHA#20462
chore(ci): Bump pnpm/action-setup to v5 and pin to commit SHA#20462
Conversation
Bump from v4 to v5.0.0 which uses Node.js 24 (resolves the GHA deprecation warning for Node.js 20 actions). Pin to the exact commit SHA for supply chain security. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| with: | ||
| ref: ${{ env.HEAD_COMMIT }} | ||
| - uses: pnpm/action-setup@v4 | ||
| - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 |
There was a problem hiding this comment.
Bug: The pinned commit SHA for pnpm/action-setup may point to v4.4.0 instead of the intended v5.0.0, which would fail to resolve the Node.js deprecation warning.
Severity: MEDIUM
Suggested Fix
Verify the correct commit SHA for the pnpm/action-setup@v5.0.0 release tag directly from the official pnpm/action-setup repository. Update the workflow file to use the official v5 tag (e.g., pnpm/action-setup@v5) or the verified commit SHA for v5.0.0.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/build.yml#L925
Potential issue: The pull request updates `pnpm/action-setup` to a specific commit SHA
(`fc06bc1257f339d1d5d8b3a19a8cae5388b55320`) with the intention of upgrading to
`v5.0.0`. However, there is evidence this SHA may correspond to `v4.4.0`. If the SHA is
incorrect, the action's runtime will not be updated from Node.js v20 to v24. This means
the GitHub Actions deprecation warning for Node.js 20 will not be resolved, and the
primary goal of this change will not be met. The CI job will remain at risk of failing
when Node.js 20 is fully deprecated.
Did we get this right? 👍 / 👎 to inform future reviews.
There was a problem hiding this comment.
this is the commit tagged with v5.0.0, so should be fine.
size-limit report 📦
|
nicohrubec
left a comment
nicohrubec
left a comment
There was a problem hiding this comment.
we had a PR open to pin all actions to commit SHAs (ref), is this something we want to do for all actions?
I think it makes sense, at least for everything that is not a github-owned action (e.g. actions/cache@4 is likely fine)! |
Just to keep this in the back of our heads: https://www.vaines.org/posts/2026-03-24-the-comforting-lie-of-sha-pinning/ |
yes, we need to actually verify the shas for this to make sense! 😅 |
3 participants
Summary
pnpm/action-setupfrom v4 to v5.0.0fc06bc1257f339d1d5d8b3a19a8cae5388b55320) instead of a mutable version tag for supply chain securityUpdated in
build.yml(2 occurrences) andcanary.yml(1 occurrence).Changelog (v4 → v5)
v5.0.0 — Updated the action to use Node.js 24 (resolves GHA deprecation warning for Node.js 20 actions).
v4.4.0 — Updated the action to use Node.js 24.
v4.3.0 — Store caching support, docs fixes, dependency cleanup.
v4.2.0 — Respects
.npmrcregistry configuration when fetching pnpm.v4.1.0 — Added support for
package.yaml.Full changelog: pnpm/action-setup@v4.0.0...v5.0.0
Test plan
🤖 Generated with Claude Code