feat: add update-pnpm-minimum-release-age input

[zkochan]

Summary

Adds an update-pnpm-minimum-release-age input that overrides pnpm's minimumReleaseAge (in minutes) for the pnpm self-update step only, by setting PNPM_CONFIG_MINIMUM_RELEASE_AGE right before the self-update invocation.

Why

pnpm 12 defaults minimumReleaseAge to 24 hours, and pnpm self-update deliberately ignores the repository's release-age settings — including minimumReleaseAgeExclude — so a repo cannot decide whether the pnpm binary may be replaced (clear_self_update_policy). On CI there is no user-level config, so the built-in 24-hour cutoff applies to pnpm itself: a dist-tag pointing at a release younger than 24 hours is silently resolved to the newest mature version instead, and the action reports "already set to use" the old version.

This is exactly what happened in pnpm/pnpm's update-lockfile workflow after publishing pnpm@12.0.0-beta.1: three runs of https://github.com/pnpm/pnpm/actions/workflows/update-lockfile.yml minutes after the publish all stayed on beta.0 (e.g. https://github.com/pnpm/pnpm/actions/runs/30571699202). Env-level policy is honored by self-update by design, so passing PNPM_CONFIG_MINIMUM_RELEASE_AGE=0 lets a workflow that follows prereleases pick up a same-day release; verified against the released 12.0.0-beta.0 binary.

The variable is exported only immediately before self-update (the last step of update.sh), so the dependency update keeps the repository's own release-age settings.

Testing

• bats test/ — 31 tests pass, including two new ones covering the env var's presence and scoping (the pnpm stub now records PNPM_CONFIG_MINIMUM_RELEASE_AGE when set).

---

Written by an agent (Claude Code, claude-fable-5).

Summary by CodeRabbit

• New Features

  • Added an input to control pnpm’s minimum release age during self-updates.
  • The setting applies only to the pnpm self-update step, leaving dependency updates unaffected.
  • An empty value preserves the default behavior.

• Documentation

  • Updated usage examples and input reference documentation with configuration details and behavior notes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 85f171a0-5c57-4bba-a714-a3b6d4334543

📥 Commits

Reviewing files that changed from the base of the PR and between 76f98d7 and 5ba3c21.

📒 Files selected for processing (5)

• README.md
• action.yml
• scripts/update.sh
• test/stubs/pnpm
• test/update.bats

📜 Recent review details

🔇 Additional comments (5)

action.yml (1)

81-91: LGTM!

Also applies to: 141-141

README.md (1)

88-91: LGTM!

Also applies to: 131-131

test/stubs/pnpm (1)

2-12: LGTM!

test/update.bats (1)

26-26: LGTM!

Also applies to: 139-154

scripts/update.sh (1)

74-75: 🎯 Functional Correctness

No change needed. Since the installed pnpm version for this repository honors PNPM_CONFIG_MINIMUM_RELEASE_AGE, the current export does not become a no-op.

			> Likely an incorrect or invalid review comment.

---

📝 Walkthrough

Walkthrough

The action adds update-pnpm-minimum-release-age, forwards it to scripts/update.sh, applies it only during pnpm self-update, documents the behavior, and adds integration tests for configured and empty values.

Changes

pnpm release-age override

Layer / File(s)	Summary
Input contract and wiring action.yml, README.md	The new input is defined, passed to scripts/update.sh, and documented with its self-update-only behavior.
Self-update environment and validation scripts/update.sh, test/stubs/pnpm, test/update.bats	The release-age environment variable is conditionally applied during self-update, and tests verify configured and empty values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit hops through YAML bright,
Carries age to self-update night.
Pnpm waits, then springs anew,
Tests record the whole trail too.
No age set? The path stays clear—
Hop, hop, release without fear!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding the update-pnpm-minimum-release-age input.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-minimum-release-age

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Add self-update minimumReleaseAge override for pnpm updates

✨ Enhancement 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Add input overriding pnpm self-update minimumReleaseAge via PNPM_CONFIG_MINIMUM_RELEASE_AGE.
• Scope override to self-update only; dependency updates keep repository release-age settings.
• Document usage and add tests verifying env var presence and isolation.

Diagram

graph TD
  W["Workflow inputs"] --> A["action.yml"] --> S["scripts/update.sh"] --> D["pnpm update"]
  S --> E["set MIN_RELEASE_AGE"] --> U["pnpm self-update"] --> P(["pnpm CLI"])
  T["test/update.bats"] --> S --> B["test/stubs/pnpm"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Write temporary user-level pnpm config for self-update

• ➕ Could avoid relying on env var semantics if pnpm behavior changes
• ➖ More filesystem side effects in CI and harder to scope/clean up reliably
• ➖ Still must ensure self-update reads that config (pnpm explicitly ignores repo config)

2. Replace self-update with a scripted pnpm binary install

• ➕ Full control over version selection independent of pnpm self-update policies
• ➖ More complex and likely less portable across platforms/runners
• ➖ Reimplements logic pnpm already provides and maintains

Recommendation: The PR’s approach—setting PNPM_CONFIG_MINIMUM_RELEASE_AGE immediately before pnpm self-update—is the best fit because it uses pnpm’s supported policy mechanism while cleanly scoping the override to only the self-update call. This avoids unintended changes to dependency resolution behavior and keeps CI behavior predictable.

Files changed (5) +48 / -3

Enhancement (2) +17 / -0

action.ymlAdd update-pnpm-minimum-release-age input and env wiring +12/-0

Add update-pnpm-minimum-release-age input and env wiring

• Introduces a new composite-action input for overriding pnpm’s self-update minimumReleaseAge. Plumbs the value into the update step via UPDATE_PNPM_MINIMUM_RELEASE_AGE.

action.yml

update.shExport PNPM_CONFIG_MINIMUM_RELEASE_AGE only for pnpm self-update +5/-0

Export PNPM_CONFIG_MINIMUM_RELEASE_AGE only for pnpm self-update

• Conditionally exports PNPM_CONFIG_MINIMUM_RELEASE_AGE when the new env input is set. Places the export immediately before 'pnpm self-update' to avoid affecting dependency updates.

scripts/update.sh

Tests (2) +26 / -3

pnpmLog PNPM_CONFIG_MINIMUM_RELEASE_AGE prefix in pnpm stub +9/-3

Log PNPM_CONFIG_MINIMUM_RELEASE_AGE prefix in pnpm stub

• Enhances the pnpm test stub to prefix logged commands with PNPM_CONFIG_MINIMUM_RELEASE_AGE when present. Enables assertions about env-var scoping.

test/stubs/pnpm

update.batsAdd integration tests for minimum-release-age scoping +17/-0

Add integration tests for minimum-release-age scoping

• Adds coverage ensuring the minimum release age override applies only to the self-update invocation. Verifies that leaving the input unset does not leak any PNPM_CONFIG_MINIMUM_RELEASE_AGE into logs.

test/update.bats

Documentation (1) +5 / -0

README.mdDocument new self-update release-age override input +5/-0

Document new self-update release-age override input

• Adds an example showing how to set the new input to follow same-day pnpm prereleases. Extends the inputs table with detailed behavior and scoping notes.

README.md