Use GITHUB_TOKEN/GH_TOKEN if available for higher rate limits.
Store as ACTION_TAG (e.g., v4.2.0). Abort if missing.
Resolve the action tag to an immutable commit SHA
Run git ls-remote https://github.com/pnpm/action-setup "refs/tags/${ACTION_TAG}^{}" and capture the SHA as ACTION_SHA.
If the dereferenced tag is missing, fall back to git ls-remote https://github.com/pnpm/action-setup "refs/tags/${ACTION_TAG}".
Abort if ACTION_SHA is empty.
Update workflows carefully (no broad regex)
Files: everything under .github/workflows/ that uses pnpm/action-setup.
For each file, edit by hand:
Set uses: pnpm/action-setup@${ACTION_SHA}.
If a with: version: field exists, set it to ${PNPM_VERSION} (keep quoting style/indent).
Do not touch unrelated steps. Avoid multiline sed/perl one-liners.
Verify
Run pnpm -v and confirm it matches packageManager.
git diff to ensure only intended workflow/package.json changes.
Follow-up
If runtime code/build/test config was changed (not typical here), run $code-change-verification; otherwise, a light check is enough.
Commit with chore: upgrade pnpm toolchain and open a PR (automation may do this).
Notes
Tools needed: curl, jq, node, pnpm/corepack. Install if missing.
Keep edits minimal and readable—prefer explicit file edits over global replacements.
GitHub Actions must stay pinned to commit SHAs, not tags. Use the latest release tag only to discover the commit SHA to pin.
If GitHub API is rate-limited, retry with a token or bail out rather than guessing the tag.
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: openai-openai-agents-js-pnpm-upgrade3description: pnpm Upgrade4---56# pnpm Upgrade78Use these steps to update pnpm and CI pins without blunt search/replace.910## Steps (run from repo root)11121. Update pnpm locally13 - Try `pnpm self-update`; if pnpm is missing or self-update fails, run `corepack prepare pnpm@latest --activate`.14 - Capture the resulting version as `PNPM_VERSION=$(pnpm -v)`.15162. Align package.json17 - Open `package.json` and set `packageManager` to `pnpm@${PNPM_VERSION}` (preserve trailing newline and formatting).18193. Find latest pnpm/action-setup tag20 - Query GitHub API: `curl -fsSL https://api.github.com/repos/pnpm/action-setup/releases/latest | jq -r .tag_name`.21 - Use `GITHUB_TOKEN`/`GH_TOKEN` if available for higher rate limits.22 - Store as `ACTION_TAG` (e.g., `v4.2.0`). Abort if missing.23244. Resolve the action tag to an immutable commit SHA25 - Run `git ls-remote https://github.com/pnpm/action-setup "refs/tags/${ACTION_TAG}^{}"` and capture the SHA as `ACTION_SHA`.26 - If the dereferenced tag is missing, fall back to `git ls-remote https://github.com/pnpm/action-setup "refs/tags/${ACTION_TAG}"`.27 - Abort if `ACTION_SHA` is empty.28295. Update workflows carefully (no broad regex)30 - Files: everything under `.github/workflows/` that uses `pnpm/action-setup`.31 - For each file, edit by hand:32 - Set `uses: pnpm/action-setup@${ACTION_SHA}`.33 - If a `with: version:` field exists, set it to `${PNPM_VERSION}` (keep quoting style/indent).34 - Do not touch unrelated steps. Avoid multiline sed/perl one-liners.35366. Verify37 - Run `pnpm -v` and confirm it matches `packageManager`.38 - `git diff` to ensure only intended workflow/package.json changes.39407. Follow-up41 - If runtime code/build/test config was changed (not typical here), run `$code-change-verification`; otherwise, a light check is enough.42 - Commit with `chore: upgrade pnpm toolchain` and open a PR (automation may do this).4344## Notes4546- Tools needed: `curl`, `jq`, `node`, `pnpm`/`corepack`. Install if missing.47- Keep edits minimal and readable—prefer explicit file edits over global replacements.48- GitHub Actions must stay pinned to commit SHAs, not tags. Use the latest release tag only to discover the commit SHA to pin.49- If GitHub API is rate-limited, retry with a token or bail out rather than guessing the tag.5051---52> Converted and distributed by [TomeVault](https://tomevault.io/claim/openai) — claim your Tome and manage your conversions.53<!-- tomevault:4.0:skill_md:2026-04-11 -->
Run npx get-skill add tomevault-io/openai-openai-agents-js-pnpm-upgrade in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
pnpm Upgrade It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.
