ci: pin pnpm/action-setup to v6.1.0 (latest available) - #461
Merged
Conversation
The floating v6 major tag hasn't been moved past v6.0.10, one release behind v6.1.0 (adds pnpm v12 support), so plain @v6 usage was not actually running the latest available version. Pin to the exact tag, matching how hendrikmuhs/ccache-action is already handled, and note why in the same comment block. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017iWrfmJFUyb3g3SyqgAGb8
kraenhansen
added
Apple 🍎
Claude
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017iWrfmJFUyb3g3SyqgAGb8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Audited every third-party action used across
.github/workflows/check.ymland.github/workflows/release.ymlagainst its latest available release, per the "verify latest or document why not" policy. This PR is the one action out of the set that needed a change:pnpm/action-setup.Why
pnpm/action-setupis used with the floating@v6major tag everywhere in this repo. Upstream'sv6tag currently still points atv6.0.10(Aug 3, 2026) — it hasn't been moved forward tov6.1.0(Sep 5, 2026, adds pnpm v12 support). So@v6was silently not resolving to the latest available version.Fix: pin to the exact
v6.1.0tag everywhere, mirroring howhendrikmuhs/ccache-actionis already pinned to an exact patch in this file (with the same rationale style), and documented the reason next to the existing ccache-action note so a future bump doesn't get "helpfully" reverted back to floating@v6. Once upstream moves thev6tag pastv6.1.0, we can float again.Audit results for every other action in these workflows
Confirmed each is already on the newest available version (their floating major tag currently resolves to the same commit as the newest specific-version tag):
actions/checkout@v7actions/setup-node@v7actions/setup-java@v6actions/upload-artifact@v7android-actions/setup-android@v4reactivecircus/android-emulator-runner@v2aminya/setup-cpp@v1changesets/action/*@v2v2branch, not a tag, but it's kept current)hendrikmuhs/ccache-action@v1.2.24(exact)v1/v1.2to ≥ v1.2.22") still holds — those floating tags are still stuck at v1.2.20.pnpm/action-setup@v6→@v6.1.0No other action needed a version bump or a new documented-reason comment.
🤖 Generated with Claude Code
https://claude.ai/code/session_017iWrfmJFUyb3g3SyqgAGb8
Generated by Claude Code