[rstacruz25]

Summary

Update the pnpm 11 JavaScript and standalone bootstraps from 11.25.0 to 11.28.10, the currently published next-11 version. Regenerate their npm lockfiles and rebuild dist/index.js.

Keep the native pnpm 12.17.0 bootstrap and current shared-store regression coverage.

Validation

• Regenerated the bootstrap lockfiles with the repository updater; only the two pnpm 11 lockfiles changed.
• pnpm run build and pnpm exec tsc --noEmit passed.
• Ran the bundled action locally for both 11.28.10 and 11.25.0, with JavaScript and standalone bootstraps. All four checks reported the requested installed version from outside the pinned project.
• Cross-platform CI and the review of the updated head are followed before marking this ready.

---

Written by an agent (Codex, GPT-6).

Summary by CodeRabbit

• Chores
  • Updated the package manager’s bootstrap setup. No user-facing features or behavior changes are included in this update.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The bootstrap lockfiles now pin pnpm and @pnpm/exe to version 11.28.10. Platform package entries are updated, and the @pnpm/linuxstatic-arm64 entry is removed.

Changes: Bootstrap lockfile update

Layer / File(s)	Summary
Update bootstrap package locks src/install-pnpm/bootstrap/pnpm-lock.json, src/install-pnpm/bootstrap/exe-lock.json	The locked pnpm, @pnpm/exe, and platform package versions, tarball URLs, and integrity hashes are updated to 11.28.10. The @pnpm/linuxstatic-arm64 optional dependency and lock entry are removed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• pnpm/action-setup#291: This change updates the pnpm 11 bootstrap version used in the Windows issue, but the available description does not establish that it fixes the shim failure.

Merge Risk: Minimal · up to eeaf9

The bootstrap version update has no demonstrated merge-blocking issue. ARM64 musl compatibility was not confirmed, but no failure was established.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "fix: update pnpm 11 bootstrap to 11.28.10" matches the main change. The PR updates the pnpm 11 JavaScript and standalone bootstraps from 11.25.0 to 11.28.10. The raw summary confirms the lo…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix: update pnpm 11 bootstrap to 11.28.10" matches the main change. The PR updates the pnpm 11 JavaScript and standalone bootstraps from 11.25.0 to 11.28.10. The raw summary confirms the lockfile changes to exe-lock.json and pnpm-lock.json that carry this update. The title is specific and concise, and it names the version that the change targets.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the lockfile rows
New version pins and hashes glow
Platform entries shift in place
One ARM64 entry leaves the trace
The bootstrap hops to 11.28.10!}

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 965300fe-28a9-4682-8388-0fe28e3e9c92

Commits

Reviewing files that changed from the base of the PR and between b4ddf3a and eeaf903.

Files ignored due to path filters: 1

• dist/index.js is excluded by !**/dist/**

Files selected for processing: 2

• src/install-pnpm/bootstrap/exe-lock.json
• src/install-pnpm/bootstrap/pnpm-lock.json

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 0 remain after this review.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[qodo-code-review]

PR Summary by Qodo

Update pnpm 11 bootstraps to 11.28.10

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Update JavaScript and standalone pnpm 11 bootstraps to the published 11.28.10 release.
• Regenerate their npm lockfiles and rebuild the action bundle so installs use the updated
 bootstraps.
• Leave the pnpm 12 native bootstrap unchanged.

Diagram

graph TD
  A["Setup action"] --> B["Bootstrap selection"] --> C["JavaScript lockfile"] --> E["npm ci"] --> F["Installed pnpm"]
  B --> D["Standalone lockfile"] --> E

Loading

High-Level Assessment

Updating the committed npm lockfiles and rebuilding the bundle fits the existing deterministic bootstrap installation strategy. Resolving a dist-tag at action runtime would avoid periodic pin updates but sacrifice reproducibility, so it is not preferable here.

Files changed (3) +36 / -56

Other (3) +36 / -56

index.jsRebuild the bundled action with updated pnpm 11 pins +4/-4

Rebuild the bundled action with updated pnpm 11 pins

• Regenerates the distributed action bundle so its embedded bootstrap lockfiles reflect pnpm 11.28.10. This keeps the executable action in sync with the source lockfiles.

dist/index.js

exe-lock.jsonPin the standalone pnpm bootstrap to 11.28.10 +28/-48

Pin the standalone pnpm bootstrap to 11.28.10

• Updates @pnpm/exe and its available optional platform packages from 11.25.0 to 11.28.10, including registry URLs and integrity hashes. The regenerated dependency list no longer includes linuxstatic-arm64.

src/install-pnpm/bootstrap/exe-lock.json

pnpm-lock.jsonPin the JavaScript pnpm bootstrap to 11.28.10 +4/-4

Pin the JavaScript pnpm bootstrap to 11.28.10

• Updates the pnpm dependency and locked package from 11.25.0 to 11.28.10, with the corresponding registry URL and integrity hash.

src/install-pnpm/bootstrap/pnpm-lock.json

[zkochan]

Ready to merge. Rebased onto current master and updated both pnpm 11 bootstraps to published 11.28.10, leaving the native pnpm 12 bootstrap unchanged. Verified the built action locally with pnpm 11.28.10 and 11.25.0 in both JavaScript and standalone modes. The full Linux/macOS/Windows CI matrix and bundle check pass; CodeRabbit approved the current head (eeaf903). No actionable review findings remain.

---

Written by an agent (Codex, GPT-6).