chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 in the actions group

[dependabot]

Bumps the actions group with 1 update: pnpm/action-setup.

Updates pnpm/action-setup from 6.0.9 to 6.0.10

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.10

What's Changed

• docs(README): point users to the successor pnpm/setup action by @​BlackHole1 in pnpm/action-setup#282
• refactor: introduce restore keys for cache by @​SukkaW in pnpm/action-setup#280
• ci: use pnpm 11 for pr-check by @​jamietanna in pnpm/action-setup#284
• fix: update pnpm to v11.19.0 by @​jamietanna in pnpm/action-setup#283
• docs: update README to include devEngines.packageManager by @​nemchik in pnpm/action-setup#273

New Contributors

• @​jamietanna made their first contribution in pnpm/action-setup#284
• @​nemchik made their first contribution in pnpm/action-setup#273

Full Changelog: pnpm/action-setup@v6...v6.0.10

Commits

• 0977fd9 docs: Update README to include devEngines.packageManager (#273)
• 48261ac fix: update pnpm to v11.19.0 (#283)
• 75677f7 ci: use pnpm 11 for pr-check (#284)
• 769ae71 refactor: introduce restore keys for cache (#280)
• 6fed91f docs(README): point users to the successor pnpm/setup action (#282)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 5, 2026, 1:30 PM ET / 17:30 UTC.

ClawSweeper review

What this changes

The PR changes the pinned pnpm/action-setup revision from v6.0.9 to v6.0.10 in five CI, benchmark, hydration, and release workflow files.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this PR open: current main still pins v6.0.9, while this narrow Dependabot update consistently advances all existing pnpm setup steps to the v6.0.10 commit. No patch defect was found; merge after the remaining workflow checks complete.

Priority: P3
Reviewed head: 0b47c6812682bd6be7eee5f84f8e9d21c38f2f41

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A narrow, consistently pinned dependency update with broad CI coverage already passing and no identified correctness defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow-only update is exempt from external contributor behavior-proof requirements; completed and pending CI runs exercise the changed setup path.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot workflow-only update is exempt from external contributor behavior-proof requirements; completed and pending CI runs exercise the changed setup path.
Evidence reviewed	4 items	Current main still needs the update: All 12 current-main setup steps use the v6.0.9 full-SHA pin, including CI, package smoke, benchmarks, hydration, and release workflows. PR is a consistent pinned revision update: The supplied pull-file patches replace only the existing v6.0.9 SHA with the v6.0.10 SHA in 12 locations across five workflow files; configuration and permissions remain unchanged. Workflow provenance: Blame attributes the current CI setup pin to the v0.5.2 release commit, establishing Peter Steinberger as the recent contributor for this workflow surface.
Findings	None	None.
Security	None	None.

How this fits together

Repository workflows install a fixed pnpm version before checks, benchmarks, package validation, and release publishing. The action pin selects the third-party setup code executed in those jobs.

flowchart LR
  A[Workflow trigger] --> B[Repository workflows]
  B --> C[pnpm setup action]
  C --> D[Configured pnpm]
  D --> E[Checks benchmarks and releases]

Loading

Before merge

• Resolve merge risk (P1) - The replacement action code runs in CI and release jobs, including a publish job with OIDC permission; merge should wait for the remaining Windows and Cargo checks and retain the full-SHA pin.
• Complete next step (P2) - This is a normal, clean workflow dependency update awaiting completion of its existing validation rather than an automated repair candidate.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow pin coverage	12 replacements across 5 workflow files	The same action revision is updated everywhere this repository currently sets up pnpm, avoiding version drift between validation and release paths.

Merge-risk options

Maintainer options:

1. Complete CI, then merge (recommended)
   Wait for the remaining Windows and Cargo checks to pass, then merge the pinned patch update without changing workflow permissions.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Wait for all required checks to pass, retain the full-SHA action pin, and merge without changing workflow permissions.

Technical review

Best possible solution:

Merge the synchronized, full-SHA v6.0.10 update after all required workflow runs succeed, keeping the existing least-privilege workflow permissions unchanged.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a workflow dependency refresh, not a reported product bug. The relevant validation is execution of the affected GitHub Actions jobs.

Is this the best way to solve the issue?

Yes. Updating the existing full-SHA pin uniformly is the narrowest maintainable solution and preserves the configured pnpm versions and workflow behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8cc745a20b1d.

Labels

Label changes:

• add P3: This is a routine patch-level automation dependency refresh with no reported user-facing failure.
• add merge-risk: 🚨 security-boundary: The updated third-party action executes in release-related jobs, including an OIDC-enabled publish job, although its ref remains a full SHA.
• add merge-risk: 🚨 automation: The update changes the setup action used by CI, benchmark, package-validation, hydration, and release workflows.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only update is exempt from external contributor behavior-proof requirements; completed and pending CI runs exercise the changed setup path.

Label justifications:

• P3: This is a routine patch-level automation dependency refresh with no reported user-facing failure.
• merge-risk: 🚨 automation: The update changes the setup action used by CI, benchmark, package-validation, hydration, and release workflows.
• merge-risk: 🚨 security-boundary: The updated third-party action executes in release-related jobs, including an OIDC-enabled publish job, although its ref remains a full SHA.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only update is exempt from external contributor behavior-proof requirements; completed and pending CI runs exercise the changed setup path.

Evidence

What I checked:

• Current main still needs the update: All 12 current-main setup steps use the v6.0.9 full-SHA pin, including CI, package smoke, benchmarks, hydration, and release workflows. (.github/workflows/ci.yml:44, 8cc745a20b1d)
• PR is a consistent pinned revision update: The supplied pull-file patches replace only the existing v6.0.9 SHA with the v6.0.10 SHA in 12 locations across five workflow files; configuration and permissions remain unchanged. (.github/workflows/release.yml:33, 0b47c6812682)
• Workflow provenance: Blame attributes the current CI setup pin to the v0.5.2 release commit, establishing Peter Steinberger as the recent contributor for this workflow surface. (.github/workflows/ci.yml:44, 32759e8923a1)
• Validation coverage: The PR’s completed checks include workflow linting, CodeQL, macOS/Linux checks, package smoke tests, benchmarks, and coverage; Windows and Cargo runs are still in progress. (0b47c6812682)

Likely related people:

• Peter Steinberger: The current pnpm setup pin was introduced in the v0.5.2 release commit and remains attributed to that commit in CI workflow blame. (role: recent workflow contributor; confidence: high; commits: 32759e8923a1; files: .github/workflows/ci.yml, .github/workflows/release.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the in-progress Windows and Cargo checks before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.