Skip to content

chore(ci): update Trunk setup action refs #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaysin586 merged 1 commit into from
Jun 18, 2026
Merged

chore(ci): update Trunk setup action refs #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .trunk/setup-ci/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ description: Set up dependencies for Trunk Code Quality
runs:
using: composite
steps:
- uses: pnpm/action-setup@v4 # zizmor: ignore[unpinned-uses]
- uses: pnpm/action-setup@v6 # zizmor: ignore[unpinned-uses]

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Find all pnpm/action-setup version references in the repository.

# Test: Search for all usages. Expect: All pinned to the same version.
rg -n 'pnpm/action-setup@' .github/ .trunk/

Repository: humanspeak/docs-kit

Length of output: 236

Update release workflow to use pnpm/action-setup@v6 for consistency.

This composite action is upgraded to @v6, but .github/workflows/release.yml:23 still pins pnpm/action-setup@v4. This creates environment divergence where workflows using the composite action get v6 behavior while the release workflow uses v4 behavior.

Update the release workflow to match the composite action's version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.trunk/setup-ci/action.yaml at line 7, The pnpm/action-setup version is
inconsistent across workflows - the composite action in setup-ci/action.yaml
uses `@v6` but the release workflow still uses `@v4`. Update the pnpm/action-setup
action reference in the release workflow from `@v4` to `@v6` to maintain consistency
with the composite action and ensure all workflows use the same version.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

pnpm/action-setup breaking changes v4 to v6

💡 Result:

The transition from pnpm/action-setup v4 to v6 introduced several changes and initial stability issues that have been addressed in subsequent patch releases. Primary Changes and Impacts: - Version Management: The v6 release updated the internal bootstrap version of pnpm, which caused conflicts in projects where a different version was requested via the version input or the packageManager field in package.json [1][2][3]. - PATH Precedence: Early v6 versions suffered from an issue where the bootstrap pnpm binary on the PATH shadowed the self-updated (requested) version. This was addressed by modifying the PATH setup order to ensure the target version takes precedence [2][4][3]. - Lockfile Churn: Initial v6 releases caused unexpected modifications to pnpm-lock.yaml when used in conjunction with actions/setup-node and its pnpm cache feature. This was mitigated in version 6.0.1 and subsequent updates [5][6]. Migration Recommendations: - If you are upgrading, it is highly recommended to use the latest version of pnpm/action-setup (v6.0.9 or higher) to benefit from fixes regarding version resolution, PATH precedence, and lockfile stability [7][4]. - If you encounter issues with version resolution, ensure you are not relying on potentially stale environment state; explicit version pinning in your workflow remains a reliable way to avoid ambiguity [1][2]. For the most up-to-date implementation, refer to the official pnpm documentation for GitHub Actions, which currently reflects the usage of v6 [8].

Citations:

🏁 Script executed:

cat -n .trunk/setup-ci/action.yaml

Repository: humanspeak/docs-kit

Length of output: 703

Pin pnpm/action-setup to a specific patch version to avoid known breaking change issues.

The v4-to-v6 migration introduced breaking changes including version management conflicts, PATH precedence issues, and lockfile churn when used with actions/setup-node. While these have been fixed in v6.0.1+ and especially v6.0.9+, using @v6 without a patch version pin risks pulling an older release with these issues. Use pnpm/action-setup@v6.0.9 or higher to ensure compatibility with the version: 10 input and the downstream actions/setup-node usage.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.trunk/setup-ci/action.yaml at line 7, In the action.yaml file, update the
pnpm/action-setup action reference from the unpinned version `@v6` to a specific
patch version `@v6.0.9` or higher. This ensures compatibility and avoids known
breaking changes from earlier v6 releases. The line with `uses:
pnpm/action-setup@v6` should be changed to specify the full semantic version
including the patch number to guarantee consistent behavior with the downstream
actions/setup-node usage.

with:
version: 10

Expand Down
Loading