Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ jobs:

strategy:
matrix:
node-version: [16.x, 18.x]
node-version: [18.x]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pnpm 9.0.0 discontinued support for node 16

package:
- cli
- core
Expand All @@ -22,9 +22,7 @@ jobs:

steps:
- uses: actions/checkout@v3
- uses: pnpm/action-setup@v2
with:
version: 7
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we not use the v4.1.0 tag?

Copy link
Contributor Author

@ItsHarper ItsHarper Aug 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could, but a tag can be later updated, so if a malicious person gained write access to the pnpm actions repo, they could run malicious code in this workflow without us having to do anything.

Specifying a commit provides the same protection for actions that checking in a lockfile with hashes does for npm dependencies.

I'm less worried about the official GitHub ones. In all likelihood, it would be very difficult for a rogue GitHub employee to deploy malicious code, and if they did, ~everyone would be impacted.


- uses: actions/setup-node@v3
with:
Expand Down
1 change: 0 additions & 1 deletion .node-version

This file was deleted.

3 changes: 2 additions & 1 deletion CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ This project is written with [TypeScript](https://www.typescriptlang.org/), a su

## Developing

codemod expects at least node 16 and pnpm. You can check each of these with `node -v` and `pnpm -v`. Look for instructions on installing node [here](https://nodejs.org) and pnpm [here](https://pnpm.io/).
codemod expects at least node 18 and pnpm 10. You can check each of these with `node -v` and `pnpm -v`. Look for instructions on installing node [here](https://nodejs.org) and pnpm [here](https://pnpm.io/).
As long as you have pnpm 10 or later installed globally, pnpm will automatically run the version of pnpm specified in the `packageManager` field of `package.json`.

### Setup

Expand Down
3 changes: 2 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -43,5 +43,6 @@
},
"scripts": {
"prepare": "husky install"
}
},
"packageManager": "[email protected]+sha512.ad27a79641b49c3e481a16a805baa71817a04bbe06a38d17e60e2eaee83f6a146c6a688125f5792e48dd5ba30e7da52a5cda4c3992b9ccf333f9ce223af84748"
}
Loading
Loading