mirror of
https://github.com/pnpm/pnpm.git
synced 2026-10-31 03:58:35 -04:00
docs-migration-runtime-setting
16
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Zoltan Kochan
|
9d3b6c58ae |
feat(docker): publish an Alpine variant of the pnpm image (#17069)
Adds `<version>-alpine`, `<major>-alpine`, and `alpine` tags built from docker/Dockerfile.alpine with the musl release tarball. Alpine users can use the image as a base or copy /opt/pnpm into `node:*-alpine` without fetching the installer from get.pnpm.io, which was returning 403 to bursts of concurrent CI jobs. The download, checksum, and version check move into docker/install-pnpm.sh, shared by both Dockerfiles. The Alpine image also installs libstdc++ and libgcc, which the musl Node.js builds installed by `pnpm runtime` need. The Alpine build runs only for releases that ship musl tarballs for both x64 and arm64, so v11 and v10 releases skip it. Every release used to publish the `latest` and `<major>` tags, so a v11 maintenance release moved `latest` back to v11. The builds now push only the exact version tags. A final step lists the stable releases and, with `docker buildx imagetools create`, points `<major>` at the highest version in that major and `latest` at the highest version overall. The Alpine tags follow the same rule. Deciding after the builds sees every release of a burst, since lines are published seconds apart. A concurrency group was rejected because GitHub cancels a pending run when a third one queues. The selection lives in .github/scripts/docker-image-tags.sh with a test run by CI, and fails on an empty release list. The v12 CI docs now run the Bitbucket Pipelines and GitLab CI examples in `ghcr.io/pnpm/pnpm:12` instead of downloading the installer, and recommend the image for CI that runs jobs in containers. CircleCI keeps the installer because its checkout step needs git and ssh. The CI examples that still use the standalone script fall back to the latest pnpm/get.pnpm.io installer release when get.pnpm.io fails. They run the script only after a download succeeds. Related to pnpm/pnpm#16973. |
||
|
Zoltan Kochanandgithub-actions[bot]
|
5276e7402b |
chore: update dependencies, Node.js, pnpm, and GitHub Actions (#15003)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
Zoltan Kochanandgithub-actions[bot]
|
49dbe22c32 |
chore: update dependencies, Node.js, pnpm, and GitHub Actions (#14922)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
Zoltan Kochan
|
d34902d5a6 | chore: update dependencies, Node.js, pnpm, and GitHub Actions (#14400) | ||
|
Zoltan Kochan
|
d754f7f413 | fix: ignore non-pnpm releases in Docker workflow (#14391) | ||
|
Zoltan Kochanandgithub-actions[bot]
|
c233e72abe |
chore: update dependencies, Node.js, pnpm, and GitHub Actions (#14006)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
Zoltan Kochanandgithub-actions[bot]
|
13f5820de9 |
chore: update dependencies, Node.js, pnpm, and GitHub Actions (#13480)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
|
baca5d63a5 |
chore: update lockfile, Node.js, and pnpm versions (#13224)
* chore: update dependencies, Node.js, pnpm, and GitHub Actions * chore: hold typescript on 6.x for typescript-eslint compatibility The update-lockfile job bumped the `typescript` catalog entry to 7.0.2, which typescript-eslint refuses to load against — it hard-errors at load with "typescript-eslint does not support TS 7.0" — failing the Compile & Lint job. The 7.x compiler is already used for the build via `@typescript/native-preview` (tsgo); the `typescript` npm package only serves the JS-API tooling (eslint, jest), which needs 6.x until typescript-eslint adds TS >=7.1 support (https://github.com/typescript-eslint/typescript-eslint/issues/10940). Revert the catalog entry to 6.0.3 and add `typescript` to `update.ignoreDeps` so the update-lockfile workflow stops re-bumping it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: drop the stray typescript@7.0.2 from the lockfile openpgp declares an optional `typescript` peer (>=4.7). After the catalog was reverted to 6.0.3, pnpm's incremental resolution kept openpgp latched onto the leftover typescript@7.0.2 node, leaving it (and its native platform packages) in the lockfile and tripping peer-mismatch review bots. Re-point openpgp's optional peer to 6.0.3 so typescript@7.0.2 is gone entirely; the openpgp subtree is now identical to the base branch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]
|
bfb1b1308f |
chore(deps): bump the github-actions group across 1 directory with 12 updates (#12905)
Bumps the github-actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.1.0` | `4.2.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.2.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.2.0` | `7.3.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.5` | `2.83.1` | | [crate-ci/typos](https://github.com/crate-ci/typos) | `1.47.2` | `1.48.0` | | [garnet-org/action](https://github.com/garnet-org/action) | `2.0.2` | `2.2.0` | | [warpdotdev/oz-agent-action](https://github.com/warpdotdev/oz-agent-action) | `1.0.21` | `1.0.24` | Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](https://github.com/dorny/paths-filter/compare/fbd0ab8f3e69293af611ebaee6363fc25e6d187d...7b450fff21473bca461d4b92ce414b9d0420d706) Updates `github/codeql-action/init` from 4.36.2 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) Updates `github/codeql-action/autobuild` from 4.36.2 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8) Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c) Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0) Updates `docker/build-push-action` from 7.2.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/f9f3042f7e2789586610d6e8b85c8f03e5195baf...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) Updates `taiki-e/install-action` from 2.82.5 to 2.83.1 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/bffeee26d4db9be238a4ea78d8826604ebcb594d...2ca9b94c269419b7b0c711c09d0b21c4e1d51145) Updates `crate-ci/typos` from 1.47.2 to 1.48.0 - [Release notes](https://github.com/crate-ci/typos/releases) - [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md) - [Commits](https://github.com/crate-ci/typos/compare/37bb98842b0d8c4ffebdb75301a13db0267cef89...bee27e3a4fd1ea2111cf90ab89cd076c870fce14) Updates `garnet-org/action` from 2.0.2 to 2.2.0 - [Release notes](https://github.com/garnet-org/action/releases) - [Commits](https://github.com/garnet-org/action/compare/2b7fc9d79b54f551b43358c27424a36064b3e078...3d47f4a9004f7356c980a0e8d420ef5984750e3c) Updates `warpdotdev/oz-agent-action` from 1.0.21 to 1.0.24 - [Release notes](https://github.com/warpdotdev/oz-agent-action/releases) - [Commits](https://github.com/warpdotdev/oz-agent-action/compare/1922f22c008c6263607a398f31c80299349a1fa6...fcbed2c2043c310881424f41757da05d5c9d4047) --- updated-dependencies: - dependency-name: crate-ci/typos dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: garnet-org/action dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.82.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: warpdotdev/oz-agent-action dependency-version: 1.0.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Zoltan Kochan
|
b75311cea7 |
ci: migrate workflows to Blacksmith runners (#13043)
Move non-npm-trusted-publishing GitHub Actions jobs to Blacksmith runner labels. Use larger Blacksmith runners for heavier build, Docker, benchmark, Windows, and macOS jobs, while leaving the npm OIDC trusted-publishing publish jobs on GitHub-hosted runners. npm trusted publishing currently does not support self-hosted runner providers, so the TypeScript pnpm publish job, Rust pnpm publish job, and pnpr publish job keep their GitHub-hosted labels. Keep benchmark artifact names stable so follow-up workflow_run jobs on the default branch keep matching the producing benchmark jobs. |
||
|
YES!HYUNGSEOKandClaude
|
11c9fb168f |
ci: gate the docker.yml workflow_dispatch build behind the release environment (#12639)
The Docker workflow can be triggered via workflow_dispatch, and its build job pushes mutable tags (:latest and :<major>) to ghcr.io/pnpm/pnpm. Unlike release.yml and update-latest.yml, the build job had no environment gate, so any collaborator with write access could publish an image to the public mutable tags without reviewer approval. Add an environment: release gate to the build job so workflow_dispatch runs require approval from the release environment reviewers, matching the protection already used by the other publishing workflows. The release (published) event path is unaffected. Co-authored-by: Claude <noreply@anthropic.com> |
||
|
dependabot[bot]
|
270aa1d713 |
chore(deps): bump the github-actions group across 1 directory with 4 updates (#12621)
Bumps the github-actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [pnpm/setup](https://github.com/pnpm/setup), [bencherdev/bencher](https://github.com/bencherdev/bencher) and [taiki-e/install-action](https://github.com/taiki-e/install-action). Updates `actions/checkout` from 6.0.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) Updates `pnpm/setup` from b1cac37306e39c21283b9dd6cb0ac288fb35ba6b to 77cf06832101b3ac8c65caaf76a21643936d07a4 - [Release notes](https://github.com/pnpm/setup/releases) - [Commits](https://github.com/pnpm/setup/compare/b1cac37306e39c21283b9dd6cb0ac288fb35ba6b...77cf06832101b3ac8c65caaf76a21643936d07a4) Updates `bencherdev/bencher` from 0.6.6 to 0.6.7 - [Release notes](https://github.com/bencherdev/bencher/releases) - [Commits](https://github.com/bencherdev/bencher/compare/50fb1e138651a46d2fb704fab1adab38c181552e...ec56bb69a7f34096002ca3384d10e2f6676b063e) Updates `taiki-e/install-action` from 2.81.8 to 2.82.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/0631aa6515c7d545823c67cfae7ef4fc7f490154...b8cecb83565409bcc297b2df6e77f030b2a468d5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: bencherdev/bencher dependency-version: 0.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: pnpm/setup dependency-version: 77cf06832101b3ac8c65caaf76a21643936d07a4 dependency-type: direct:production dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.82.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8cec791e38 |
chore(deps): bump the github-actions group across 1 directory with 4 updates (#12356)
Bumps the github-actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action](https://github.com/github/codeql-action), [taiki-e/install-action](https://github.com/taiki-e/install-action) and [crate-ci/typos](https://github.com/crate-ci/typos). Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10) Updates `github/codeql-action` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e) Updates `taiki-e/install-action` from 2.79.14 to 2.81.8 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/873c7452cadb7c034694a1282227095d93fbdf92...0631aa6515c7d545823c67cfae7ef4fc7f490154) Updates `crate-ci/typos` from 1.47.0 to 1.47.2 - [Release notes](https://github.com/crate-ci/typos/releases) - [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md) - [Commits](https://github.com/crate-ci/typos/compare/f8a58b6b53f2279f71eb605f03a4ae4d10608f45...37bb98842b0d8c4ffebdb75301a13db0267cef89) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: crate-ci/typos dependency-version: 1.47.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.81.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
04473e027c |
chore(deps): bump the github-actions group across 1 directory with 10 updates (#12220)
Bumps the github-actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.5` | `4.36.0` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.0.0` | `4.1.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.1.0` | `7.2.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.78.1` | `2.79.14` | | [crate-ci/typos](https://github.com/crate-ci/typos) | `1.46.1` | `1.47.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` | | [cbrgm/mastodon-github-action](https://github.com/cbrgm/mastodon-github-action) | `2.2.0` | `2.2.1` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.5` | `0.5.6` | Updates `github/codeql-action` from 4.35.5 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9e0d7b8d25671d64c341c19c0152d693099fb5ba...7211b7c8077ea37d8641b6271f6a365a22a5fbfa) Updates `docker/setup-qemu-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/ce360397dd3f832beb865e1373c09c0e9f86d70a...06116385d9baf250c9f4dcb4858b16962ea869c3) Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5) Updates `docker/login-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee) Updates `docker/build-push-action` from 7.1.0 to 7.2.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/bcafcacb16a39f128d818304e6c9c0c18556b85f...f9f3042f7e2789586610d6e8b85c8f03e5195baf) Updates `taiki-e/install-action` from 2.78.1 to 2.79.14 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/184183c2401be73c3bf42c2e61268aa5855379c1...873c7452cadb7c034694a1282227095d93fbdf92) Updates `crate-ci/typos` from 1.46.1 to 1.47.0 - [Release notes](https://github.com/crate-ci/typos/releases) - [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md) - [Commits](https://github.com/crate-ci/typos/compare/5374cbf686e897b15713110e233094e2874de7ef...f8a58b6b53f2279f71eb605f03a4ae4d10608f45) Updates `codecov/codecov-action` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354) Updates `cbrgm/mastodon-github-action` from 2.2.0 to 2.2.1 - [Release notes](https://github.com/cbrgm/mastodon-github-action/releases) - [Commits](https://github.com/cbrgm/mastodon-github-action/compare/776364a15dd1171530479600c75363f7cbc89ef5...244bbe72e61b4490e2dc1c34f9537ae9299ae601) Updates `zizmorcore/zizmor-action` from 0.5.5 to 0.5.6 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/a16621b09c6db4281f81a93cb393b05dcd7b7165...5f14fd08f7cf1cb1609c1e344975f152c7ee938d) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.79.14 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: crate-ci/typos dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: cbrgm/mastodon-github-action dependency-version: 2.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Zoltan Kochan
|
6b2a955a15 |
ci: address zizmor findings across workflows (#11608)
Resolves all 30 zizmor alerts reported on main after #11607: - template-injection (19): move `${{ ... }}` interpolations in `run:` blocks to `env:` so untrusted-ish values (workflow_dispatch inputs, github.ref_name, github.actor) can't break out of shell quoting. - artipacked (8): add `persist-credentials: false` to `actions/checkout` in audit, benchmark, ci, codeql-analysis, docker, release, test workflows. `update-lockfile.yml` keeps the persisted token (later step pushes to a branch) with a `zizmor: ignore[artipacked]` comment and justification. - dependabot-cooldown (1): add a 7-day cooldown so brand-new (potentially malicious) Actions releases don't get auto-PR'd day-of-release. - ref-version-mismatch (1): `bluwy/release-for-reddit-action` SHA pointed at the `v2` tag, not a non-existent `v2.0.0`. Fix the comment. - superfluous-actions (1): mark `softprops/action-gh-release` with a `zizmor: ignore` and justification — the release pipeline is sensitive and the action is battle-tested; we're not swapping it for `gh release` here. Verified locally with `zizmor --persona regular .github` (online audits on): No findings to report. Good job! (2 ignored, 32 suppressed) --- Written by an agent (Claude Code, claude-opus-4-7). |
||
|
Zoltan Kochan
|
9ae1ca7253 |
feat: publish base docker image to GHCR (#11302)
* feat: publish base docker image to GHCR Adds a Dockerfile (debian:stable-slim + pnpm standalone binary) and a release-triggered workflow that builds multi-arch images and pushes to ghcr.io/pnpm/pnpm. Users who need Node.js can install it inside the container via `pnpm runtime set node <version>`. Refs #11300 * docs: add docker/README.md * chore(cspell): add buildx to dictionary * docs: mention devEngines.runtime as alternative to pnpm runtime set * fix(docker): pin base image, verify tarball sha256, harden download - Pin `debian:stable-slim` to a digest for reproducibility. - Compute pnpm tarball SHA256 in the workflow and verify it inside the build, detecting tampered artifacts regardless of what `pnpm --version` reports. - Download the tarball to disk with `--retry` instead of `curl | tar` for resilience under multi-arch QEMU builds. - README: use `--load` so the local test image is available to `docker run`. * chore(cspell): sort dictionary additions * fix(docker): address Copilot review feedback - Include $PNPM_HOME/bin on PATH so pnpm-installed globals (node, etc.) are discoverable, and make $PNPM_HOME writable for non-root users. - Document that `pnpm runtime set node` needs `-g` to install globally. - Pass workflow inputs via env: instead of inlining GitHub expressions into shell, and validate the version string before use. * fix(docker): install libatomic1 for pnpm standalone binary The pnpm linux standalone binary dynamically links against libatomic.so.1, which is not present in debian:stable-slim by default. Without it, `pnpm --version` fails during the build with: pnpm: error while loading shared libraries: libatomic.so.1: cannot open shared object file: No such file or directory Caught by local build testing. |