Zoltan Kochan
80c416274e
The GitHub Actions dependency checking in `outdated` and `update` hardcoded https://github.com as the git host of every `uses:` repository. On GitHub Enterprise Server, actions resolve against the GHES instance instead, so `git ls-remote` failed with "Repository not found" and the error aborted the entire command (the same failure mode existed for private or deleted action repositories on github.com). - Read refs failures per repository are now non-fatal: the repository is skipped with a `globalWarn` ("Skipping the GitHub Actions from ...") instead of failing the command. One warning per repository. - New `update.githubActionsServer` setting: the base URL of the GitHub server hosting the action repositories, used for both the git remote and the homepage links. Defaults to the GITHUB_SERVER_URL environment variable (set by GitHub runners, including GHES) and then https://github.com. Trailing slashes are stripped; the empty string counts as unset. - `update.githubActions: false` (explicit) now opts `pnpm outdated` and the interactive `pnpm update` out of GitHub Actions checking. Unset preserves the previous behavior, and the explicit `--include-github-actions` flag still overrides the config. Both stacks change together. On the pacquet side, the `outdated` command dispatch now threads the reporter type so the skip warnings reach the `globalWarn` channel, matching the TypeScript CLI's log emissions, and the recursive outdated now includes GitHub Actions, closing a pre-existing parity gap. Hardening: the skip warning is credential-redacted and stripped of control characters in both stacks (new redactAndSanitize export in the error package); the resolved server URL is restricted to http(s) (ERR_PNPM_GITHUB_ACTIONS_SERVER_PROTOCOL) so a repo-controlled value cannot select another git transport such as ext::; and the TypeScript getRepoRefs passes "--" before the repository URL like the Rust runner already did. The interactive update no longer re-enables actions after an explicit opt-out; only the --include-github-actions flag overrides it. Closes pnpm/pnpm#13220.
1.1 KiB
@pnpm/types, @pnpm/config.reader, @pnpm/deps.github-actions, @pnpm/deps.inspection.commands, @pnpm/error, @pnpm/installing.commands, @pnpm/resolving.git-resolver, pnpm, pacquet
| @pnpm/types | @pnpm/config.reader | @pnpm/deps.github-actions | @pnpm/deps.inspection.commands | @pnpm/error | @pnpm/installing.commands | @pnpm/resolving.git-resolver | pnpm | pacquet |
|---|---|---|---|---|---|---|---|---|
| minor | minor | minor | minor | minor | minor | patch | minor | minor |
Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #13220.
pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.
Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.