Zoltan Kochan
80c416274e
The GitHub Actions dependency checking in `outdated` and `update` hardcoded https://github.com as the git host of every `uses:` repository. On GitHub Enterprise Server, actions resolve against the GHES instance instead, so `git ls-remote` failed with "Repository not found" and the error aborted the entire command (the same failure mode existed for private or deleted action repositories on github.com). - Read refs failures per repository are now non-fatal: the repository is skipped with a `globalWarn` ("Skipping the GitHub Actions from ...") instead of failing the command. One warning per repository. - New `update.githubActionsServer` setting: the base URL of the GitHub server hosting the action repositories, used for both the git remote and the homepage links. Defaults to the GITHUB_SERVER_URL environment variable (set by GitHub runners, including GHES) and then https://github.com. Trailing slashes are stripped; the empty string counts as unset. - `update.githubActions: false` (explicit) now opts `pnpm outdated` and the interactive `pnpm update` out of GitHub Actions checking. Unset preserves the previous behavior, and the explicit `--include-github-actions` flag still overrides the config. Both stacks change together. On the pacquet side, the `outdated` command dispatch now threads the reporter type so the skip warnings reach the `globalWarn` channel, matching the TypeScript CLI's log emissions, and the recursive outdated now includes GitHub Actions, closing a pre-existing parity gap. Hardening: the skip warning is credential-redacted and stripped of control characters in both stacks (new redactAndSanitize export in the error package); the resolved server URL is restricted to http(s) (ERR_PNPM_GITHUB_ACTIONS_SERVER_PROTOCOL) so a repo-controlled value cannot select another git transport such as ext::; and the TypeScript getRepoRefs passes "--" before the repository URL like the Rust runner already did. The interactive update no longer re-enables actions after an explicit opt-out; only the --include-github-actions flag overrides it. Closes pnpm/pnpm#13220.
18 lines
1.1 KiB
Markdown
18 lines
1.1 KiB
Markdown
---
|
|
"@pnpm/types": minor
|
|
"@pnpm/config.reader": minor
|
|
"@pnpm/deps.github-actions": minor
|
|
"@pnpm/deps.inspection.commands": minor
|
|
"@pnpm/error": minor
|
|
"@pnpm/installing.commands": minor
|
|
"@pnpm/resolving.git-resolver": patch
|
|
"pnpm": minor
|
|
"pacquet": minor
|
|
---
|
|
|
|
Added a new setting, `update.githubActionsServer`, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the `GITHUB_SERVER_URL` environment variable, falling back to `https://github.com`. The URL must use the `https://` or `http://` protocol [#13220](https://github.com/pnpm/pnpm/issues/13220).
|
|
|
|
`pnpm outdated` and `pnpm update` no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.
|
|
|
|
Setting `update.githubActions` to `false` now makes `pnpm outdated` and the interactive `pnpm update` skip GitHub Actions dependencies.
|