[RedStar071]

🔗 Linked issue

No linked issue. Fixes the failing Security analysis (zizmor) check seen on the Renovate PRs #239 and #240.

🧭 Context

zizmor's ref-version-mismatch audit fails on the pnpm/setup pin: the comment says # v3, but the moving v3 tag now points to a newer commit than the pinned SHA. The pinned SHA is the one tagged v3.0.0.

📚 Description

Changes the version comment of the pnpm/setup pin to # v3.0.0 in autofix.yml, ci.yml and pkg-pr-new.yml. I checked that the annotated v3.0.0 tag resolves to fbda4c85fc2e1e08721cd8763afea8f48d60f024, the SHA that is already pinned. The SHA is unchanged, so behaviour does not change.

The other finding in those runs (documentation.yml, # main against a stale digest) is resolved by the open Renovate PR #239.

Key changes

File	Change
.github/workflows/autofix.yml, ci.yml, pkg-pr-new.yml	# v3 -> # v3.0.0 on the pnpm/setup pin (7 places)
.changeset/ci-pnpm-setup-pin-comment.md	empty changeset

Type of Change

• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation change
• Workflow / CI change

Pre-flight Checklist

• I have read the Contributing Guidelines (if applicable)
• My code follows the code style of this project
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly
• I added a changeset with pnpm changeset (or pnpm changeset add --empty if no release is needed). See .changeset/README.md.

🤖 AI disclosure: Claude Code was used on this PR. Code written with claude-sonnet-5-5; PR description written with claude-sonnet-5-5. AI policy.

[coldtea-pr-lens]

Note

The title starts with ci:, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[pullfrog]

✅ No new issues found.

Reviewed changes — the full diff of the single commit, plus a check of the pinned SHA against the upstream tag.

• Pin comments — # v3 becomes # v3.0.0 on all 7 pnpm/setup uses (autofix.yml ×1, ci.yml ×5, pkg-pr-new.yml ×1). A grep confirms no other pnpm/setup reference under .github is left on the old comment.
• SHA unchanged — the annotated v3.0.0 tag in pnpm/setup dereferences to fbda4c85fc2e1e08721cd8763afea8f48d60f024, the SHA already pinned, so workflow behavior is identical.
• Changeset — an empty changeset, which fits a CI-only change.

  ^{｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}