pnpm-upgrade_skill

Overview

This skill automates a careful pnpm toolchain refresh across a repository. It runs pnpm self-update or corepack prepare, aligns packageManager in package.json, and updates pnpm/action-setup and pinned pnpm versions in .github/workflows to the latest release. The goal is a minimal, verifiable update suitable for manual or automated PRs.

How this skill works

The skill updates pnpm locally (preferring pnpm self-update, falling back to corepack), captures the active pnpm version, and writes packageManager in package.json to that exact version. It queries the GitHub API for the latest pnpm/action-setup release tag and updates workflow files under .github/workflows that use that action, setting the uses: tag and any with: version: values to the captured pnpm version. It emphasizes manual, file-scoped edits and confirms changes with git diff.

When to use it

• When refreshing the repository pnpm runtime to the latest stable release
• Before opening a toolchain PR that must keep changes minimal and auditable
• When CI workflows use pnpm/action-setup and need a pinned action tag and pnpm version
• If pnpm is missing or self-update fails and corepack must be used
• When automation should avoid broad regex replacements in workflows

Best practices

• Prefer pnpm self-update; use corepack prepare pnpm@latest --activate only if necessary
• Capture PNPM_VERSION=$(pnpm -v) and use it verbatim in package.json and workflows
• Query GitHub API for the latest pnpm/action-setup release tag and use authenticated requests if rate-limited
• Edit each workflow file by hand or with targeted edits; avoid repository-wide regex replacements
• Run pnpm -v and git diff to verify only intended files changed before committing

Example use cases

• Manually refresh the pnpm toolchain before a large dependency upgrade
• Build automation that opens a chore PR to keep CI and local pnpm aligned
• Small repositories where you want predictable, pinned pnpm/action-setup versions
• Projects using corepack where pnpm may not be preinstalled on developer machines