chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the actions group

[dependabot]

Bumps the actions group with 1 update: pnpm/action-setup.

Updates pnpm/action-setup from 6.0.10 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

• feat: support pnpm v12 by @​zkochan in pnpm/action-setup#288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

Commits

• ea17c68 feat: support pnpm v12 (#288)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 10, 2026, 3:00 PM ET / 19:00 UTC (Revision 4).

ClawSweeper review

What this changes

Updates the pinned pnpm setup action from v6.0.10 to v6.1.0 in the CI and package-release workflows.

Merge readiness

✅ Ready for maintainer review

This is a focused dependency update that is not yet on main. No blocking defect was found, and the supplied six-platform/Node CI matrix passed.

Priority: P3
Reviewed head: d82c503bbc49a938a4fd953fa9291ccc1bc20b59

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, conventionally validated dependency update with no identified blocking defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot's workflow-only update is exempt from contributor runtime proof; the supplied matrix checks supplement inspection of the pnpm installation path.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot's workflow-only update is exempt from contributor runtime proof; the supplied matrix checks supplement inspection of the pnpm installation path.
Evidence reviewed	7 items	Complete introduced scope: The verified merge-base-to-head patch changes only two action pins; run_install remains false and workflow permissions, triggers, and publishing commands are unchanged. Diff whitespace validation passed. Still absent from current main: GitHub confirmed main remains ea06377; its CI workflow uses action-setup v6.0.10. The bounded pull-request search found this update and an earlier merged tooling refresh, not a merged replacement. Release comparison: The latest supplied release, v0.1.1, uses action-setup v6.0.9, so it does not contain the proposed update.
Findings	None	None.
Security	None	None.

How this fits together

The workflows install the package manager selected by package.json before validating or publishing the router package. This update changes that installation tool without changing the router API or selected pnpm version.

flowchart TD
  A[Pull request or release tag] --> B[GitHub workflow]
  C[Package manager version in manifest] --> D[Pinned pnpm setup action]
  B --> D
  D --> E[Install dependencies and check package]
  E --> F[CI result or package publication]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Change scope	2 workflow pins changed; production +0, tests +0	The update adds no router code or public package surface.

Technical review

Best possible solution:

Retain the manifest as the pnpm-version authority while keeping both workflows on the same verified action release.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR without a reported router defect.

Is this the best way to solve the issue?

Yes: updating the two existing immutable pins is a narrow maintenance change, and upstream retains the installation path used by the package's current pnpm version.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against ea06377b0e80.

Labels

Label justifications:

• P3: Routine automation dependency maintenance with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot's workflow-only update is exempt from contributor runtime proof; the supplied matrix checks supplement inspection of the pnpm installation path.

Evidence

What I checked:

• Complete introduced scope: The verified merge-base-to-head patch changes only two action pins; run_install remains false and workflow permissions, triggers, and publishing commands are unchanged. Diff whitespace validation passed. (.github/workflows/ci.yml:50, d82c503bbc49)
• Still absent from current main: GitHub confirmed main remains ea06377; its CI workflow uses action-setup v6.0.10. The bounded pull-request search found this update and an earlier merged tooling refresh, not a merged replacement. (.github/workflows/ci.yml:50, ea06377b0e80)
• Release comparison: The latest supplied release, v0.1.1, uses action-setup v6.0.9, so it does not contain the proposed update. (.github/workflows/ci.yml:50, f5ce7c0d7c04)
• Verified upstream release identity: The upstream annotated v6.1.0 tag resolves to the exact commit pinned by both workflows. (ea17c68df891)
• Dependency contract and compatibility: Both changed workflows execute this dependency directly. Its installer selects the new native bootstrap only for pnpm 12 targets; the target package's [email protected] continues through the legacy bootstrap and self-update path. Reviewed source, action metadata, and dependency/lockfile changes support the stated pnpm 12 update; no dependency AGENTS.md was found. (src/install-pnpm/run.ts:37, ea17c68df891)
• Validation and review continuity: Supplied checks show successful Node 22 and 24 package checks on Linux, macOS, and Windows, plus workflow lint and CodeQL. Read-only YAML parsing passed locally. The previous review covered the same head and retained no findings or published rank-up moves; package build/tests were not rerun in this read-only review. (.github/workflows/ci.yml:30, d82c503bbc49)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-07T19:00:41.911Z sha d82c503 :: needs maintainer review before merge. :: none
• reviewed 2026-09-08T18:59:42.594Z sha d82c503 :: needs maintainer review before merge. :: none
• reviewed 2026-09-09T19:01:45.933Z sha d82c503 :: needs maintainer review before merge. :: none

[dependabot]

Looks like pnpm/action-setup is updatable in another way, so this is no longer needed.