From bfd3060ce153b0162dca211e449beb600b1ed366 Mon Sep 17 00:00:00 2001 From: ancplua Date: Fri, 15 May 2026 17:46:03 +0200 Subject: [PATCH] ci: replace pnpm/action-setup with corepack (allowlist compliance) The org policy on ANcpLua/Paperless only permits actions from ANcpLua-owned repos, GitHub-owned repos, or Marketplace-verified publishers. `pnpm/action-setup@v4` falls outside that allowlist and broke the post-merge CI run on main. Corepack ships with Node and provides the same shim without an external action. Pinned to pnpm@10.30.2 to match PaperlessUI.Angular/package.json's `packageManager` field and the prior workflow's `version: 10` (which floated to latest 10.x). Corepack steps run BEFORE `actions/setup-node@v4` so pnpm is on PATH when setup-node executes its `cache: pnpm` logic. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/ci.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb88aa7..bb34598 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -103,9 +103,10 @@ jobs: working-directory: PaperlessUI.Angular steps: - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - with: - version: 10 + - name: Activate pnpm via corepack + run: | + corepack enable + corepack prepare pnpm@10.30.2 --activate - uses: actions/setup-node@v4 with: node-version: 22 @@ -123,9 +124,10 @@ jobs: working-directory: PaperlessUI.React steps: - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - with: - version: 10 + - name: Activate pnpm via corepack + run: | + corepack enable + corepack prepare pnpm@10.30.2 --activate - uses: actions/setup-node@v4 with: node-version: 22