Bump pnpm/action-setup from 6 to 6.0.9 - #82
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6 to 6.0.9. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@v6...v6.0.9) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Pins the pnpm/action-setup GitHub Action to a specific patch version for more deterministic CI runs.
Changes:
- Update
pnpm/action-setupfrom@v6to@v6.0.9in the matrix job - Update
pnpm/action-setupfrom@v6to@v6.0.9in the non-matrix job
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - uses: actions/checkout@v7 | ||
|
|
||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v6 | ||
| uses: pnpm/action-setup@v6.0.9 | ||
|
|
||
| - name: Use Node.js ${{ matrix.node-version }} | ||
| uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Good catch — addressed in #83, which pins all three actions (actions/checkout, pnpm/action-setup, actions/setup-node) to full commit SHAs with trailing version comments rather than mixing exact versions and floating major tags. Closing this PR in favor of that one.
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v6 | ||
| uses: pnpm/action-setup@v6.0.9 | ||
|
|
||
| - name: Use Node.js | ||
| uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Good catch — addressed in #83, which pins all three actions (actions/checkout, pnpm/action-setup, actions/setup-node) to full commit SHAs with trailing version comments rather than mixing exact versions and floating major tags. Closing this PR in favor of that one.
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v6 | ||
| uses: pnpm/action-setup@v6.0.9 |
There was a problem hiding this comment.
Leaving the duplication as-is. YAML anchors aren't supported in Actions workflow files, so the only real options are a reusable workflow or a local composite action — and for three steps across two jobs, that indirection costs more in readability and Dependabot coverage (a nested action.yml needs its own directories entry in dependabot.yml) than the drift risk it removes. Worth revisiting if a third job appears.
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v6 | ||
| uses: pnpm/action-setup@v6.0.9 |
There was a problem hiding this comment.
Leaving the duplication as-is. YAML anchors aren't supported in Actions workflow files, so the only real options are a reusable workflow or a local composite action — and for three steps across two jobs, that indirection costs more in readability and Dependabot coverage (a nested action.yml needs its own directories entry in dependabot.yml) than the drift risk it removes. Worth revisiting if a third job appears.
|
Superseded by #83, which pins all three actions to commit SHAs instead of pinning just Also worth noting: the @dependabot ignore this minor version |
|
OK, I won't notify you about version 6.0.x again, unless you re-open this PR. |
|
@dependabot unignore pnpm/action-setup |
|
OK, I will stop ignoring the pnpm/action-setup dependency. |
|
Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use |
Bumps pnpm/action-setup from 6 to 6.0.9.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
62bce64fix: extract pnpm version from packageManager field instead of returning unde...58e6119feat!: replace bundled pnpm binary with npm + lockfile bootstrap (#212)2e223e0chore(workflows): adding pr-check.yaml to validate dist folder (#213)fc06bc1feat!: run the action on Node.js 24 (#205)b906affRevert "feat!: run the action on Node.js 24 (#205)"Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)