build(deps): bump pnpm/setup from 2.1.0 to 3.0.0

[dependabot]

Bumps pnpm/setup from 2.1.0 to 3.0.0.

Release notes

Sourced from pnpm/setup's releases.

v3.0.0

What's Changed

• fix!: include runid in cache key, restore freshest lockfile match by @​poulet42 in pnpm/setup#43
• feat!: automatically detect Node.js version files by @​Neonsy in pnpm/setup#49
• docs: add private registry authentication recipes by @​zkochan in pnpm/setup#61
• fix: avoid deprecated shell spawning for pnpm commands by @​sebdanielsson in pnpm/setup#52
• fix: require-lockfile no longer accepts a lockfile pnpm will not use by @​zkochan in pnpm/setup#60

New Contributors

• @​poulet42 made their first contribution in pnpm/setup#43
• @​Neonsy made their first contribution in pnpm/setup#49

Full Changelog: pnpm/setup@v2.1.0...v3.0.0

Commits

• fbda4c8 docs(README): update version
• c868a7d fix: require-lockfile no longer accepts a lockfile pnpm will not use (#60)
• 463911b fix: avoid deprecated shell spawning for pnpm commands (#52)
• 6598286 docs: add private registry authentication recipes (#61)
• c5b2e24 feat!: automatically detect Node.js version files (#49)
• f37adde fix!: include runid in cache key, restore freshest lockfile match (#43)
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
worldscript-studio	Ready	Preview	Oct 3, 2026 4:54am UTC

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: qnbs/WorldScript-Studio/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: cfa978f2-8546-4b30-b392-8713dbcba0a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit: 14dc6f8e
Scan Time: 2026-10-03 04:54:07 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating S: No issues

View Full Results

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
9184	1	9183	0

View the top 1 failed test(s) by shortest run time

tests/unit/workflowPolicy.test.ts > CI workflow policy > bootstraps the exact secure pnpm in the workflow-policy job itself, before the gate it validates

Stack Traces | 0.0482s run time

AssertionError: expected '  workflow-policy:\n    name: 📜 Work…' to contain 'pnpm/setup@703c52620218391530e48b9e88…'

- Expected
+ Received

- pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b
+   workflow-policy:
+     name: 📜 Workflow Policy Gate
+     runs-on: ubuntu-latest
+     timeout-minutes: 10
+     steps:
+       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+         with:
+           fetch-depth: 0
+           persist-credentials: false
+       # QNBS-v3: pnpm/setup instead of pnpm/action-setup, mirroring ..../actions/setup/action.yml (duplicated because this job predates the trust boundary it validates and can't use that composite).
+       - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+         with:
+           version: 11.22.0
+           install: false
+       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+         with:
+           node-version-file: .nvmrc
+           cache: pnpm
+       # QNBS-v3: no lifecycle/.pnpmfile.cjs hooks — install must not run repo code before the gate.
+       - name: Install dependencies (no lifecycle scripts)
+         run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+       # QNBS-v3: materialize the complete base workspace before governance; workspace:* packages and pinned patches are part of frozen resolution.
+       - name: Prepare trusted base governance workspace
+         if: github.event_name == 'pull_request'
+         env:
+           BASE_SHA: ${{ github.event.pull_request.base.sha }}
+         run: |
+           set -euo pipefail
+           if ! git cat-file -e "$BASE_SHA^{commit}"; then
+             echo "::error::base SHA is unavailable for trusted governance checks"
+             exit 1
+           fi
+           BASE_WORKSPACE="$(mktemp -d)"
+           git archive "$BASE_SHA" | tar -x -C "$BASE_WORKSPACE"
+           pnpm --dir "$BASE_WORKSPACE" install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+           echo "TRUSTED_BASE_WORKSPACE=$BASE_WORKSPACE" >> "$GITHUB_ENV"
+       # QNBS-v3: node directly — pnpm run's own pre-run check rejects an --ignore-pnpmfile install.
+       - name: Workflow-policy structural gate (permissions, needs graph, action pins)
+         run: |
+           set -euo pipefail
+           # QNBS-v3: PRs always run the trusted base checker; a missing base workspace fails via set -u instead of falling back to the PR copy.
+           if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
+             WORKFLOW_POLICY_ROOT="${{ github.workspace }}" \
+               node "$TRUSTED_BASE_WORKSPACE/scripts/workflow-policy-check.mjs"
+           else
+             WORKFLOW_POLICY_ROOT="${{ github.workspace }}" \
+               node scripts/workflow-policy-check.mjs
+           fi
+       # QNBS-v3: use the trusted base checker for PRs; config and checker remain the PR workspace.
+       - name: Reviewer governance configuration gate
+         env:
+           BASE_SHA: ${{ github.event.pull_request.base.sha }}
+           REVIEWER_CONFIG_ROOT: ${{ github.workspace }}
+         run: |
+           set -euo pipefail
+           if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ -n "${TRUSTED_BASE_WORKSPACE:-}" ] \
+              && [ -f "$TRUSTED_BASE_WORKSPACE/scripts/check-reviewer-config.mjs" ]; then
+             REVIEWER_CONFIG_ROOT="${{ github.workspace }}" \
+               REVIEWER_DEPENDENCY_ROOT="$TRUSTED_BASE_WORKSPACE" \
+               node "$TRUSTED_BASE_WORKSPACE/scripts/check-reviewer-config.mjs"
+           else
+             echo "::notice::base reviewer checker is absent (bootstrap); using the PR copy this one time."
+             node scripts/check-reviewer-config.mjs
+           fi
+
+   # ----------------------------------------------------------
+   # 0. SECURITY: pnpm audit + gitleaks + dependency review
+   # ----------------------------------------------------------

 ❯ tests/unit/workflowPolicy.test.ts:184:25

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[qnbs]

Disposition for v1.29 (#872): BLOCKED_BY_INCOMPATIBILITY_OR_POLICY → post-release toolchain work.

• This is a major (pnpm/setup 2.1.0 → 3.0.0) and it edits .github/workflows/reviewer-governance-trust.yml, a protected-transition path. Its required Reviewer Governance Trust Boundary check fails, which is correct: the trusted base must not accept an unauthorised change to its own trust workflow. Admission needs an explicit base-authorised protected transition (docs(adr): codify repository governance threat model, trusted-base execution and protected transitions #880 / governance(protection): prove required-check binding, workflow origin and bypass policy before further hardening #875), not a routine bump.
• It is not needed to ship v1.29; pnpm/setup 2.1.0 is green on every current lane.
• Related evidence: the Intel macOS qualification lane currently fails in pnpm/setup because pnpm v11 has no darwin-x64 binary (native: promote macos-15-intel qualification lane into the release matrix #507, run 36553360612). Any pnpm/setup or pnpm-major decision after the release should consider both together. The PR stays open intentionally.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 3cd2b6a...cc0db70 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Docker		Oct 3, 2026 4:53a.m.	Review ↗
Python		Oct 3, 2026 4:53a.m.	Review ↗
Rust		Oct 3, 2026 4:53a.m.	Review ↗
Shell		Oct 3, 2026 4:53a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[codescene-access]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.