ci: pin setup-vp action to latest main commit

[fengmk2]

Update voidzero-dev/setup-vp from the floating @v1 tag to the pinned latest commit on main (13e7afb, feat: resolve Vite+ version from package.json / catalog / lockfile #102).

This matches the repo convention of SHA-pinning actions with a version comment. Applied across nodejs.yml, release.yml, and pkg.pr.new.yml (4 references).

Summary by CodeRabbit

• Chores
  • Updated automated workflows to use a fixed version of a third-party setup action for more consistent and reliable runs.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1a61666e-ac5a-4e8d-94db-536f0eac98f5

📥 Commits

Reviewing files that changed from the base of the PR and between 16bc941 and 3661d29.

📒 Files selected for processing (3)

• .github/workflows/nodejs.yml
• .github/workflows/pkg.pr.new.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

This change pins the voidzero-dev/setup-vp GitHub Action to a specific commit SHA (13e7afb99c66525824db54e107d667216e795d37) instead of the @v1 tag, applied across the check and test jobs in nodejs.yml, and single steps in pkg.pr.new.yml and release.yml.

Changes

Pin setup-vp Action to Commit SHA

Layer / File(s)	Summary
Pin setup-vp action reference .github/workflows/nodejs.yml, .github/workflows/pkg.pr.new.yml, .github/workflows/release.yml	The voidzero-dev/setup-vp@v1 tag reference is replaced with a pinned commit SHA reference in the check and test jobs of nodejs.yml, and in single steps of pkg.pr.new.yml and release.yml.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Related PRs: None identified.

Suggested labels: ci, dependencies

Suggested reviewers: None identified.

🐰 A tag once loose, now locked in place,
Four workflows pinned with quiet grace,
No more drifting to v1's embrace,
Just one true SHA, in every trace.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: pinning the setup-vp GitHub Action to a specific commit.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/update-setup-vp-action

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/node-modules/urllib@842

commit: 3661d29

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.24%. Comparing base (16bc941) to head (3661d29).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #842   +/-   ##
=======================================
  Coverage   94.24%   94.24%           
=======================================
  Files          10       10           
  Lines         747      747           
  Branches      235      235           
=======================================
  Hits          704      704           
  Misses         40       40           
  Partials        3        3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR hardens CI supply-chain security by replacing the floating voidzero-dev/setup-vp@v1 reference with a specific commit SHA, aligning action usage with a “pin by SHA” approach across workflows.

Changes:

• Pin voidzero-dev/setup-vp to commit 13e7afb99c66525824db54e107d667216e795d37 instead of @v1.
• Apply the pin consistently across CI (nodejs.yml), packaging PR workflow (pkg.pr.new.yml), and publishing workflow (release.yml).
• Add an inline comment annotating the pinned reference.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/release.yml	Pins setup-vp in the release workflow to a specific commit SHA.
.github/workflows/pkg.pr.new.yml	Pins setup-vp in the pkg-pr-new workflow to a specific commit SHA.
.github/workflows/nodejs.yml	Pins setup-vp in both CI jobs to a specific commit SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.