fix: run pnpm arguments through action

[luxass]

Summary

• replace direct caller-controlled pnpm script expansions with actions/run-pnpm
• route setup and release pnpm install/build/publish arguments through actions/run-pnpm
• update action-ref maintenance to handle actions/run-pnpm tags and action YAML files
• document that pnpm arguments are passed without shell re-interpretation

Validation

• git diff --check
• ruby YAML parse for workflows, examples, and composite action YAML
• searched for remaining direct pnpm $... expansions in .github/workflows and actions

Note: actionlint was not run.

Summary by CodeRabbit

• Chores
  • Refactored CI/CD workflows to use a centralized run-pnpm action for executing pnpm commands instead of direct inline invocations.
  • Updated workflow documentation to clarify how script arguments are passed through the shared action.
  • Expanded workflow automation to handle updates for the new action on tag pushes.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

Multiple GitHub Actions workflows and a composite action are refactored to execute pnpm commands through a shared run-pnpm action instead of direct invocation with environment variables. The update-action-refs automation is extended to handle the new action.

Changes

Consolidate pnpm execution through shared action

Layer / File(s)	Summary
Update reusable-ci workflow steps .github/workflows/reusable-ci.yaml, .github/workflows/reusable-ci.md	The build, post-build, lint, fmt, and typecheck steps now invoke luxass/shared-workflows/actions/run-pnpm with script arguments passed via with.args, replacing direct pnpm invocation with env variables. Documentation is updated to clarify argument forwarding without shell re-interpretation.
Update reusable-test workflow step .github/workflows/reusable-test.yaml, .github/workflows/reusable-test.md	The test step is refactored to call the run-pnpm action with inputs.test-script passed via args, removing the TEST_SCRIPT environment variable. Documentation notes the new action-based execution pattern.
Update reusable-test-build-tools workflow steps .github/workflows/reusable-test-build-tools.yaml, .github/workflows/reusable-test-build-tools.md	The build, test, and typecheck steps are rewired to use the run-pnpm action with args from corresponding workflow inputs, eliminating step-level env blocks. Documentation is updated to reflect the action-based invocation.
Update reusable-release-npm workflow steps .github/workflows/reusable-release-npm.yaml, .github/workflows/reusable-release-npm.md	The install, build, and npm publish steps are refactored to use the run-pnpm action with args containing PNPM commands and computed values (including TAG and inputs.publish-args). NPM OIDC provenance configuration is preserved. Documentation clarifies argument forwarding through the action.
Update setup composite action actions/setup/action.yaml	The dependency installation step is reimplemented to call the run-pnpm action with install --frozen-lockfile plus inputs.install-args, replacing the inline bash pnpm install command.
Extend action reference update automation .github/workflows/update-action-refs.yaml	The workflow trigger pattern is expanded from only actions/setup/v* to also match actions/run-pnpm/v*. A dynamic action_path is computed from the tag reference and used to locate and update all uses: luxass/shared-workflows/${ACTION_PATH}@... references across both .github/workflows/ and actions/ directories. Pull request metadata (title, body, commit message) and path configuration are updated to use the resolved action_path.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• luxass/shared-workflows#44: Both PRs modify the reusable-release-npm.yaml npm publish steps; this PR refactors the publish command execution to use actions/run-pnpm, overlapping with changes to publish step logic.
• luxass/shared-workflows#46: This PR updates the reusable-test-build-tools.yaml workflow to use actions/run-pnpm for build/test/typecheck steps, building on the workflow initially introduced in the related PR.

🐰 From our CIrriculously clever crew:
Pnpm now hops through one shared action door,
No more env vars strewn across the floor—
Each workflow learns to share and play nice,
With consistency gaining, we've won the dice! ✨🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly matches the main change: refactoring pnpm argument handling to use a dedicated action instead of direct shell invocations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch use-run-pnpm-action

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}