Skip to content

Tags: complexdatacollective/github-actions

Tags

v2

Toggle v2's commit message 
fix(setup-pnpm): repair `pnpm add -g`, pin deps by SHA, bump versions

Three changes to setup-pnpm:

1. Fix `pnpm add -g` failure under pnpm 10+. pnpm now resolves
   global-bin-dir as `$PNPM_HOME/bin` by default, but pnpm/action-setup
   sets PNPM_HOME to `.../node_modules/.bin` (already on PATH). The
   resulting `.bin/bin` is not on PATH, so global installs error out.
   Configure global-bin-dir to PNPM_HOME directly.

2. Pin all referenced actions by commit SHA (with version comments)
   rather than mutable tags, per supply-chain best practices.

3. Bump to current versions:
     actions/checkout       v4 -> v6.0.2
     actions/setup-node     v4 -> v6.4.0
     actions/cache          v4 -> v5.0.5
     pnpm/action-setup      v4 -> v6.0.8

Also use env: for the user-supplied cache-key-prefix input rather than
interpolating into a run script directly.

v1

Toggle v1's commit message 
feat: add setup-pnpm composite action