actions/setup-pnpm
1
0
Fork 0
mirror of https://github.com/pnpm/action-setup.git synced 2026-08-14 14:02:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: cache the lockfile verification log regardless of cache

Browse Source 
The log is under a kilobyte and pnpm writes it on every install, not only
where supply-chain policies are configured: the integrity and tarball-URL
checks are unconditional. A job that starts without it re-checks every
lockfile entry against the registry — on a ~2000-entry lockfile with a warm
store, 13.5s vs 1.5s with `minimumReleaseAge` and `trustPolicy` configured,
and still 6.7s vs 1.6s with no policies at all.

Tying that to the `cache` input made the common case slow for no saving worth
counting, so the log is now restored and saved on its own key whether or not
the store is cached. `cache` goes back to meaning what its name says.
This commit is contained in:
Zoltan Kochan
2026-08-13 16:56:49 +02:00
parent 544072d0b9
commit b543421fa5
6 changed files with 47 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
action.yml
+3 -3
View File
@@ -17,9 +17,9 @@ inputs:
default: 'null'
cache:
description: |
Whether to cache the pnpm store directory and, on pnpm v11 and newer,
the results of pnpm's lockfile verification against the configured
supply-chain policies. Both are keyed on the lockfile's content hash.
Whether to cache the pnpm store directory, keyed on the lockfile's
content hash. On pnpm v11 and newer, the results of pnpm's lockfile
verification are cached either way — see the README.
required: false
default: 'false'
cache_dependency_path: