fixup! Switch from npm to pnpm

Author: mm-jpoole

.github/workflows/lint.yml

@@ -17,9 +17,8 @@ jobs:
           node-version: 22
           package-manager-cache: false
       # Install only pnpm, not the repo's full toolchain — Node comes from
-      # actions/setup-node, which pins the version this job needs.
-      # Appending only pnpm's directory to PATH keeps mise's own Node
-      # (mise.toml pins "latest") from ever shadowing setup-node's.
+      # actions/setup-node. See mise.toml for why, and for why PATH order is
+      # not what makes it safe.
       - name: Setup mise
         uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:

.github/workflows/release.yml

@@ -23,18 +23,18 @@ jobs:
           node-version: 22
           package-manager-cache: false
       # Install only pnpm, not the repo's full toolchain — Node comes from
-      # actions/setup-node, which pins the version this job needs.
-      # Appending only pnpm's directory to PATH keeps mise's own Node
-      # (mise.toml pins "latest") from ever shadowing setup-node's.
+      # actions/setup-node. See mise.toml for why, and for why PATH order is
+      # not what makes it safe.
       - name: Setup mise
         uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           install: false
           # Caching is disabled in this workflow only. zizmor's cache-poisoning
           # audit flags a restorable cache in a job that publishes artifacts
           # built at runtime, which is also why the setup-node steps here set
-          # package-manager-cache: false. Caching stays on in test.yml and
-          # lint.yml, where it is a real speed win and is not flagged.
+          # package-manager-cache: false. test.yml and lint.yml leave the
+          # default, which zizmor does not flag -- though with install: false
+          # mise-action never writes a cache there either.
           cache: false
       - name: Install pnpm
         env:
@@ -81,18 +81,18 @@ jobs:
           echo "npm $npm_version (need >= 11.5.1 for OIDC trusted publishing)"
           printf '11.5.1\n%s\n' "$npm_version" | sort -V -C
       # Install only pnpm, not the repo's full toolchain — Node comes from
-      # actions/setup-node, which pins the version this job needs.
-      # Appending only pnpm's directory to PATH keeps mise's own Node
-      # (mise.toml pins "latest") from ever shadowing setup-node's.
+      # actions/setup-node. See mise.toml for why, and for why PATH order is
+      # not what makes it safe.
       - name: Setup mise
         uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           install: false
           # Caching is disabled in this workflow only. zizmor's cache-poisoning
           # audit flags a restorable cache in a job that publishes artifacts
           # built at runtime, which is also why the setup-node steps here set
-          # package-manager-cache: false. Caching stays on in test.yml and
-          # lint.yml, where it is a real speed win and is not flagged.
+          # package-manager-cache: false. test.yml and lint.yml leave the
+          # default, which zizmor does not flag -- though with install: false
+          # mise-action never writes a cache there either.
           cache: false
       - name: Install pnpm
         env:

.github/workflows/test.yml

@@ -20,9 +20,8 @@ jobs:
           node-version: ${{ matrix.version }}
           package-manager-cache: false
       # Install only pnpm, not the repo's full toolchain — Node comes from
-      # actions/setup-node so the version matrix stays in control.
-      # Appending only pnpm's directory to PATH keeps mise's own Node
-      # (mise.toml pins "latest") from ever shadowing setup-node's.
+      # actions/setup-node. See mise.toml for why, and for why PATH order is
+      # not what makes it safe.
       - name: Setup mise
         uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:

mise.toml

@@ -28,6 +28,14 @@ lockfile_platforms = [
 ]
 
 [tools]
+# CI never installs this. Every workflow runs mise-action with install: false
+# and then installs only pnpm, putting just pnpm's install directory on PATH.
+# That directory holds pnpm and a dist/ subdir -- no node -- which is what
+# keeps this "latest" pin out of jobs where actions/setup-node fixed the Node
+# version (the test matrix, and the pinned Node in lint.yml and release.yml).
+# The directory's contents are the protection, not PATH order: $GITHUB_PATH
+# prepends, and mise-action prepends its own shims directory even with
+# install: false.
 node = "latest"
 lychee = "latest"
 # pnpm is on the github backend because aqua-registry's pnpm config keeps