From 0e1df434f500aadd6966d5e20aafea5da87dac15 Mon Sep 17 00:00:00 2001 From: DJ Date: Sun, 19 Apr 2026 06:11:59 -0700 Subject: [PATCH 1/2] fix(ci): downgrade pnpm/action-setup to v5 in dependency-audit reusable The SHA 08c4be7e (mislabeled # v4) is actually pnpm/action-setup@v6.0.0, which bootstraps with pnpm v11.0.0-rc.0. pnpm v11-rc cannot parse lockfiles generated by pnpm v9 (lockfileVersion '9.0'), causing ERR_PNPM_BROKEN_LOCKFILE in all repos still on pnpm v9. Pinning to action-setup@v5.0.0 (fc06bc1), which installs pnpm via npm directly with no v11 bootstrap, restoring compatibility with pnpm v9. --- .github/workflows/dependency-audit-reusable.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-audit-reusable.yml b/.github/workflows/dependency-audit-reusable.yml index 6082cda75..46cc9511c 100644 --- a/.github/workflows/dependency-audit-reusable.yml +++ b/.github/workflows/dependency-audit-reusable.yml @@ -101,7 +101,7 @@ jobs: steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v4 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: From b98a4b6283ad1c5d2f2fd8d0a1ab4d9f474d6443 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Mon, 8 Jun 2026 22:00:36 +0000 Subject: [PATCH 2/2] fix(bot): address bot feedback [skip ci-relay] --- .github/workflows/dependabot-rebase-reusable.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/dependabot-rebase-reusable.yml b/.github/workflows/dependabot-rebase-reusable.yml index 6de4edf1e..f3ed8ee49 100644 --- a/.github/workflows/dependabot-rebase-reusable.yml +++ b/.github/workflows/dependabot-rebase-reusable.yml @@ -182,4 +182,3 @@ jobs: echo " Warning: failed to merge PR #$PR_NUMBER" fi done <<< "$PRS" -