[zkochan]

Summary

This action reads the project's pnpm pin through get-pnpm's readProjectPin and drops its own copy of that logic (project.ts and locked-version.ts), 641 lines including their tests.

get-pnpm now reads the pin the way pnpm 12 does, as measured against pnpm 12.15.0 (pnpm/get.pnpm.io#83). The version this action installs changes only where its copy differed from pnpm:

Case	Before	Now, as pnpm
sharedWorkspaceLockfile: false	the member's lockfile	the workspace root's lockfile
lockfileDir set through include	read	not read
pnpm-workspace.yaml without packages	every project a member	only the root
Project outside packages that pins nothing	"No pnpm version is specified"	the root's pin
package.json5	not read	read

The version input still skips the manifests and is only checked against packageManager.

get-pnpm 0.0.8

get-pnpm is bumped to 0.0.8, which includes pnpm/get.pnpm.io#83. That version is excluded from minimumReleaseAge until it has aged, as 0.0.1 and 0.0.6 were. dist/index.js is rebuilt.

Validation

With get-pnpm 0.0.8:

• pnpm test passes, 117/117.
• pnpm lint passes.
• dist/index.js grows from 1.33 MB to 1.46 MB, which is confbox and picomatch.

run.test.mjs now stubs node:child_process only for run.ts, because get-pnpm, bundled into the test, imports it too.

---

Written by an agent (Claude Code, claude-opus-5-5).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Improvements
  • When no version is specified, setup now uses the version declared in the project’s package configuration rather than a lockfile pin.
  • If an explicit version conflicts with the project’s existing pnpm declaration, setup reports an error.
  • Missing workspace or package-version information now results in an error with setup guidance.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fbd55e46-a944-48dd-8c34-27ee342fc955

Commits

Reviewing files that changed from the base of the PR and between fa36a5e and 3d4e1a2.

Files ignored due to path filters: 2

• dist/index.js is excluded by !**/dist/**
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 8

• package.json
• pnpm-workspace.yaml
• src/install-pnpm/locked-version.test.mjs
• src/install-pnpm/locked-version.ts
• src/install-pnpm/project.test.mjs
• src/install-pnpm/project.ts
• src/install-pnpm/run.test.mjs
• src/install-pnpm/run.ts

Files with no reviewable changes: 4

• src/install-pnpm/project.test.mjs
• src/install-pnpm/locked-version.test.mjs
• src/install-pnpm/locked-version.ts
• src/install-pnpm/project.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Recent review details

Additional comments: 4

package.json: 1

19-19: LGTM!

pnpm-workspace.yaml: 1

9-9: LGTM!

src/install-pnpm/run.ts: 1

8-8: LGTM!

Also applies to: 50-57, 65-73, 76-85, 87-87, 89-89, 91-91, 95-95, 98-98

src/install-pnpm/run.test.mjs: 1

17-19: LGTM!

Also applies to: 83-83, 87-87

Walkthrough

The install flow now uses get-pnpm to read project pins. The change updates the get-pnpm dependency and removes local workspace-manifest and lockfile pin-selection helpers.

Changes: pnpm Pin Resolution

Layer / File(s)	Summary
Update get-pnpm dependency package.json, pnpm-workspace.yaml	The dependency range changes to ^0.0.8. The minimum release age exclusions add get-pnpm@0.0.8.
Replace local project-pin selection src/install-pnpm/run.ts, src/install-pnpm/run.test.mjs, src/install-pnpm/project.ts, src/install-pnpm/project.test.mjs, src/install-pnpm/locked-version.ts, src/install-pnpm/locked-version.test.mjs	Without an explicit version, run.ts uses readProjectPin and prefers lockedVersion over spec. With an explicit version, it checks for a conflicting packageManager value. The local manifest and lockfile selection helpers and their test files are removed. The run test expects the root lockfile pin when workspace lockfiles are not shared.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• pnpm/setup#86: Updates the same get-pnpm dependency and release age exclusion.
• pnpm/setup#88: Changes the get-pnpm integration in run.ts.
• pnpm/setup#92: Changes lockfile pin lookup behavior in project.ts, which this change removes.

Suggested reviewers: mindtooth, haines

Merge Risk: Minimal · up to 3d4e1

No PR-introduced issue remains that needs resolution before merging. The existing explicit-version limitation for JSON5 manifests can be handled separately.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "refactor: read the pnpm pin through get-pnpm's readProjectPin" names the main change. The PR replaces the action's own pin-reading logic (project.ts and locked-version.ts) with get-pnpm's r…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "refactor: read the pnpm pin through get-pnpm's readProjectPin" names the main change. The PR replaces the action's own pin-reading logic (project.ts and locked-version.ts) with get-pnpm's readProjectPin, as the raw summary and PR objectives both describe. The title is specific and concise, and it follows a conventional commit prefix. It does not cover the get-pnpm 0.0.8 bump or the dist rebuild, but that is expected.

Full details: Docstring Coverage

Explanation

Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the project pin,
Then finds the locked version within.
The old helpers hop away,
While get-pnpm leads the way.
A fresh release joins the run.}

_{Comment @coderabbitai help to get the list of available commands.}

[zkochan]

@coderabbitai review

---

Written by an agent (Claude Code, claude-opus-5-5).

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[qodo-code-review]

PR Summary by Qodo

Use get-pnpm to read project pnpm pins

✨ Enhancement 🐞 Bug fix 🕐 20-40 Minutes

AI Description

• Delegate project pin selection to get-pnpm, removing duplicated workspace and lockfile logic.
• Match pnpm 12 behavior where the action previously selected different versions.
• Preserve explicit version overrides and packageManager conflict checks; update get-pnpm to 0.0.8.

Diagram

graph TD
  A["Installer inputs"] --> B{"Version given?"} -->|No| C["get-pnpm pin"] --> D["Locked or spec"] --> E["Download pnpm"] --> F["Installed pnpm"]
  B -->|Yes| G["Conflict check"] --> E

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Maintain the action's own pin reader

• ➕ Keeps pin-selection behavior and its tests under this repository's control.
• ➖ Duplicates pnpm semantics and requires ongoing fixes as pnpm changes.

Recommendation: Use get-pnpm's readProjectPin: the action already depends on get-pnpm for downloads, and sharing pnpm-aligned pin selection avoids further drift. Retain integration tests for the action-specific explicit-version path and consequential selection cases.

Files changed (5) +55 / -101

Refactor (1) +36 / -90

run.tsDelegate project pin selection to readProjectPin +36/-90

Delegate project pin selection to readProjectPin

• Replaces local manifest, workspace, and lockfile selection with get-pnpm's readProjectPin, using its locked version when present. Keeps explicit version input as a separate path that checks only for a conflicting packageManager version, and preserves missing-workspace and missing-pin errors.

src/install-pnpm/run.ts

Tests (1) +5 / -4

run.test.mjsAdjust installer integration coverage for pnpm-aligned pins +5/-4

Adjust installer integration coverage for pnpm-aligned pins

• Limits the child_process stub to run.ts so bundled get-pnpm retains its own import. Changes the sharedWorkspaceLockfile: false expectation to select the root lockfile's pin.

src/install-pnpm/run.test.mjs

Other (3) +14 / -7

package.jsonRequire get-pnpm 0.0.8 +1/-1

Require get-pnpm 0.0.8

• Raises the get-pnpm dependency to a release containing the pnpm 12-aligned readProjectPin implementation.

package.json

pnpm-workspace.yamlTemporarily exempt get-pnpm 0.0.8 from release-age policy +1/-1

Temporarily exempt get-pnpm 0.0.8 from release-age policy

• Adds 0.0.8 to minimumReleaseAgeExclude so the new release can be installed before it ages past the workspace threshold.

pnpm-workspace.yaml

pnpm-lock.yamlLock get-pnpm 0.0.8 and its dependencies +12/-5

Lock get-pnpm 0.0.8 and its dependencies

• Updates the resolved get-pnpm version and records its new confbox and picomatch dependencies.

pnpm-lock.yaml

[coderabbitai]

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.