Fix cache poisoning code scanning alerts in Python integration workflows #5127

	name: Preview

	on:
	pull_request:
	branches:
	- main
	- release/*
	paths-ignore:
	- "website/**"

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	preview:
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	fetch-depth: 0 ## Needed for Changesets to find `main` branch

	- uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
	name: Setup .NET
	with:
	# Automatically read .NET SDK version from global.json to stay in sync
	global-json-file: packages/http-client-csharp/global.json

	- uses: ./.github/actions/setup

	- name: Install dependencies
	run: node eng/tsp-core/tpm/cli.ts install --since origin/main

	- name: Build
	run: node eng/tsp-core/tpm/cli.ts build --since origin/main

	- name: Bump version to prerelease targets
	run: pnpm chronus version --prerelease "{nextVersion}-pr.${{ github.event.pull_request.number }}.${{ github.run_number }}"

	# `chronus version --prerelease` rewrites package.json specifiers (e.g. workspace:^ ->
	# a concrete prerelease range) without updating the lockfile. pnpm 11's verifyDepsBeforeRun
	# check then fails the next `pnpm` invocation with ERR_PNPM_OUTDATED_LOCKFILE. Disable it
	# for the remainder of the job since the mismatch is expected here.
	- run: pnpm config set verifyDepsBeforeRun false --location project

	- run: node eng/tsp-core/pkg-pr-new.ts

Navigation Menu