Give wildcard matching and GitHub Actions dependency handling independent
crate boundaries. Preserve config's matcher reexport and keep CLI opt-in
policy separate from workflow processing.
Replace duplicate literal-star matchers in global listing and versioning
with the shared compiled matcher, preserving each caller's negation and
empty-selector behavior. Remove configuration from workspace filtering's
production dependency graph and move YAML dependencies out of the CLI.
Validate planned workflow edits against freshly read action text after
asynchronous Git lookups. Reject stale ranges without overwriting the
changed workflow. Redact homepage credentials and restrict GitHub server
URLs to HTTPS or loopback HTTP in both CLI versions, with regression tests
and a shared release note.
Follow-up to pnpm/pnpm#14804.
Zoltan Kochan
8d4b588669