From e5c2aa1771f72c0f76b0ce72199a0fa4bc68051c Mon Sep 17 00:00:00 2001 From: humble-little-bear Date: Thu, 8 Oct 2026 13:34:22 +0800 Subject: [PATCH] ci: pin pnpm 10 in canary/publish workflows and set build-script approvals The canary and publish workflows installed pnpm with an unpinned 'npm install -g pnpm', which now resolves to pnpm 12. pnpm 11+ fails the install with ERR_PNPM_IGNORED_BUILDS for any build script that is not explicitly allowed (cpu-features, unrs-resolver), so the v0.5.x canary release failed. - Use pnpm/action-setup@v4 with version 10 and 'pnpm install --frozen-lockfile', matching the other workflows. - Replace the 'set this to true or false' allowBuilds placeholders with explicit false for cpu-features and unrs-resolver. --- .changeset/pin-pnpm-canary.md | 4 ++++ .github/workflows/canary-publish.yml | 7 ++++++- .github/workflows/publish.yml | 7 ++++++- pnpm-workspace.yaml | 9 +++++++-- 4 files changed, 23 insertions(+), 4 deletions(-) create mode 100644 .changeset/pin-pnpm-canary.md diff --git a/.changeset/pin-pnpm-canary.md b/.changeset/pin-pnpm-canary.md new file mode 100644 index 0000000..b73f848 --- /dev/null +++ b/.changeset/pin-pnpm-canary.md @@ -0,0 +1,4 @@ +--- +--- + +ci: pin pnpm 10 in the canary and publish workflows and set explicit build-script approvals so installs no longer pick up the latest pnpm major. diff --git a/.github/workflows/canary-publish.yml b/.github/workflows/canary-publish.yml index 0f36e65..f5a8bb0 100644 --- a/.github/workflows/canary-publish.yml +++ b/.github/workflows/canary-publish.yml @@ -16,13 +16,18 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Setup pnpm + uses: pnpm/action-setup@v4 + with: + version: 10 + - uses: actions/setup-node@v4 with: node-version: '20.x' registry-url: 'https://registry.npmjs.org' - name: Install dependencies - run: npm install -g pnpm && pnpm i + run: pnpm install --frozen-lockfile - name: Set up Git identity run: | diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 48d4332..aa2c392 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -13,13 +13,18 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Setup pnpm + uses: pnpm/action-setup@v4 + with: + version: 10 + - uses: actions/setup-node@v4 with: node-version: '20.x' registry-url: 'https://registry.npmjs.org' - name: Install dependencies - run: npm install -g pnpm && pnpm i + run: pnpm install --frozen-lockfile - name: Verify changesets are consumed if: startsWith(github.ref, 'refs/tags/') diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index c651bcf..fca59b4 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -70,6 +70,11 @@ minimumReleaseAgeExclude: - "@hono/node-server@2.0.10" - "@modelcontextprotocol/sdk@1.31.0" +# Build-script approvals read by newer pnpm (11+ fails the install on any unlisted build script). +# - cpu-features: optional runtime dep of the CLI; src/node/install.ts falls back to the portable CKB +# binary when it is not compiled, and it is kept external in the ncc bundle so end users build it +# on their own install. Nothing in this repo's build/tests needs the native addon. +# - unrs-resolver: its postinstall only checks for the prebuilt @unrs/resolver-binding-* package. allowBuilds: - cpu-features: set this to true or false - unrs-resolver: set this to true or false + cpu-features: false + unrs-resolver: false