ci: pin pnpm 10 in canary/publish workflows and set build-script approvals

.changeset/pin-pnpm-canary.md

@@ -0,0 +1,4 @@
+---
+---
+
+ci: pin pnpm 10 in the canary and publish workflows and set explicit build-script approvals so installs no longer pick up the latest pnpm major.

.github/workflows/canary-publish.yml

@@ -16,13 +16,18 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
       - uses: actions/setup-node@v4
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
-        run: npm install -g pnpm && pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Set up Git identity
         run: |

.github/workflows/publish.yml

@@ -13,13 +13,18 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
       - uses: actions/setup-node@v4
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
-        run: npm install -g pnpm && pnpm i 
+        run: pnpm install --frozen-lockfile
 
       - name: Verify changesets are consumed
         if: startsWith(github.ref, 'refs/tags/')

pnpm-workspace.yaml

@@ -70,6 +70,11 @@ minimumReleaseAgeExclude:
   - "@hono/node-server@2.0.10"
   - "@modelcontextprotocol/sdk@1.31.0"
 
+# Build-script approvals read by newer pnpm (11+ fails the install on any unlisted build script).
+# - cpu-features: optional runtime dep of the CLI; src/node/install.ts falls back to the portable CKB
+#   binary when it is not compiled, and it is kept external in the ncc bundle so end users build it
+#   on their own install. Nothing in this repo's build/tests needs the native addon.
+# - unrs-resolver: its postinstall only checks for the prebuilt @unrs/resolver-binding-* package.
 allowBuilds:
-  cpu-features: set this to true or false
-  unrs-resolver: set this to true or false
+  cpu-features: false
+  unrs-resolver: false