From 59334212843bb8546e54b4a9cdeb074994a8a9e8 Mon Sep 17 00:00:00 2001
From: Sil <silveltman@gmail.com>
Date: Fri, 2 Oct 2026 19:19:35 +0200
Subject: [PATCH] Harden the organization check install

Always run the frozen install, cache the pnpm store instead of node_modules,
skip pnpmfiles, protect nested installs, and pin actions to commit SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/check.yml | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 5672207..a8b0927 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -18,8 +18,12 @@ jobs:
     name: Check
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    # Nested pnpm installs in a check script get the same protection as the install below.
+    env:
+      pnpm_config_ignore_scripts: "true"
+      pnpm_config_ignore_pnpmfile: "true"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -33,7 +37,7 @@ jobs:
           fi
 
       - if: steps.scripts.outputs.run == 'true'
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
@@ -41,16 +45,21 @@ jobs:
       - if: steps.scripts.outputs.run == 'true'
         run: corepack enable
 
-      # Later pushes to the same pull request skip the install while dependencies are unchanged.
+      # Caches downloaded packages only. The install below always runs, so every run
+      # checks the lockfile against the repository's pnpm settings and the registry.
       - if: steps.scripts.outputs.run == 'true'
-        id: modules
-        uses: actions/cache@v6
+        id: store
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - if: steps.scripts.outputs.run == 'true'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          path: node_modules
-          key: modules-${{ runner.os }}-node24-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '**/package.json') }}
+          path: ${{ steps.store.outputs.path }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: pnpm-store-${{ runner.os }}-
 
-      - if: steps.scripts.outputs.run == 'true' && steps.modules.outputs.cache-hit != 'true'
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - if: steps.scripts.outputs.run == 'true'
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
 
       - if: steps.scripts.outputs.run == 'true'
         run: pnpm check