ci: set Node.js up before pnpm and move to pnpm/action-setup v6 (#407)

* ci: set Node.js up before pnpm and move to pnpm/action-setup v6

#405 held pnpm/action-setup at v5 because v6 bootstraps pnpm by shelling
out to `npm ci`, and the self-hosted Linux runner's only npm is the
broken copy in the runner's own Node.js 24 externals:

    Error: Cannot find module '../lib/cli.js'

v6 resolves npm through PATH and merely appends that externals
directory, so running actions/setup-node first — which prepends its own
Node.js installation — puts a working npm ahead of it.

The reason pnpm came first was setup-node's `cache: pnpm`, which shells
out to `pnpm store path` and so needs pnpm to already exist. v6 caches
the pnpm store itself, keyed on the lockfile, so that input moves from
setup-node to `cache: true` on pnpm/action-setup and the ordering
constraint disappears.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE

* ci: re-run checks for the newly applied labels

check.yml only runs on opened/synchronize/reopened, so the label-gated
jobs — including the self-hosted Android one this change needs to prove
itself on — do not start from labelling alone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: kraenhansen

.github/workflows/check.yml

@@ -25,30 +25,31 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# Two actions below are deliberately held back from their newest release, both
-# because of the Node.js 20 deprecation:
+# Every job sets Node.js up before pnpm, which is the opposite of what pnpm's
+# own docs suggest. pnpm/action-setup v6 bootstraps pnpm by shelling out to
+# `npm ci`, and it finds npm on PATH — on our self-hosted Linux runner the only
+# npm there is the broken copy in the runner's own Node.js 24 externals, so the
+# setup step dies with "Cannot find module '../lib/cli.js'". Running setup-node
+# first puts a working npm ahead of it. The usual ordering exists so that
+# setup-node's `cache: pnpm` can shell out to `pnpm store path`; pnpm's own
+# `cache: true` caches the same store without needing pnpm to already exist.
 #
-# - pnpm/action-setup is pinned to v5, not v6. v6 rewrote the self-installer to
-#   shell out to `npm ci`, and our self-hosted Linux runner has no npm on PATH
-#   beyond the runner's own Node.js 24 externals — where it is broken. v5 is a
-#   Node.js 24 action too, and still bootstraps from a bundled pnpm, so it
-#   clears the deprecation without the new npm dependency. Move to v6 once that
-#   runner has a working npm.
-# - hendrikmuhs/ccache-action is pinned to an exact patch because its floating
-#   v1 / v1.2 tags still point at a Node.js 20 build. Float again once upstream
-#   moves them to >= v1.2.22.
+# hendrikmuhs/ccache-action is pinned to an exact patch, not a floating major:
+# its v1 / v1.2 tags still point at a Node.js 20 build, which the runners now
+# warn about. Float again once upstream moves them to >= v1.2.22.
 
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with:
@@ -93,11 +94,12 @@ jobs:
     name: Unit tests (${{ matrix.runner }})
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with:
@@ -132,11 +134,12 @@ jobs:
     name: Weak Node-API tests (${{ matrix.runner }})
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with:
@@ -161,11 +164,12 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with:
@@ -205,11 +209,12 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with:
@@ -253,11 +258,12 @@ jobs:
     runs-on: ubuntu-self-hosted
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with:
@@ -343,11 +349,12 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with:

.github/workflows/release.yml

@@ -20,8 +20,8 @@ on:
 # refreshing the "Version Packages" pull request until someone approves. The
 # two jobs that must not overlap carry their own groups instead.
 
-# pnpm/action-setup is pinned to v5 and hendrikmuhs/ccache-action to an exact
-# patch, both for Node.js 20 deprecation reasons. See the note in check.yml.
+# Node.js is set up before pnpm, and hendrikmuhs/ccache-action is pinned to an
+# exact patch rather than a floating major. See the note in check.yml for why.
 
 jobs:
   # changesets/action's sub-actions split the "what should happen?" decision out
@@ -39,11 +39,12 @@ jobs:
       mode: ${{ steps.select.outputs.mode }}
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       # select-mode runs the locally installed @changesets/cli, so the workspace
       # has to be installed before it.
       - run: pnpm install
@@ -71,11 +72,12 @@ jobs:
       pull-requests: write # the "Version Packages" pull request
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - run: pnpm install
 
       - name: Create Release Pull Request
@@ -98,11 +100,12 @@ jobs:
       id-token: write # NPM trusted publishing
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
-          cache: pnpm
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true
       - name: Setup cpp tools
         uses: aminya/setup-cpp@v1
         with: