chore(ci): bump pnpm/action-setup from 4.3.0 to 6.0.9

[dependabot]

Bumps pnpm/action-setup from 4.3.0 to 6.0.9.

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.9

What's Changed

• fix: update pnpm to v11.7.0 by @​zkochan in pnpm/action-setup#267

Full Changelog: pnpm/action-setup@v6...v6.0.9

v6.0.8

What's Changed

• docs(README): fix cache_dependency_path type by @​haines in pnpm/action-setup#257
• fix: drop patchPnpmEnv so standalone+self-update works on Windows by @​zkochan in pnpm/action-setup#258
• fix: update pnpm to 11.1.1 by @​mungodewar in pnpm/action-setup#248

New Contributors

• @​mungodewar made their first contribution in pnpm/action-setup#248

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

v6.0.7

What's Changed

• fix: honor devEngines.packageManager.onFail=error (#252) by @​zkochan in pnpm/action-setup#254
• fix: restore inputs from state in post by @​haines in pnpm/action-setup#255
• fix: self-update bootstrap to packageManager-pinned version (#233) by @​zkochan in pnpm/action-setup#256

New Contributors

• @​haines made their first contribution in pnpm/action-setup#255

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

v6.0.6

What's Changed

• fix: bin_dest output points to self-updated pnpm, not bootstrap by @​zkochan in pnpm/action-setup#249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

v6.0.5

What's Changed

• fix: append (not prepend) action node dir to PATH for npm bootstrap by @​zkochan in pnpm/action-setup#241

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

v6.0.4

What's Changed

• fix: use npm co-located with the action node binary by @​benquarmby in pnpm/action-setup#239

New Contributors

• @​benquarmby made their first contribution in pnpm/action-setup#239

... (truncated)

Commits

• 0ebf471 fix: update pnpm to v11.7.0 (#267)
• 0e279bb fix: update pnpm to 11.1.1 (#248)
• 3e83581 fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)
• 551b42e docs(README): fix cache_dependency_path type (#257)
• 739bfe4 fix: self-update bootstrap to packageManager-pinned version (#233) (#256)
• f61705d chore: add CODEOWNERS
• 7a5507b fix: restore inputs from state in post (#255)
• 1155470 fix: honor devEngines.packageManager.onFail=error (#252) (#254)
• 91ab88e fix: bin_dest output points to self-updated pnpm, not bootstrap (#249)
• e578e19 fix: update pnpm to 11.0.4
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[lml2468]

@dependabot rebase

Rebasing to pick up the current CI (a fresh Build + code-review run). With the review gate now at 1 approval, these CI-action bumps can merge once checks are green. — automated PR-review cadence (OCT-13)

[lml2468]

qa-engineer verdict: PASS

Scope: 1-line bump of pnpm/action-setup v4.3.0 → v6.0.9 in .github/workflows/ci.yml. SHA-pinned (0ebf47130e...) with matching version comment.

Verify evidence (CI snapshot):

• ✅ CI / Build SUCCESS — pnpm install + build executes on the new action
• ✅ Detect changed paths SUCCESS
• ✅ label / PR size and detect dependency changes SUCCESS
• ✅ pr-title-lint, sanity/actionlint, sanity/No tabs in workflow files SUCCESS — workflow file is syntactically clean
• ✅ history / Common ancestor check SUCCESS
• ❌ check-sprint / check-sprint FAILURE — orthogonal sprint-label workflow, unrelated to this dependency bump

Coverage:

• No new code paths to test; the Build job is the self-test for this change and is green.
• No regression risk for existing test suites: only the action version reference changed.
• Edge: action major version v4→v6 jumps two majors; the Build job exercising real pnpm install on the new action is sufficient verification — release notes only document internal pnpm bootstrap fixes and Windows compatibility (no API surface change consumed here).

Flaky risk: low — run_install: false keeps the action's behaviour minimal.

Conclusion: tests cover the change adequately. Approving.

[lml2468]

security-engineer verdict: CLEARED

Threat model (CI dependency):

• Supply chain (T1): action is pinned by commit SHA 0ebf47130e4866e96fce0953f49152a61190b271 (not floating tag) — mitigates tag-rewrite / hijacked-release attacks. ✅
• Privilege escalation (T2): action runs in Build job context only; no new secrets, no pull_request_target, no permissions: change. ✅
• Code execution (T3): action only bootstraps pnpm; called with run_install: false, so no auto-install of arbitrary package scripts at setup time. ✅

SBOM / vuln scans (CI snapshot):

• ✅ OSV-Scanner / scan-pr SUCCESS — no known CVEs in pnpm/action-setup@6.0.9
• ✅ dependency-review / Dependency Review SUCCESS — GitHub's advisory DB clean
• ✅ secret-scan / Secret Scan (gitleaks) SUCCESS

Release notes audit (v4.3.0 → v6.0.9):

• v5.x: dropped Node 16 runtime, default Node 20 — aligned with actions/setup-node@v4 already in this workflow.
• v6.x: bundled pnpm bumped to v11.7.0; devEngines.packageManager.onFail=error honoured; standalone+self-update fixes. No new secret reads, no new network calls beyond pnpm bootstrap.
• No CVE advisories filed against any v4..v6 release of pnpm/action-setup at time of review.

STRIDE residual risk: low. Standard transitive trust on upstream maintainers (zkochan et al), unchanged from current pin.

Conclusion: cleared.

[lml2468]

code-reviewer verdict: APPROVED

Diff: 1 line changed in .github/workflows/ci.yml:

-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

Correctness:

• SHA matches pnpm/action-setup tag v6.0.9 (verified against upstream commit 0ebf471).
• Trailing # v6.0.9 comment kept consistent with project convention (other uses: entries in the file follow the same SHA+comment pattern, e.g. actions/checkout@34e1148 # v4, actions/setup-node@49933ea # v4).
• with: { run_install: false } block unchanged — call site contract is unaffected by the action version bump.

Design fit:

• Major-version jump (v4 → v6) is the only point worth flagging. Upstream breaking changes between v4 and v6:
  • v5: minimum Node 20 — already satisfied (this workflow uses actions/setup-node@v4).
  • v6: bundled pnpm 11.x — repo's packageManager field in package.json will be respected by the action, so no behaviour change for this CI.
    No code-level adjustments required in this repo.

Maintainability / readability: trivial diff, no churn.

Nits: none worth blocking.

Conclusion: approving.

[lml2468]

Aggregate Verdict: APPROVED — awaiting human merge

3 reviewer verdicts collected, all green:

role	verdict	label
qa-engineer	PASS	review:done:qa:approve
security-engineer	CLEARED	review:done:security:approve
code-reviewer	APPROVED	review:done:code:approve

Summary of evidence:

• 1-line bump of pnpm/action-setup v4.3.0 → v6.0.9, SHA-pinned with matching tag comment.
• CI Build job green on the new action (re-exercises real pnpm install).
• Supply-chain: SHA pin holds; OSV-Scanner, dependency-review, secret-scan all SUCCESS.
• Code-review: diff is trivial; v5/v6 breaking changes (Node 20 minimum, pnpm 11.x bundle) are already compatible with this repo.

Residual non-blocking notes:

• check-sprint / check-sprint is FAILURE but orthogonal to this dependency bump (sprint-label workflow, unrelated to the change).

Next step: human merge. Per loop policy, this autopilot will not call gh pr merge.