[lemarier]

Change

The check and release templates pinned pnpm/action-setup@f520ece, which is the annotated tag object for v6, not a commit. Actions resolves it to commit 0977fd9 (v6.0.10), so the code that ran was genuine, but zizmor's online ref-version-mismatch audit fails on it, and every repo that copied the templates inherited the pin. The templates now pin 0977fd99725f1db4007ccb2928dbb4e90d06cc86, the same code. docs/adopting.md now says to run zizmor with GH_TOKEN so online audits run; the offline runs used for the adoption PRs missed this.

Validation

git ls-remote https://github.com/pnpm/action-setup shows refs/tags/v6 = f520ece and refs/tags/v6^{} = 0977fd9. Rendered copies of every template pass actionlint and online zizmor 1.30.1 --min-severity medium (the OCR caller rendered with main's SHA). just check passes. The adopting repos' PRs carry the same repin.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T12:10:56.769218Z	2903fc9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Advanced

Run ID: 9f5ebc88-a425-4ebd-96a4-541059e16f51

📥 Commits

Reviewing files that changed from the base of the PR and between 64439b7 and 2903fc9.

📒 Files selected for processing (3)

• docs/adopting.md
• templates/workflows/origin89-check.yml
• templates/workflows/origin89-release.yml

Limit details: You’ve used all 10 included reviews currently available.

---

📝 Walkthrough

Walkthrough

The adoption instructions now require cargo deny and pinned-version zizmor checks before opening a pull request. They specify GH_TOKEN for online action-pin audits, note a limitation of offline audits, and describe how to handle findings. The check and release workflow templates update the pinned commit for pnpm/action-setup v6.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Merge Risk: ⚪ Minimal · up to 2903f

The workflow templates use the intended pnpm action version, and the adoption guidance documents the pre-PR checks. No material merge risk is established.

Architecture Summary

Architecture risk: 🔵 Low · up to 2903f

The change affects 2 systems.

Changed systems: templates, docs

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — templates (service) was modified; 2 changed files map to changed impact.
• observed — docs (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in docs/adopting.md: The instructions now require cargo deny check and pinned-version zizmor before opening the PR, with GH_TOKEN set for online action-pin audits. They note that offline runs can miss pins naming tag objects rather than commits; findings must be fixed or recorded as reviewed inline exceptions. Previously, the instructions did not specify GH_TOKEN or this offline-audit limitation.
• observed — Modified behavior in templates/workflows/origin89-check.yml: Updated the pinned commit for pnpm/action-setup; the action remains at v6.
• observed — Modified behavior in templates/workflows/origin89-release.yml: The select-mode job updates the pinned pnpm/action-setup v6 commit.
• observed — Modified behavior in templates/workflows/origin89-release.yml: The version job updates the pinned pnpm/action-setup v6 commit.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning pnpm/action-setup to its v6 commit.
Description check	✅ Passed	The description explains the problem, the resulting pin change, the documentation update, and the validation commands and results. It matches the required Change and Validation sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 3
• Waived: $0.75 (charged $0.00)
• View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

---

_{Comment @coderabbitai help to get the list of available commands.}