Skip to content

chore(ci): Bump pnpm/action-setup to v5 and pin to commit SHA #20462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mydea merged 1 commit into from
Apr 24, 2026
+3 −3
Merged

chore(ci): Bump pnpm/action-setup to v5 and pin to commit SHA #20462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -922,7 +922,7 @@ jobs:
uses: actions/checkout@v6
with:
ref: ${{ env.HEAD_COMMIT }}
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
Copy link
Copy Markdown

@sentry sentry Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The pinned commit SHA for pnpm/action-setup may point to v4.4.0 instead of the intended v5.0.0, which would fail to resolve the Node.js deprecation warning.
Severity: MEDIUM

Suggested Fix

Verify the correct commit SHA for the pnpm/action-setup@v5.0.0 release tag directly from the official pnpm/action-setup repository. Update the workflow file to use the official v5 tag (e.g., pnpm/action-setup@v5) or the verified commit SHA for v5.0.0.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/build.yml#L925

Potential issue: The pull request updates `pnpm/action-setup` to a specific commit SHA
(`fc06bc1257f339d1d5d8b3a19a8cae5388b55320`) with the intention of upgrading to
`v5.0.0`. However, there is evidence this SHA may correspond to `v4.4.0`. If the SHA is
incorrect, the action's runtime will not be updated from Node.js v20 to v24. This means
the GitHub Actions deprecation warning for Node.js 20 will not be resolved, and the
primary goal of this change will not be met. The CI job will remain at risk of failing
when Node.js 20 is fully deprecated.

Did we get this right? 👍 / 👎 to inform future reviews.

Copy link
Copy Markdown
Member Author

@mydea mydea Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the commit tagged with v5.0.0, so should be fine.

with:
version: 9.15.9
- name: Set up Node
Expand Down Expand Up @@ -1054,7 +1054,7 @@ jobs:
uses: actions/checkout@v6
with:
ref: ${{ env.HEAD_COMMIT }}
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
with:
version: 9.15.9
- name: Set up Node
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/canary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ jobs:
uses: actions/checkout@v6
with:
ref: ${{ env.HEAD_COMMIT }}
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
with:
version: 9.15.9
- name: Set up Node
Expand Down
Loading