Skip to content

chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.1 #342

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.1 #342

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/bundle-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
path: base

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

Check warning on line 31 in .github/workflows/bundle-analysis.yml

View check run for this annotation

Claude / Claude Code Review

Stale version comments after SHA update 

8 workflow files updated the pnpm/action-setup SHA to v6.0.1 but kept stale `# v4` comments, while only ci.yml correctly updated to `# v6.0.1`. Version comments exist so security auditors can verify a pinned SHA matches a known release — having comments three major versions behind defeats this purpose; update all `# v4` annotations to `# v6.0.1` in bundle-analysis.yml:31, docs-check.yml:65, docs-seo-aeo.yml:35, prepare-release.yml:34, release-on-tag.yml:26, release.yml:32 and :136, and stable-re
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Stale version comment after SHA update

The SHA 078e9d416474b29c0c387560859308974f7e9c53 points to the v6.0.1 release, but the trailing comment still reads # v4. This makes it harder to audit which action version is actually running. The same stale comment appears in docs-check.yml, docs-seo-aeo.yml, prepare-release.yml, release-on-tag.yml, release.yml, and stable-release.yml.

Suggested change
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1
Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/bundle-analysis.yml
Line: 31

Comment:
**Stale version comment after SHA update**

The SHA `078e9d416474b29c0c387560859308974f7e9c53` points to the v6.0.1 release, but the trailing comment still reads `# v4`. This makes it harder to audit which action version is actually running. The same stale comment appears in `docs-check.yml`, `docs-seo-aeo.yml`, `prepare-release.yml`, `release-on-tag.yml`, `release.yml`, and `stable-release.yml`.

```suggestion
        uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1
```

How can I resolve this? If you propose a fix, please make it concise.

Copy link
Copy Markdown

@claude claude Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 8 workflow files updated the pnpm/action-setup SHA to v6.0.1 but kept stale # v4 comments, while only ci.yml correctly updated to # v6.0.1. Version comments exist so security auditors can verify a pinned SHA matches a known release — having comments three major versions behind defeats this purpose; update all # v4 annotations to # v6.0.1 in bundle-analysis.yml:31, docs-check.yml:65, docs-seo-aeo.yml:35, prepare-release.yml:34, release-on-tag.yml:26, release.yml:32 and :136, and stable-release.yml:30.

Extended reasoning...

What the bug is and how it manifests

This PR bumps pnpm/action-setup from v5.0.0 to v6.0.1, pinning the new SHA 078e9d416474b29c0c387560859308974f7e9c53. The standard security practice when using SHA-pinned GitHub Actions is to include a human-readable version comment (e.g., # v6.0.1) so that reviewers and security auditors can quickly verify which release the SHA corresponds to without having to cross-reference an external source. When those comments are wrong or stale, the entire purpose of the annotation is defeated.

The specific code path that triggers it

In the diff, every affected file changes from pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4 to pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4. The SHA correctly points to v6.0.1, but the trailing comment still reads # v4 — three major versions behind. The single exception is ci.yml, which correctly updates the comment from # v5.0.0 to # v6.0.1.

Affected locations in this PR:

  • .github/workflows/bundle-analysis.yml line 31
  • .github/workflows/docs-check.yml line 65
  • .github/workflows/docs-seo-aeo.yml line 35
  • .github/workflows/prepare-release.yml line 34
  • .github/workflows/release-on-tag.yml line 26
  • .github/workflows/release.yml lines 32 and 136
  • .github/workflows/stable-release.yml line 30

Why existing code doesn't prevent it

Dependabot automatically updates SHAs but does not update inline version comments — that is a manual responsibility. The inconsistency was already present (some files had # v4 when they were actually on v5), and this PR propagated the stale comment to the new SHA without correcting it. ci.yml happened to be corrected because it had the more-accurate # v5.0.0 comment and someone updated it, but the others were overlooked.

What the impact would be

Functionally, there is no runtime impact — GitHub Actions resolves the SHA directly, ignoring the comment. However, the security impact is that human reviewers and automated audit tools relying on these comments to verify supply-chain integrity will see # v4 and assume the pinned SHA matches pnpm/action-setup v4, when in reality it is v6.0.1. This is a nit-level issue in the sense that no code breaks, but it directly undermines the stated reason SHA pinning with annotations is used.

How to fix it

Replace # v4 with # v6.0.1 in all eight affected locations listed above.

Step-by-step proof

  1. PR title states: "bump pnpm/action-setup from 5.0.0 to 6.0.1"
  2. PR description commit list confirms SHA: 078e9d4 fix: update pnpm to 11.0.0-rc.2 — this is the v6.0.1 release commit
  3. ci.yml diff: - uses: pnpm/action-setup@fc06bc1257f... # v5.0.0 → + uses: pnpm/action-setup@078e9d41... # v6.0.1 ✓ correct
  4. bundle-analysis.yml diff: - uses: pnpm/action-setup@fc06bc1257f... # v4 → + uses: pnpm/action-setup@078e9d41... # v4 ✗ comment not updated
  5. Same pattern repeated in docs-check.yml, docs-seo-aeo.yml, prepare-release.yml, release-on-tag.yml, release.yml (×2), and stable-release.yml
  6. A security auditor reading bundle-analysis.yml would see SHA 078e9d4 annotated as v4 and, if they looked up pnpm/action-setup v4, would find a completely different SHA — raising a false alarm or, worse, causing them to dismiss the mismatch as a known annotation pattern.


- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/deploy-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
uses: actions/checkout@v6

- name: Setup pnpm
uses: pnpm/action-setup@v5
uses: pnpm/action-setup@v6.0.1

Check notice on line 27 in .github/workflows/deploy-docs.yml

View check run for this annotation

Claude / Claude Code Review

deploy-docs.yml uses mutable tag instead of pinned SHA 

deploy-docs.yml uses the mutable tag pnpm/action-setup@v6.0.1 instead of a pinned commit SHA, while all 8 other workflow files in this PR use the immutable SHA @078e9d416474b29c0c387560859308974f7e9c53. This is a pre-existing pattern in this file (it previously used @v5), but the PR touched this line without converting to SHA pinning, leaving an inconsistency across the codebase — the fix is to use pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1.
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Mutable tag reference — inconsistent with other workflows

deploy-docs.yml uses a mutable tag (@v6.0.1) while every other workflow in this PR pins to an immutable SHA. A tag can be force-pushed, so the exact code that runs can change without any diff in this file. Pinning to the same SHA used elsewhere would make supply-chain verification consistent.

Suggested change
uses: pnpm/action-setup@v6.0.1
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1
Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/deploy-docs.yml
Line: 27

Comment:
**Mutable tag reference — inconsistent with other workflows**

`deploy-docs.yml` uses a mutable tag (`@v6.0.1`) while every other workflow in this PR pins to an immutable SHA. A tag can be force-pushed, so the exact code that runs can change without any diff in this file. Pinning to the same SHA used elsewhere would make supply-chain verification consistent.

```suggestion
        uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1
```

How can I resolve this? If you propose a fix, please make it concise.

Copy link
Copy Markdown

@claude claude Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟣 deploy-docs.yml uses the mutable tag pnpm/action-setup@v6.0.1 instead of a pinned commit SHA, while all 8 other workflow files in this PR use the immutable SHA @078e9d416474b29c0c387560859308974f7e9c53. This is a pre-existing pattern in this file (it previously used @v5), but the PR touched this line without converting to SHA pinning, leaving an inconsistency across the codebase — the fix is to use pnpm/action-setup@078e9d4 # v6.0.1.

Extended reasoning...

What the bug is and how it manifests

In .github/workflows/deploy-docs.yml line 27, pnpm/action-setup is referenced via the mutable tag @v6.0.1. All 8 other workflow files modified in this PR (bundle-analysis.yml, ci.yml, docs-check.yml, docs-seo-aeo.yml, prepare-release.yml, release-on-tag.yml, release.yml, stable-release.yml) pin to the immutable commit SHA @078e9d416474b29c0c387560859308974f7e9c53.

The specific code path that triggers it

A mutable Git tag can be force-pushed by the upstream maintainer (pnpm/action-setup) at any time, silently repointing the tag to a different commit. GitHub Actions resolves the action ref at runtime, meaning any future workflow run would pull in whatever commit the tag currently points to — without any diff or PR review.

Why existing code does not prevent it

GitHub Actions has no built-in enforcement of SHA pinning. The other files in this PR were correctly updated to use the immutable SHA, but deploy-docs.yml was only updated from @v5 to @v6.0.1, maintaining the mutable-tag pattern. Notably, the entire deploy-docs.yml file consistently uses mutable version tags for all its actions (actions/checkout@v6, actions/setup-node@v6, cloudflare/wrangler-action@v3), not just the pnpm/action-setup step.

Why this is pre-existing

Before this PR, the file used pnpm/action-setup@v5 — also a mutable tag. The PR did not introduce the mutable-tag pattern; it simply updated the version tag from @v5 to @v6.0.1. The supply chain risk existed before this PR and is not materially worsened by the change, which is why this is classified as pre-existing.

Impact

If the pnpm/action-setup repository were compromised or the tag repointed, the docs deployment workflow could execute arbitrary code with access to CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID secrets. However, the same risk exists from cloudflare/wrangler-action@v3 and other mutable tags in the same file.

How to fix it

Replace line 27 with the SHA-pinned reference used in all other workflow files:

uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1

Ideally, also convert the other mutable tags in deploy-docs.yml (actions/checkout@v6, actions/setup-node@v6, cloudflare/wrangler-action@v3) to SHA pins to fully align with the rest of the codebase.

Step-by-step proof

  1. Before this PR: deploy-docs.yml contains uses: pnpm/action-setup@v5 (mutable tag — pre-existing issue).
  2. This PR updates the line to uses: pnpm/action-setup@v6.0.1 (still a mutable tag).
  3. All 8 other workflow files in this PR are updated to uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1 (immutable SHA).
  4. An upstream maintainer force-pushes the v6.0.1 tag on pnpm/action-setup to a malicious commit.
  5. The next run of deploy-docs.yml silently executes the malicious code, which now has access to Cloudflare API tokens stored in GitHub secrets.


- name: Setup Node.js
uses: actions/setup-node@v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs-seo-aeo.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/prepare-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
fetch-depth: 0

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-on-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
fetch-depth: 0

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
fetch-depth: 0

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down Expand Up @@ -133,7 +133,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/stable-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
fetch-depth: 0

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
uses: pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v4

- name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
Expand Down
Loading