chore: convert repo from npm to pnpm#1
Conversation
- Add packageManager field (pnpm@11.6.0) and pnpm-lock.yaml - Update CI and publish workflows to use pnpm/action-setup and pnpm commands - Update prepublishOnly script and docs (README, PROFILING) to pnpm
📝 WalkthroughWalkthroughThis PR migrates the repository from npm to pnpm as the package manager. Changes include declaring pnpm@11.6.0 in package.json, updating CI and release GitHub Actions workflows to use pnpm commands with appropriate flags, and updating all documentation examples to show pnpm usage. ChangesPackage Manager Migration to pnpm
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 23-24: The workflow uses tag-pinned actions (pnpm/action-setup@v4,
actions/setup-node@v6, actions/checkout@v6,
fastify/github-action-merge-dependabot@v3); replace each tag ref with the
corresponding full commit SHA (e.g., pnpm/action-setup@<commit-sha>) by looking
up the canonical action repo and using the exact commit SHA you want to pin,
updating the refs in .github/workflows/ci.yml so all four actions are referenced
by their full commit SHAs instead of the tag names.
- Around line 26-32: Remove the unsupported always-auth input from the
actions/setup-node@v6 step (delete the always-auth: false line) so the workflow
no longer supplies an invalid input, and update the workflow action references
(e.g., actions/checkout@v6, pnpm/action-setup@v4, actions/setup-node@v6,
fastify/github-action-merge-dependabot@v3) to pinned immutable commit SHAs
instead of floating tags to harden the supply chain.
In @.github/workflows/publish.yml:
- Around line 26-27: Replace floating action tags with immutable commit SHAs:
pin pnpm/action-setup@v4, actions/setup-node@v6 and actions/checkout@v6 used in
the publish workflow to their corresponding full commit SHAs (replace the `@vX`
style with @<commit-sha>), and make the same change for the unpinned actions in
the CI workflow; ensure each action reference is updated to a specific commit
SHA rather than a version tag so the workflows become immutable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a2ea7cf8-1260-43e1-8ced-4569de77639a
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
.github/workflows/ci.yml.github/workflows/publish.ymlPROFILING.mdREADME.mdpackage.json
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant portion of the workflow around the referenced lines
sed -n '1,120p' .github/workflows/ci.yml | nl -ba | sed -n '15,60p'
# Confirm all `uses:` entries in the workflow for security pinning review
rg -n "^\s*- uses:\s*" .github/workflows/ci.ymlRepository: kibertoad/json-river
Length of output: 107
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Print with line numbers using awk (since `nl` isn't available)
awk 'NR>=1 && NR<=120 {printf "%4d:%s\n", NR, $0}' .github/workflows/ci.yml | sed -n '15,80p'
# List all `uses:` entries in the workflow
rg -n '^\s*- uses:\s*' .github/workflows/ci.ymlRepository: kibertoad/json-river
Length of output: 1237
Pin GitHub Actions to full commit SHAs in .github/workflows/ci.yml
pnpm/action-setup@v4 and actions/setup-node@v6 are tag-pinned; replace the tag refs with full commit SHAs to strengthen CI supply-chain guarantees. (Also tag-pinned: actions/checkout@v6 and fastify/github-action-merge-dependabot@v3.)
Suggested fix
- - name: Setup pnpm
- uses: pnpm/action-setup@v4
+ - name: Setup pnpm
+ uses: pnpm/action-setup@<FULL_COMMIT_SHA>
- name: Setup Node ${{ matrix.node-version }}
- uses: actions/setup-node@v6
+ uses: actions/setup-node@<FULL_COMMIT_SHA>🧰 Tools
🪛 zizmor (1.25.2)
[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 23 - 24, The workflow uses tag-pinned
actions (pnpm/action-setup@v4, actions/setup-node@v6, actions/checkout@v6,
fastify/github-action-merge-dependabot@v3); replace each tag ref with the
corresponding full commit SHA (e.g., pnpm/action-setup@<commit-sha>) by looking
up the canonical action repo and using the exact commit SHA you want to pin,
updating the refs in .github/workflows/ci.yml so all four actions are referenced
by their full commit SHAs instead of the tag names.
Source: Linters/SAST tools
| - name: Setup Node ${{ matrix.node-version }} | ||
| uses: actions/setup-node@v6 | ||
| with: | ||
| always-auth: false | ||
| node-version: ${{ matrix.node-version }} | ||
| cache: 'pnpm' | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "=== File: $FILE ==="
ls -la "$FILE" || true
echo "--- Lines 1-120 (context) ---"
nl -ba "$FILE" | sed -n '1,140p'
echo "--- Lines 20-60 (target) ---"
nl -ba "$FILE" | sed -n '20,70p'
echo "=== Actions used in $FILE (quick scan) ==="
rg -n "uses:\s*([^ \n]+)" "$FILE" -o --no-filename | sed -n '1,200p' || true
echo "=== Full uses: lines (no regex truncation) ==="
rg -n "^\s*uses:\s*" "$FILE" || trueRepository: kibertoad/json-river
Length of output: 268
🌐 Web query:
actions/setup-node v6 input always-auth
💡 Result:
In actions/setup-node version 6, the always-auth input has been completely removed [1][2]. This input was deprecated because always-auth is no longer supported or required by modern versions of the npm CLI [2][3]. To prevent workflow errors or warnings, you must remove any references to always-auth from your GitHub Actions configuration files [1][4]. If your specific workflow requirements necessitate the use of always-auth (for example, if you are using an older version of npm that still requires it), you will need to pin your action to a version prior to v6 [3].
Citations:
- 1: https://github.com/actions/setup-node/blob/v6/README.md
- 2: Remove always-auth configuration handling from action actions/setup-node#1436
- 3: Stop adding
always-authto the.npmrcfile actions/setup-node#1305 - 4: https://github.com/actions/setup-node?tab=readme-ov-file
🌐 Web query:
actions/setup-node always-auth input
💡 Result:
The always-auth input in the actions/setup-node GitHub Action has been removed [1][2]. It is deprecated and no longer supported in modern versions of npm [2][3]. To avoid warnings or errors in your workflows, you should remove any existing references to always-auth from your workflow configuration files [1][4]. This change was implemented to align with current npm best practices, as the always-auth configuration was removed from the npm CLI several years ago [2][5].
Citations:
- 1: https://github.com/actions/setup-node/blob/main/README.md
- 2: Remove always-auth configuration handling from action actions/setup-node#1436
- 3: actions/setup-node@b9b25d4
- 4: https://github.com/actions/setup-node/blob/v6/README.md
- 5: Stop adding
always-authto the.npmrcfile actions/setup-node#1305
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "=== ls ==="
ls -la "$FILE"
echo "=== File contents (numbered, full) ==="
awk '{printf "%5d\t%s\n", NR, $0}' "$FILE"
echo "=== uses: entries ==="
rg -n "^\s*uses:\s*" "$FILE" || true
echo "=== any always-auth references ==="
rg -n "always-auth" "$FILE" || trueRepository: kibertoad/json-river
Length of output: 1762
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "=== All uses: occurrences ==="
rg -n "uses:" "$FILE"
echo "=== Check for pinned SHA patterns (40+ hex after @) ==="
rg -n "uses:\s*[^@\s]+@([0-9a-f]{40,})" "$FILE" || true
echo "=== Check for major-tag style (`@vN`) ==="
rg -n "uses:\s*[^@\s]+@v[0-9]+" "$FILE" || trueRepository: kibertoad/json-river
Length of output: 536
Remove unsupported always-auth input from actions/setup-node@v6
ci.yml sets always-auth: false for actions/setup-node@v6 (line 29), but always-auth is not supported in v6 and can cause workflow validation/lint errors.
Suggested fix
- name: Setup Node ${{ matrix.node-version }}
uses: actions/setup-node@v6
with:
- always-auth: false
node-version: ${{ matrix.node-version }}
cache: 'pnpm'Also pin action references to immutable commit SHAs for supply-chain hardening (e.g., actions/checkout@v6, pnpm/action-setup@v4, actions/setup-node@v6, fastify/github-action-merge-dependabot@v3).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Setup Node ${{ matrix.node-version }} | |
| uses: actions/setup-node@v6 | |
| with: | |
| always-auth: false | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'pnpm' | |
| - name: Setup Node ${{ matrix.node-version }} | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'pnpm' |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 29-29: input "always-auth" is not defined in action "actions/setup-node@v6". available inputs are "architecture", "cache", "cache-dependency-path", "check-latest", "mirror", "mirror-token", "node-version", "node-version-file", "package-manager-cache", "registry-url", "scope", "token"
(action)
🪛 zizmor (1.25.2)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 26 - 32, Remove the unsupported
always-auth input from the actions/setup-node@v6 step (delete the always-auth:
false line) so the workflow no longer supplies an invalid input, and update the
workflow action references (e.g., actions/checkout@v6, pnpm/action-setup@v4,
actions/setup-node@v6, fastify/github-action-merge-dependabot@v3) to pinned
immutable commit SHAs instead of floating tags to harden the supply chain.
Source: Linters/SAST tools
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the reported section of publish.yml
sed -n '1,120p' .github/workflows/publish.yml | nl -ba | sed -n '15,110p'
# Extract all action uses in publish.yml (for pinning/unpinning context)
rg -n "^\s*uses:\s*" .github/workflows/publish.yml
# Check other workflows for floating action tags (same actions)
rg -n "uses:\s*(pnpm/action-setup@|actions/setup-node@)" .github/workflows || true
# Report all pnpm/action-setup and actions/setup-node occurrences with file+line
rg -n --hidden --glob '!.git/*' "pnpm/action-setup@|actions/setup-node@" .github/workflows || trueRepository: kibertoad/json-river
Length of output: 107
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Sanity: confirm file exists
ls -la .github/workflows/publish.yml
echo "---- publish.yml (around lines 20-50) ----"
# Print with line numbers (NR from awk)
awk 'NR>=15 && NR<=60 {printf "%5d %s\n", NR, $0}' .github/workflows/publish.yml
echo "---- All uses: lines in publish.yml ----"
rg -n "^\s*uses:\s*" .github/workflows/publish.yml
echo "---- Floating tags for pnpm/action-setup and actions/setup-node across workflows ----"
rg -n "uses:\s*(pnpm/action-setup@v|actions/setup-node@v)" .github/workflows || true
echo "---- All occurrences of pnpm/action-setup@ and actions/setup-node@ across workflows ----"
rg -n "pnpm/action-setup@|actions/setup-node@" .github/workflows || trueRepository: kibertoad/json-river
Length of output: 2666
Pin GitHub Actions to immutable SHAs in publish (and CI) workflows
pnpm/action-setup@v4 (publish.yml:27) and actions/setup-node@v6 (publish.yml:30) use floating tags; pin to full commit SHAs. Same actions are also unpinned in .github/workflows/ci.yml, and actions/checkout@v6 is unpinned in publish.yml (line 21).
Suggested fix
- - name: Setup pnpm
- uses: pnpm/action-setup@v4
+ - name: Setup pnpm
+ uses: pnpm/action-setup@<FULL_COMMIT_SHA>
- name: Setup Node
- uses: actions/setup-node@v6
+ uses: actions/setup-node@<FULL_COMMIT_SHA>Version bump is constrained to major|minor|patch, so no template-injection mitigation is needed there.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 26 - 27, Replace floating action
tags with immutable commit SHAs: pin pnpm/action-setup@v4, actions/setup-node@v6
and actions/checkout@v6 used in the publish workflow to their corresponding full
commit SHAs (replace the `@vX` style with @<commit-sha>), and make the same change
for the unpinned actions in the CI workflow; ensure each action reference is
updated to a specific commit SHA rather than a version tag so the workflows
become immutable.
Source: Linters/SAST tools
2 participants
Summary by CodeRabbit
Chores
Documentation