Skip to content

fix(deps): update dependencies and unify the GitHub Actions pins #340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
soroushm merged 2 commits into from
Aug 15, 2026
Merged

fix(deps): update dependencies and unify the GitHub Actions pins #340

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
80ea383
fix(deps): update dependencies and unify the GitHub Actions pins
soroushm Aug 15, 2026
3e63c89
docs(CI): correct the version and caching references the workflow doc…
soroushm Aug 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/actions/setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,10 @@ runs:
steps:
- name: Setup pnpm
if: inputs.manager == 'pnpm'
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

- name: Setup Node
uses: actions/setup-node@v5
uses: actions/setup-node@v7
with:
node-version: ${{ inputs.node_version }}
cache: ${{ inputs.manager }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/cd-editor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ jobs:
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

- name: Setup Node
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: ${{ env.NODE_VERSION }}
cache: pnpm
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/cd-packages.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,11 +63,11 @@ permissions:

| # | Step | Detail |
| --- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | Checkout | `actions/checkout@v5`, no persisted creds |
| 1 | Checkout | `actions/checkout@v7`, no persisted creds |
| 2 | Resolve packages | Turns `inputs.package` (read via `$PKG` env, never spliced into shell) into the run's package list (`$PKGS` via `GITHUB_ENV`): the one named package — which must exist under `packages/` and be non-`private` (defense-in-depth in case the generated choice list is hand-edited) — or, for `all`, every non-private directory under `packages/`. Every resolved package must have a `release-notes/<version>.md` for its current `package.json` version. Runs before publish, so npm is never touched when any notes are missing. |
| 3 | Read Node.js version | `cat .nvmrc` → `$GITHUB_ENV` (`NODE_VERSION`) |
| 4 | Setup pnpm | `pnpm/action-setup@v5` |
| 5 | Setup Node | `actions/setup-node@v5`, `node-version: $NODE_VERSION`, `cache: pnpm` (deps cache), `registry-url: https://registry.npmjs.org` |
| 4 | Setup pnpm | `pnpm/action-setup@v6` |
| 5 | Setup Node | `actions/setup-node@v7`, `node-version: $NODE_VERSION`, `cache: pnpm` (deps cache), `registry-url: https://registry.npmjs.org` |
Comment thread
coderabbitai[bot] marked this conversation as resolved.
| 6 | Install | `pnpm install --frozen-lockfile --ignore-scripts` |
| 7 | **Publish** | Loops `$PKGS`: per package, `pnpm publish --no-git-checks`, guarded by an `npm view` check that skips a version already on the registry — with `all`, that skip **is** the filter: only packages with an unpublished version actually ship. A real publish failure is recorded but doesn't abort the loop — the remaining packages still publish, then the step fails listing the failed ones. Auth is the OIDC id-token; **`NODE_AUTH_TOKEN` is never set**. Writes a job-summary line per package (published or skipped). |
| 8 | **GitHub Release** | Loops `$PKGS` and runs even when Publish failed (`!cancelled()`), so packages that did publish still get their Release. Per package: skips a version that isn't on npm (no Release for a failed publish), then creates the Release only if it doesn't already exist (`gh release view` check) — gated on the release's existence, not the npm-publish path, so a rerun can repair a missing release after a successful publish. Runs `gh release create "<name>@<version>" --notes-file packages/<pkg>/release-notes/<version>.md`. |
Expand All @@ -90,7 +90,7 @@ publisher (repo `soroush-tech/core`, workflow `cd-packages.yml`, environment
then OIDC takes over.
- **pnpm version:** publish on **pnpm 10.x** (the repo pins `pnpm@10.13.1`) — OIDC is
currently broken on pnpm 11 ([pnpm#11513](https://github.com/pnpm/pnpm/issues/11513)).
Needs a modern Node runtime; the repo runs **Node 25** (`.nvmrc`).
Needs a modern Node runtime; the repo runs **Node 26** (`.nvmrc`).
- **Never set `NODE_AUTH_TOKEN`:** an empty value makes pnpm attempt token auth instead
of falling back to OIDC.
- **Release = version bump:** the publish step skips versions already on the registry,
Expand Down Expand Up @@ -163,7 +163,7 @@ catch drift that publishing can't act on.

## Caching

Only the **dependency store**, via `setup-node@v5` with `cache: pnpm` — keyed off the
Only the **dependency store**, via `setup-node@v7` with `cache: pnpm` — keyed off the
`pnpm-lock.yaml` hash, same mechanism as CI.

---
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/cd-packages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:
contents: write # create the GitHub Release + tag
steps:
- name: Checkout Repository
uses: actions/checkout@v5
uses: actions/checkout@v7
with:
persist-credentials: false

Expand Down Expand Up @@ -89,10 +89,10 @@ jobs:
run: echo "NODE_VERSION=$(cat .nvmrc)" >> "$GITHUB_ENV"

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

- name: Setup Node
uses: actions/setup-node@v5
uses: actions/setup-node@v7
with:
node-version: ${{ env.NODE_VERSION }}
cache: pnpm
Expand Down
9 changes: 5 additions & 4 deletions .github/workflows/cd-web.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ Output: `web` (`'true'`/`'false'`). The missing-file fallback means a manual dis
| 2 | Read Node.js version | `cat .nvmrc` → `$GITHUB_ENV` (`NODE_VERSION`); fails if `.nvmrc` is missing |
| 3 | Detect package manager | shell `if` on lockfile → `manager` / `command` / `runner` |
| 4 | Setup pnpm | `pnpm/action-setup@v6`, `if manager == 'pnpm'` |
| 5 | Setup Node | `actions/setup-node@v6`, `node-version: $NODE_VERSION`, `cache: <manager>` (deps cache — see [Caching](#caching)) |
| 5 | Setup Node | `actions/setup-node@v7`, `node-version: $NODE_VERSION`, `cache: <manager>` (deps cache — see [Caching](#caching)) |
Comment thread
coderabbitai[bot] marked this conversation as resolved.
| 6 | Install | `${manager} ${command}` |
| 7 | Build project | `${runner} run build` with the production env below |
| 8 | Upload artifact | `actions/upload-pages-artifact@v5`, `path: ./apps/web/build/client` |
Expand Down Expand Up @@ -116,7 +116,7 @@ Runs in parallel with `build`/`deploy`.
| 1 | Checkout | `actions/checkout@v7`, `persist-credentials: false` |
| 2 | Read Node.js version | guarded read of `.nvmrc` → `$GITHUB_ENV` (`NODE_VERSION`); fails if the file is missing |
| 3 | Setup pnpm | `pnpm/action-setup@v6` |
| 4 | Setup Node | `actions/setup-node@v6`, `node-version: $NODE_VERSION`, `cache: pnpm` |
| 4 | Setup Node | `actions/setup-node@v7`, `node-version: $NODE_VERSION`, `cache: pnpm` |
| 5 | Install | `pnpm install --frozen-lockfile --ignore-scripts` |
| 6 | Build Storybook | `pnpm --filter @soroush/web build:storybook` → `apps/web/storybook-static` (same VITE build env as `build`) |
| 7 | Deploy to Cloudflare | `cloudflare/wrangler-action@v4` runs `wrangler pages deploy --branch=main` with `wranglerVersion: '4.119.0'`; project name + output dir come from `apps/web/wrangler.jsonc` (`name` + `pages_build_output_dir`). `packageManager: pnpm` is set explicitly — the lockfile sits at the repo root, so the action's per-directory detection would fall back to npm, which cannot read `workspace:*` deps |
Expand All @@ -142,8 +142,9 @@ provisioned out-of-band in Cloudflare, not by this workflow.

## Caching

Only the **dependency store** is cached, via `setup-node@v6` with `cache: <manager>`
in the `build` job — keyed off the `pnpm-lock.yaml` hash, same mechanism as CI. There
Only the **dependency store** is cached, via `setup-node@v7` with `cache: <manager>`
in the `build` job and `cache: pnpm` in `storybook` — keyed off the `pnpm-lock.yaml`
hash, same mechanism as CI. There
is no Playwright cache here (no browser tests run during deploy), and the Pages
artifact is a one-shot upload, not a cache.

Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/cd-web.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
- name: Download changes from CI
if: github.event_name == 'workflow_run'
continue-on-error: true
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
uses: actions/download-artifact@v8
with:
name: changes
run-id: ${{ github.event.workflow_run.id }}
Expand Down Expand Up @@ -55,7 +55,7 @@ jobs:
contents: read
steps:
- name: Checkout Repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@v7
with:
persist-credentials: false

Expand Down Expand Up @@ -95,7 +95,7 @@ jobs:
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@v7
with:
node-version: ${{ env.NODE_VERSION }}
cache: ${{steps.detect-package-manager.outputs.manager}}
Expand All @@ -116,7 +116,7 @@ jobs:
APP_ENV: production

- name: Upload artifact
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
uses: actions/upload-pages-artifact@v5
with:
path: ./apps/web/build/client

Expand All @@ -133,7 +133,7 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
uses: actions/deploy-pages@v5

# Build Storybook and deploy it to Cloudflare Pages (storybook.soroush.tech).
# Runs in parallel with the GitHub Pages deploy, gated on the same change detection.
Expand All @@ -148,7 +148,7 @@ jobs:
deployments: write # gitHubToken on wrangler-action creates GitHub deployment records
steps:
- name: Checkout Repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@v7
with:
persist-credentials: false

Expand All @@ -166,7 +166,7 @@ jobs:
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@v7
with:
node-version: ${{ env.NODE_VERSION }}
cache: pnpm
Expand Down
Loading
Loading