Automate pnpm updates

[zemd]

No description provided.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 41a7b337-fbc5-4ad2-a001-334e55cd8306

📥 Commits

Reviewing files that changed from the base of the PR and between 90cbb33 and 8e5714e.

📒 Files selected for processing (9)

• .changeset/afraid-candles-warn.md
• .github/workflows-examples/README.md
• .github/workflows-examples/repo-pnpm-update.yml
• .github/workflows/repo-pnpm-update.yml
• .github/workflows/shared-pnpm-update.yml
• internal/gha/src/workflows/contracts.test.ts
• internal/gha/src/workflows/pnpm-updates.test.ts
• internal/gha/src/workflows/release.test.ts
• internal/gha/src/workflows/repository.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds scheduled and reusable GitHub Actions workflows that update pnpm with Corepack and create or refresh a pull request through Release Branchkeeper. Adds documentation, release metadata, and tests for workflow structure and branch behavior.

Changes

pnpm update automation

Layer / File(s)	Summary
Workflow entrypoints and contracts .github/workflows/repo-pnpm-update.yml, .github/workflows-examples/repo-pnpm-update.yml, .github/workflows/shared-pnpm-update.yml, .github/workflows-examples/README.md, .changeset/afraid-candles-warn.md	Defines the reusable workflow inputs and secrets. Adds weekly scheduled callers with restricted permissions, concurrency control, and Release Branchkeeper credentials. Documents setup requirements and records a patch release.
Corepack preparation and pull request creation .github/workflows/shared-pnpm-update.yml	Runs Corepack with Node 24 and lifecycle scripts disabled. Accepts only package.json changes, uploads the changed file, then creates or force-updates automation/pnpm-update and creates or refreshes the pull request.
Workflow contract and behavior validation internal/gha/src/workflows/pnpm-updates.test.ts, internal/gha/src/workflows/contracts.test.ts, internal/gha/src/workflows/release.test.ts, internal/gha/src/workflows/repository.test.ts	Tests schedule gating, workflow delegation, telemetry opt-out, Node 24 requirements, credential wiring, and branch and pull request scenarios.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 8e571

This PR automates weekly pnpm updates, but content produced by the downloaded latest pnpm release can currently change any part of package.json before the workflow commits it to the update branch and opens a pull request. Because the workflow does not verify that only the intended pnpm version changed, this bounded supply-chain risk needs to be fixed or explicitly accepted before merging.

Sequence Diagram(s)

sequenceDiagram
  participant ScheduledCaller as repo-pnpm-update.yml
  participant SharedWorkflow as shared-pnpm-update.yml
  participant Corepack
  participant Branchkeeper as Release Branchkeeper GitHub App
  ScheduledCaller->>SharedWorkflow: Invoke weekly workflow
  SharedWorkflow->>Corepack: Run corepack use pnpm@latest
  SharedWorkflow->>SharedWorkflow: Validate package.json-only diff
  SharedWorkflow->>Branchkeeper: Create token and update automation/pnpm-update
  Branchkeeper->>Branchkeeper: Commit package.json
  Branchkeeper->>Branchkeeper: Create or refresh pull request

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	No pull request description was provided, so the changes and implementation details are not documented in the description.	Add a brief description explaining the weekly Corepack-based pnpm update workflow, Branchkeeper authentication, pull request behavior, and test coverage.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: automating weekly pnpm updates through new GitHub Actions workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4 files. (5 skipped: 5 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Bencher Report

Project	zemd
Branch	zemd/automate-pnpm-updates
Testbed	ubuntu-latest

⚠️ WARNING: No Threshold found!

Without a Threshold, no Alerts will ever be generated.

• Throughput (operations / second (ops/s))
• Latency (nanoseconds (ns))

Click here to create a new Threshold
For more information, see the Threshold documentation.
To only post results if a Threshold exists, set the --ci-only-thresholds flag.

Click to view all benchmark results

Benchmark	Latency	nanoseconds (ns)	Throughput	operations / second (ops/s) x 1e3
@zemd/color/oklch_to_srgb	📈 view plot ⚠️ NO THRESHOLD	112.01 ns	📈 view plot ⚠️ NO THRESHOLD	8,927.84 ops/s x 1e3
@zemd/color/srgb_to_oklch	📈 view plot ⚠️ NO THRESHOLD	178.24 ns	📈 view plot ⚠️ NO THRESHOLD	5,610.36 ops/s x 1e3
@zemd/nestjs-pino-logger/build structured message	📈 view plot ⚠️ NO THRESHOLD	162.73 ns	📈 view plot ⚠️ NO THRESHOLD	6,144.99 ops/s x 1e3
@zemd/nestjs-pino-logger/format cached-context log	📈 view plot ⚠️ NO THRESHOLD	1,008.30 ns	📈 view plot ⚠️ NO THRESHOLD	991.76 ops/s x 1e3
@zemd/std-modules/merge nested objects	📈 view plot ⚠️ NO THRESHOLD	17,038.05 ns	📈 view plot ⚠️ NO THRESHOLD	58.69 ops/s x 1e3
@zemd/std-modules/merge shallow objects	📈 view plot ⚠️ NO THRESHOLD	6,909.46 ns	📈 view plot ⚠️ NO THRESHOLD	144.73 ops/s x 1e3

🐰 View full continuous benchmarking report in Bencher