-
Notifications
You must be signed in to change notification settings - Fork 19
build: update pnpm #929
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
build: update pnpm #929
Changes from all commits
648959e
b7ed132
8d07fb9
32e032c
d47d0f4
3766119
95a4336
dd185e8
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,7 @@ jobs: | |
|
|
||
| strategy: | ||
| matrix: | ||
| node-version: [16.x, 18.x] | ||
| node-version: [18.x] | ||
| package: | ||
| - cli | ||
| - core | ||
|
|
@@ -22,9 +22,7 @@ jobs: | |
|
|
||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: pnpm/action-setup@v2 | ||
| with: | ||
| version: 7 | ||
| - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 | ||
|
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can we not use the v4.1.0 tag?
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We could, but a tag can be later updated, so if a malicious person gained write access to the pnpm actions repo, they could run malicious code in this workflow without us having to do anything. Specifying a commit provides the same protection for actions that checking in a lockfile with hashes does for npm dependencies. I'm less worried about the official GitHub ones. In all likelihood, it would be very difficult for a rogue GitHub employee to deploy malicious code, and if they did, ~everyone would be impacted. |
||
|
|
||
| - uses: actions/setup-node@v3 | ||
| with: | ||
|
|
||
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,5 +43,6 @@ | |
| }, | ||
| "scripts": { | ||
| "prepare": "husky install" | ||
| } | ||
| }, | ||
| "packageManager": "[email protected]+sha512.ad27a79641b49c3e481a16a805baa71817a04bbe06a38d17e60e2eaee83f6a146c6a688125f5792e48dd5ba30e7da52a5cda4c3992b9ccf333f9ce223af84748" | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
pnpm 9.0.0 discontinued support for node 16