[WIP] BB-3615 - Upgrade to pnpm 11 and add secutiry settings#1
Open
AlexArchiPro wants to merge 27 commits into
Open
[WIP] BB-3615 - Upgrade to pnpm 11 and add secutiry settings#1AlexArchiPro wants to merge 27 commits into
AlexArchiPro wants to merge 27 commits into
Conversation
When a project has both npm and pnpm, using pnpm/action-setup will result in an error: `Multiple versions of pnpm specified`. The previous implementation was only meant to avoid the "ERR_PNPM_BAD_PM_VERSION" error, but it did not take into account the situation of multiple different package managers. Signed-off-by: Kevin Cui <bh@bugs.cc>
copy .npmrc from GitHub workspace if it exists so that PNPM respects custom registry configurations when self-installing
fix the string run_install example
) * Clarify that package_json_file is relative to GITHUB_WORKSPACE Clarify the description for package_json_file parameter to specify that the path must be relative to the repository root. * Apply suggestion from @zkochan --------- Co-authored-by: Zoltan Kochan <z@kochan.io>
* add pnpm store caching * style: format * no semicolons * no star imports * import order * style: no star imports --------- Co-authored-by: khai96_ <hvksmr1996@gmail.com>
This reverts commit 9b5745c.
Fast-forward archiprocode/pnpm-action-setup v4 to upstream pnpm/action-setup v4 HEAD (commit b906aff). Fork is currently 0 commits ahead, 26 behind upstream v4 — zero archi-specific patches to preserve, conflict-free merge. This brings every consumer pinned `archiprocode/pnpm-action-setup@v4` (7 archiprocode repos, 25 CI callsites) onto the maintained upstream code. After this lands, the `v4` tag in the fork must be moved to the new HEAD so consumers pick up the change. Notable upstream patches included: - feat: store caching (pnpm#188) — pnpm store cache speedup - fix: not allow install multiple package manager (pnpm#161) — safety fix - feat: support installation from custom NPM registry (pnpm#179) - Plus 23 docs/refactor/CI fixes - Note: upstream's pnpm#205 (Node 24 action runtime) was reverted by b906aff, so action.yml#runs.using stays at node20 (consistent with upstream)
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| // copy .npmrc if it exists to install from custom registry | ||
| if (GITHUB_WORKSPACE) { | ||
| try { | ||
| await copyFile(path.join(GITHUB_WORKSPACE, '.npmrc'), path.join(dest, '.npmrc')) |
There was a problem hiding this comment.
🔒 Agentic Security Review
Severity: HIGH
This change copies repository-controlled .npmrc from GITHUB_WORKSPACE into the bootstrap install directory used to install pnpm. In workflows that run on untrusted PR content, this allows attacker-controlled registry configuration to influence the action's own dependency bootstrap.
Impact: an attacker can redirect package resolution to a malicious registry during bootstrap and potentially execute attacker-controlled install-time code under CI runner privileges, including possible token/secret exposure in privileged workflow contexts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fast-forward this fork's
v4branch to upstreampnpm/action-setup@v4HEAD (commitb906aff). Before this PR, the fork'sv4is at commitfe02b34—0 commits ahead, 26 commits behindupstream. Zero archi-specific patches to preserve, so the merge is conflict-free.This is the fork-maintenance step in the BB-3615 fleet rollout (see
docs/PLAN.md§ "Why we keep archiprocode/pnpm-action-setup@v4"). 7 archiprocode repos and 25 CI callsites consume@v4; this PR brings them onto the maintained upstream code.Why this is safe
gh api repos/pnpm/action-setup/compare/archiprocode:pnpm-action-setup:v4...pnpm:action-setup:v4→ahead_by: 0, behind_by: 26.@v4. Until thev4tag (not just branch) is moved to the new HEAD, no consumer is affected. Tag move is a deliberate follow-up step after merge.b906aff) is included —action.yml#runs.usingstays atnode20, matching upstream's current intent.What's included (upstream commits)
feat: store caching (#188)— pnpm store cache speedup;feat: support installation from custom NPM registry (#179);feat: support package.yaml (#156)fix: not allow install multiple package manager (#161);fix: add missing outputs metadata to action.yml (#127);fix: correct typo in error message (#125)feat: update dist;test: update pnpm to v9Revert "feat!: run the action on Node.js 24 (#205)"— action runtime stays on node20After merge — required tag move
The
v4tag must be moved to the new HEAD so every consumer pinned@v4picks up the change:```bash
git fetch origin
git tag -f v4 origin/v4
git push origin -f v4
```
Without the tag move, the merge does not propagate to consumer CI.
[WIP] lifecycle
Per BB-3615 convention, this PR opens
[WIP]and stays[WIP]until a human reviewer:v4tag move (or chooses to defer it).[WIP]prefix.Test plan
action.yml#runs.usingremainsnode20).v4tag move per the snippet above.archipro-mobile'spull-request.yml) and confirm pnpm install still succeeds.