[codex] Isolate pnpm store on self-hosted runners

[Jesssullivan]

Summary

• isolate pnpm cache/store to the workspace on self-hosted runners
• avoid collisions in the shared home-directory pnpm store on honey
• apply the same fix pattern already proven in MassageIthaca

Testing

• CI on this PR

[greptile-apps]

Greptile Summary

This PR isolates the pnpm store to each job's workspace directory ($GITHUB_WORKSPACE/.pnpm-store) on self-hosted runners, preventing collisions in the shared home-directory store. The pattern — configure store path, then restore/save via actions/cache — is applied consistently across all pnpm-using jobs in both ci.yml and publish.yml, with correctly structured cache keys (OS + node version + pnpm version + lockfile hash).

Confidence Score: 5/5

Safe to merge; the isolation pattern is correct and the single finding is a speculative concurrency edge case.

The only finding is P2: pnpm config set store-dir writes to user-level config, which could theoretically collide if the runner executes concurrent jobs. In practice this rarely happens on self-hosted runners and the existing approach is already proven in MassageIthaca. No correctness, data-integrity, or security issues were found.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds PNPM_STORE_PATH env var and "Configure workspace pnpm store" + cache steps to both the test (matrix) and build jobs; store isolation pattern is correctly ordered and cache keys are consistent.
.github/workflows/publish.yml	Applies the same PNPM_STORE_PATH isolation pattern to the publish test job; publish-npm and publish-github jobs are unaffected (no pnpm usage).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[checkout] --> B[setup-node\nno built-in cache]
    B --> C[corepack enable]
    C --> D[pnpm config set store-dir\nworkspace local path]
    D --> E[actions/cache restore\npath = workspace store]
    E -->|hit| F[pnpm install uses\nrestored workspace store]
    E -->|miss| G[pnpm install downloads\nto workspace store]
    F --> H[build and test steps]
    G --> H
    H --> I[actions/cache save\npost-job if key is new]

Loading

_{Reviews (1): Last reviewed commit: "ci: isolate pnpm store on self-hosted ru..." | Re-trigger Greptile}

[greptile-apps]

User-level config written by pnpm config set on shared runners

pnpm config set store-dir writes to ~/.npmrc (user scope) by default, not to the project .npmrc. On a self-hosted runner that executes more than one concurrent job under the same OS user, two jobs with different $GITHUB_WORKSPACE paths could race to overwrite this value — each setting its own workspace-relative path — so one job's pnpm install might end up reading the store of the other job.

A lower-risk alternative is to scope the setting to the project directory, which is unique per checkout:

Suggested change

	run: pnpm config set store-dir "$PNPM_STORE_PATH"
	run: pnpm config set store-dir "$PNPM_STORE_PATH" --location project

This writes to .npmrc inside the workspace rather than ~/.npmrc, so concurrent jobs can't collide. The same change would apply to publish.yml line 34.