ci: swap pnpm/action-setup for pnpm/setup standalone binary - #604
Conversation
pnpm/action-setup's self-installer runs an npm-based install of the pnpm CLI itself, measured at 20s-6min of pure variance per job across sampled CI runs, unrelated to this repo's dependency count (the actual pnpm store cache restore and `pnpm install --frozen-lockfile` with a warm store only ever took 6-9s). pnpm/setup is pnpm's own documented successor for v11+, downloading a SHA-256-verified standalone binary instead. Isolated to only the bootstrap mechanism for this measurement: caching (actions/setup-node's cache:pnpm) is left unchanged in both call sites so cache architecture and bootstrap aren't varied together.
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideCI now uses pnpm’s SHA-256-verified standalone release binary instead of pnpm/action-setup’s npm-based self-installer in both installation paths, with pnpm 11.22.0 pinned explicitly and install deferred to the existing steps. Caching, Node resolution, and dependency-install behavior remain unchanged to isolate the expected setup-time improvement. File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary
|
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
There was a problem hiding this comment.
Summary
This PR correctly implements the swap from pnpm/action-setup to pnpm/setup to address measured CI performance variance (20s-6min) in the pnpm bootstrap mechanism.
Key Changes Verified:
- ✅ Both locations (
.github/actions/setup/action.ymland.github/workflows/ci.yml) consistently updated - ✅ Action SHA pinned (
703c52620218391530e48b9e8870d5c0082e1b9b) maintaining security practices - ✅ Version explicitly set to
11.22.0(unchanged from previous configuration) - ✅
install: falseproperly added to preserve existing separatepnpm install --frozen-lockfilestep - ✅ No breaking changes to workflow logic or caching architecture
The implementation is sound and ready for merge. The isolated scope (changing only the bootstrap mechanism while leaving caching and install steps unchanged) allows for clean attribution of any performance improvements.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
Warning Review limit reachedNext included review available in 35 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 75 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (4)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (2)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe shared setup action and workflow-policy job replace Changespnpm setup migration
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to CI now bootstraps the same pinned pnpm version through the standalone setup action while keeping dependency installation separate. No current merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/actions/setup/action.yml" line_range="20" />
<code_context>
- # QNBS-v3: install the patched exact pnpm before setup-node reads the repository lockfile for caching.
- - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+ # QNBS-v3: pnpm/setup verifies a SHA-256-checked standalone binary, replacing pnpm/action-setup's npm-based installer (measured 20s-6min variance); caching left unchanged below to isolate this one variable.
+ - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
with:
version: 11.22.0
</code_context>
<issue_to_address>
**nitpick:** `docs/CI.md` still documents the composite pipeline as using `pnpm/action-setup`, so the repository's CI reference is inaccurate after this change and directs maintainers toward the retired bootstrap mechanism.
**Suggested fix:** Update the composite setup documentation to describe `pnpm/setup` and its `install: false` configuration.
</issue_to_address>Sourcery assessment
Approved.
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Docker |  |
Sep 4, 2026 9:02a.m. | Review ↗ |
| Python | |
Sep 4, 2026 9:02a.m. | Review ↗ |
| Rust | |
Sep 4, 2026 9:02a.m. | Review ↗ |
| Shell | |
Sep 4, 2026 9:02a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
The initial commit's comment claimed pnpm/setup verifies its download against a GitHub-published SHA-256 digest. The live CI log and pnpm/setup's own source show it fetches the standalone binary via the npm registry and verifies an npm-signed checksum against a pinned key instead; the upstream source explicitly notes GitHub's digest is not the tamper-proof verification source. Also notes pnpm/setup's own exact-lockfile-hash verification-result cache runs independently of the (unchanged) pnpm store caching. docs/CI.md's pipeline reference still named the retired pnpm/action-setup step.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
tests/unit/workflowPolicy.test.ts hardcoded pnpm/action-setup's exact pin and ordering, which the pnpm/setup migration (this branch) doesn't satisfy — this test runs inside the Quality Gate job, separately from the standalone workflow-policy-check.mjs structural checker already validated locally, so it wasn't caught until a bot review flagged it. Updated the assertions to the new action/pin and added a check for install:false, which the bootstrap-contract test already exists to protect.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
…e workflow-policy bootstrap
Adds an explicit not.toContain('pnpm/action-setup@') check to the
composite-action assertion so the retired bootstrap can't silently
reappear. Also adds a dedicated test for the inline workflow-policy
job's own pnpm/setup bootstrap (exact pin, explicit version,
install:false, ordering before actions/setup-node, old pin absent) —
this job duplicates the swap because it validates the trust boundary
the composite action itself must clear, so it wasn't covered by the
existing composite-action test. Reuses the existing extractJobBlock
helper; no parser or test-framework changes.
…y bootstrap test; sync README test count Adds the missing assertion that the workflow-policy job's no-lifecycle -scripts install command stays exactly `pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile` after the pnpm/setup swap. Also syncs README's test-count badges (7427->7428) for the new test added in the prior commit, per docs:check.
There was a problem hiding this comment.
Gates Passed
See analysis details in CodeScene
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Summary
Wave 1 of a bounded CI performance optimization pass. Measured (not assumed) the root cause of the CI setup-time variance observed across recent runs:
pnpm/action-setup's self-installer runs an npm-based install of the pnpm CLI itself, which showed 20s-6min of pure variance per job across a sampled range of recent runs, entirely independent of this repo's dependency count. The actual pnpm store cache restore andpnpm install --frozen-lockfilewith a warm store only ever took 6-9 seconds — the store cache was never the bottleneck.pnpm/setupis pnpm's own documented successor action for pnpm v11+ (this repo pinspnpm@11.22.0). It fetches pnpm's standalone executable via the npm registry (confirmed in this PR's own CI log:Downloading pnpm 11.22.0 from the npm registry) and verifies an npm-signed checksum against a pinned key before extracting it — not, as an earlier version of this description incorrectly claimed, a GitHub-published SHA-256 digest; pnpm/setup's own source is explicit that GitHub's digest is not the tamper-proof verification source here.Scope — isolated to one variable
This PR changes only the pnpm bootstrap mechanism, in both places pnpm is installed:
.github/actions/setup/action.yml(shared composite, used by most jobs).github/workflows/ci.yml'sworkflow-policyjob (inlines its own setup — it validates the trust boundary that composite actions like the one above must clear before being trusted, so it can't use it)Deliberately not changed in this PR:
actions/setup-node'scache: pnpmremains unchanged in both call sites (zero lines touched), andpnpm/setup's owncacheinput is left at itsfalsedefault. Independently of that setting,pnpm/setupalways manages its own exact-lockfile-hash-bound verification-result cache (pnpm-lockfile-verified-*, visible in this PR's own log as "Lockfile verification cache is not found" → "... saved") — this is upstream pnpm v11 supply-chain-policy behavior, not something this PR turns on, and it fails safe (no prefix fallback; a miss just re-verifies).runtime:input —actions/setup-nodestill owns Node version resolution (matrix +.nvmrcfallback), unchanged.version: 11.22.0is set explicitly in both places (not read implicitly frompackage.json'spackageManagerfield) — theworkflow-policyjob in particular must not resolve its own tooling version from PR-controlled content before the trust boundary it exists to validate.install: falseonpnpm/setupin both places — the existing separatepnpm install --frozen-lockfilestep (and, inworkflow-policy, its--ignore-scripts --ignore-pnpmfilehardening) is unchanged, preserving current failure attribution.Also refreshed
docs/CI.md's composite-setup pipeline reference, which still named the retiredpnpm/action-setupstep — a doc-truth fix with no runtime-semantic effect on this PR's benchmark.Evidence
Baseline — sampled Quality Gate job logs from 5 recent runs showed the
pnpm/action-setupself-installer step (Running self-installer...→added 1 package[, and audited 2 packages] in Ns) taking: 20s, 41s, 2m, 3m, 6m — whilepnpm install --frozen-lockfileimmediately after (with a cache hit already restored) consistently took under 10s.First real data point (this PR, Workflow Policy Gate job) —
pnpm/setupcompleted in ~3.1s; theactions/setup-nodepnpm-store cache was cold on this run andpnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfilestill only took ~17.4s. Strongly consistent with the bootstrap step being the actual hotspot, but this is one job on one run — not yet generalized to the full PR/multiple runs.Validation
node scripts/workflow-policy-check.mjs— passed (permissions, needs graph, action pins, aggregator sync all structurally sound)pnpm run lint— passedpnpm run docs:check— passedNon-goals for this PR
No job consolidation (VRT+Lighthouse, standard+Deep E2E), no static-work deduplication, no caching-architecture change beyond the doc-truth note above, no self-hosted runners or custom images. Those remain candidates for later waves, contingent on what this isolated measurement shows across the full run.
Summary by Sourcery
Speed up and stabilize CI setup by switching both pnpm bootstrap locations to the verified standalone pnpm/setup action.
Enhancements:
CI:
Documentation:
Tests:
Chores: