From 13add92fb67a2f8a3ab0f260e5067db4eedd0caa Mon Sep 17 00:00:00 2001
From: planadecu <planadecu@gmail.com>
Date: Wed, 30 Sep 2026 21:56:19 +0200
Subject: [PATCH] CI: bump actions; don't publish for CI-only changes; no cache
 in publish

- checkout v7, pnpm/action-setup v6, setup-node v7 (supersedes Dependabot #16).
- publish.yml ignores pushes that only touch .github/** or CLAUDE.md: they
  don't change the npm package, so they shouldn't publish a new version.
- The release job disables setup-node's automatic dependency cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PzJHgXssByMwBXH1PGbXCL
---
 .github/workflows/ci.yml      |  6 +++---
 .github/workflows/publish.yml | 14 ++++++++++----
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ef16d67..686b6a3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,13 +6,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           standalone: true
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: 'pnpm'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 961d6d3..5ca2a08 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,10 @@ on:
   push:
     branches:
       - main
+    # Changes that don't reach the npm package don't publish a new version.
+    paths-ignore:
+      - '.github/**'
+      - 'CLAUDE.md'
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -11,16 +15,16 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           standalone: true
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           # registry-url is required so npm knows the registry for the OIDC exchange.
@@ -29,7 +33,9 @@ jobs:
           # is set on the publish step. (pnpm publish does NOT do this — it uses the
           # placeholder and 404s — which is why we publish with npm below.)
           registry-url: 'https://registry.npmjs.org'
-          cache: 'pnpm'
+          # No dependency cache in the release job: a poisoned cache could reach the
+          # published package (setup-node's cache-poisoning guidance).
+          package-manager-cache: false
       - name: Configure Git
         run: |
           git config --global user.name 'GitHub Actions'