Repository navigation
feat: support pnpm workspace action distributions - #655
Conversation
|
Internal - Pull request - Continuous Integration - Test results Workflow run and full reports · Commit 0a01442 Jobs: 6 success · 0 failure · 0 cancelled · 0 skipped · 0 abandoned. Test: 273 passed · 0 failed · 0 skipped. Test detailsTest resultsTest Results
Job results and report availability
Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs. |
|
Internal - Pull request - Continuous Integration - Code coverage Workflow run and full reports · Commit 0a01442 Jobs: 6 success · 0 failure · 0 cancelled · 0 skipped · 0 abandoned. Coverage: 5 source report(s); percentages remain separate. Coverage detailsCoverage resultsci-reports-1-test-action-distributions-actions-action-distributions-92aab049-e3f2-4c0c-b18c-4a18df8bf979/lcov.infoCoverage
Overall: 97.76% 🟢 ci-reports-1-test-action-lint-pull-request-title-actions-quality-lint-pull-request-title-9518029e-97c9-49fd-8453-67d7045b0422/lcov.infoCoverage
Overall: 100.00% 🟢 ci-reports-1-test-action-need-fix-to-issue-actions-need-fix-to-issue-754b5d8e-73f8-49bc-84ce-a68b6295c25a/lcov.infoCoverage
Overall: 100.00% 🟢 ci-reports-1-test-action-parse-ci-reports-actions-quality-parse-ci-reports-04fe59a0-7a96-4f43-a338-4956e82c0627/lcov.infoCoverage
Overall: 95.39% 🟢 ci-reports-1-test-action-test-action-distribution-actions-quality-test-action-distribution-fd9d394f-9d91-4689-a168-d315c59861c9/lcov.infoCoverage
Overall: 100.00% 🟢 Job results and report availability
Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs. |
|
Internal - Pull request - Continuous Integration - Lint results Workflow run and full reports · Commit 0a01442 Jobs: 6 success · 0 failure · 0 cancelled · 0 skipped · 0 abandoned. Lint: Collected diagnostics and Super-Linter summaries. Execution status is included in the job outcomes. Super-Linter detailsSuper-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter Job results and report availability
Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs. |
A pnpm workspace can build several committed actions from one root lockfile. The current distribution workflow only installs with npm, accepts one output directory per package, and caps the serialized artifact at 20 MiB. This prevents adoption by
meetup-event-automation, whose 22 bundles produce an 87.4 MiB JSON artifact.This adds pnpm workspace support using the stable
ci-github-nodejs3.0.0setup-nodeandget-package-manageractions. They configure tooling and select the locked install and script commands from the first affected package; the common helper executes those commands once per affected package without a shell. Selected packages use the same manager, and root workspaces build once. There is no separate package-manager selector or direct pnpm bootstrap in this workflow.The shared setup uses
install-dependencies: falsebecause installation belongs to the affected-package loop. The existing explicit Node-version selection remains after setup: the shared 3.0.0 action has no version override input, and the workflow must honor its requested runtime. Installation hooks stay disabled by default and can be enabled for approved workspace hooks. Every configured literal output directory must contain its required files.For larger workspaces,
max-artifact-sizepermits up to 128 MiB of JSON, bounded by 1,000 files and 50 MiB per file. Changes above 20 MiB upload individual Git blobs, preserve the expected parent's tree and create one child commit. GraphQLupdateRefspublishes it withbeforeOidandforce: false; failures do not retry or expose partial commits. Small changes retaincreateCommitOnBranchand its automatic signing. The large-change Git Data API path does not automatically sign commits, so consumers must check signing rules.Consumer adoption: cloud-native-aixmarseille/meetup-event-automation#883 (draft pending the upstream merge and stable release).
Validation:
packageinvocation, all 22 outputs validated in an 87.4 MiB artifact; the consumer's independentcheck:distpassed.npm run check:dist --prefix actions/action-distributionspassed after committing the regenerated bundle.make lintfor changed action source, metadata, workflow and guides passed;git diff --checkpassed.Responsibility and security review: Node.js/package-manager tooling and command selection belong to ci-github-nodejs; distribution input policy remains in
DistributionOptions, discovery inDistributionPackages, and large Git-object publication inDistributionCommit. The writer still validates run/actor/PR/head/path policy, never executes PR code, and derives its scope from trusted inputs. Dependency lifecycle hooks only run in the read-only builder. The writer's own size limit applies before parsing downloaded bytes.The npm-oriented distribution-test workflow is unchanged. Workspace consumers retain their own bundle verification and action integration checks. Metadata and maintained guides are updated; generated action/workflow references are pending the existing main-branch CI Dokumentor release workflow and were not hand-edited. A live Dependabot-to-writer handoff and App authorization must be checked after the callers reach the default branch.
References: shared setup action, shared command detection, pnpm build approvals, Git blob API, GitHub ref update schema.