luxass · luxass · Jun 13, 2026 · Jun 13, 2026
@@ -89,3 +89,5 @@ The caller job should grant `contents: read` because the reusable workflow check
 | Job | Description |
 | --- | --- |
 | `ci` | Runs setup, then the enabled `pnpm` commands. |
+
+The build, post-build, lint, fmt, and typecheck script inputs are passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
@@ -116,30 +116,30 @@ jobs:
 
       - name: build
         if: ${{ inputs.build }}
-        env:
-          BUILD_SCRIPT: ${{ inputs.build-script }}
-        run: pnpm $BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.build-script }}
 
       - name: post-build
         if: ${{ inputs.build && inputs.post-build-script != '' }}
-        env:
-          POST_BUILD_SCRIPT: ${{ inputs.post-build-script }}
-        run: pnpm $POST_BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.post-build-script }}
 
       - name: lint
         if: ${{ inputs.lint }}
-        env:
-          LINT_SCRIPT: ${{ inputs.lint-script }}
-        run: pnpm $LINT_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.lint-script }}
 
       - name: fmt
         if: ${{ inputs.fmt }}
-        env:
-          FMT_SCRIPT: ${{ inputs.fmt-script }}
-        run: pnpm $FMT_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.fmt-script }}
 
       - name: typecheck
         if: ${{ inputs.typecheck }}
-        env:
-          TYPECHECK_SCRIPT: ${{ inputs.typecheck-script }}
-        run: pnpm $TYPECHECK_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.typecheck-script }}
@@ -110,3 +110,5 @@ jobs:
 | Job | Description |
 | --- | --- |
 | `release` | Builds and publishes the package or workspace packages to npm. |
+
+The install, build, and publish arguments are passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
@@ -84,15 +84,15 @@ jobs:
         run: pnpx changelogithub
 
       - name: install dependencies
-        env:
-          INSTALL_ARGS: ${{ inputs.install-args }}
-        run: pnpm install --frozen-lockfile $INSTALL_ARGS
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: install --frozen-lockfile ${{ inputs.install-args }}
 
       - name: build
         if: ${{ inputs.build }}
-        env:
-          BUILD_SCRIPT: ${{ inputs.build-script }}
-        run: pnpm $BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.build-script }}
 
       - name: detect tag
         id: tag
@@ -108,17 +108,15 @@ jobs:
       - name: publish to npm (staging)
         if: ${{ inputs.stage }}
         env:
-          TAG: ${{ steps.tag.outputs.tag }}
           NPM_CONFIG_PROVENANCE: "true"
-          PUBLISH_ARGS: ${{ inputs.publish-args }}
-          RECURSIVE: ${{ inputs.recursive }}
-        run: pnpm stage publish ${{ env.RECURSIVE == 'true' && '-r' || '' }} --tag "$TAG" $PUBLISH_ARGS
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: stage publish ${{ inputs.recursive && '-r' || '' }} --tag ${{ steps.tag.outputs.tag }} ${{ inputs.publish-args }}
 
       - name: publish to npm
         if: ${{ !inputs.stage }}
         env:
-          TAG: ${{ steps.tag.outputs.tag }}
           NPM_CONFIG_PROVENANCE: "true"
-          PUBLISH_ARGS: ${{ inputs.publish-args }}
-          RECURSIVE: ${{ inputs.recursive }}
-        run: pnpm publish ${{ env.RECURSIVE == 'true' && '-r' || '' }} --tag "$TAG" $PUBLISH_ARGS
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: publish ${{ inputs.recursive && '-r' || '' }} --tag ${{ steps.tag.outputs.tag }} ${{ inputs.publish-args }}
@@ -94,4 +94,4 @@ The caller job should grant `contents: read` because the reusable workflow check
 
 The workflow modifies the checked out workspace by adding the selected build tool package before running commands. It does not commit or upload those changes.
 
-The build, test, and typecheck inputs are passed as arguments to `pnpm`, so callers should only pass trusted command names or arguments.
+The build, test, and typecheck inputs are passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
@@ -102,16 +102,16 @@ jobs:
           pnpm add -Dw "$TOOL_NAME@$TOOL_VERSION"
 
       - name: build
-        env:
-          BUILD_SCRIPT: ${{ inputs.build-script }}
-        run: pnpm $BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.build-script }}
 
       - name: test
-        env:
-          TEST_SCRIPT: ${{ inputs.test-script }}
-        run: pnpm $TEST_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.test-script }}
 
       - name: typecheck
-        env:
-          TYPECHECK_SCRIPT: ${{ inputs.typecheck-script }}
-        run: pnpm $TYPECHECK_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.typecheck-script }}
@@ -78,3 +78,5 @@ The caller job should grant `contents: read` because the reusable workflow check
 | Job | Description |
 | --- | --- |
 | `test` | Runs setup, then runs the configured `pnpm` test command. |
+
+The test script input is passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
@@ -75,6 +75,6 @@ jobs:
           install-args: ${{ inputs.install-args }}
 
       - name: test
-        env:
-          TEST_SCRIPT: ${{ inputs.test-script }}
-        run: pnpm $TEST_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.test-script }}
@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "actions/setup/v*"
+      - "actions/run-pnpm/v*"
 
 permissions: {}
 
@@ -44,27 +45,30 @@ jobs:
           TAG_REF: ${{ github.ref_name }}
           TAG_SHA: ${{ github.sha }}
         run: |
+          ACTION_PATH="${TAG_REF%/v*}"
           echo "tag=${TAG_REF}" >> "$GITHUB_OUTPUT"
           echo "sha=${TAG_SHA}" >> "$GITHUB_OUTPUT"
+          echo "action_path=${ACTION_PATH}" >> "$GITHUB_OUTPUT"
 
       - name: find and update workflow references
         id: update
         env:
           NEW_SHA: ${{ steps.resolve.outputs.sha }}
           NEW_TAG: ${{ steps.resolve.outputs.tag }}
+          ACTION_PATH: ${{ steps.resolve.outputs.action_path }}
         run: |
-          FILES=$(grep -rl "uses: luxass/shared-workflows/actions/setup@" .github/workflows/ --exclude="update-action-refs.yaml" || true)
+          FILES=$(grep -rl "uses: luxass/shared-workflows/${ACTION_PATH}@" .github/workflows/ actions/ --include="*.yaml" --exclude="update-action-refs.yaml" || true)
 
           if [ -z "$FILES" ]; then
-            echo "No workflow files reference actions/setup"
+            echo "No workflow files reference ${ACTION_PATH}"
             echo "changed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           echo "changed=true" >> "$GITHUB_OUTPUT"
 
           for file in $FILES; do
-            sed -i "s|uses: luxass/shared-workflows/actions/setup@[a-f0-9]\{40\}.*|uses: luxass/shared-workflows/actions/setup@${NEW_SHA} # ${NEW_TAG}|" "$file"
+            sed -i "s|uses: luxass/shared-workflows/${ACTION_PATH}@[a-f0-9]\{40\}.*|uses: luxass/shared-workflows/${ACTION_PATH}@${NEW_SHA} # ${NEW_TAG}|" "$file"
           done
 
           {
@@ -77,7 +81,7 @@ jobs:
         if: steps.update.outputs.changed == 'true'
         id: diff
         run: |
-          DIFF=$(git diff .github/workflows/)
+          DIFF=$(git diff .github/workflows/ actions/)
           {
             echo "content<<DIFF_EOF"
             echo "$DIFF"
@@ -90,13 +94,14 @@ jobs:
         env:
           TAG: ${{ steps.resolve.outputs.tag }}
           SHA: ${{ steps.resolve.outputs.sha }}
+          ACTION_PATH: ${{ steps.resolve.outputs.action_path }}
           DIFF: ${{ steps.diff.outputs.content }}
         with:
           token: ${{ steps.app-token.outputs.token }}
-          commit-message: "chore(deps): update actions/setup to ${{ steps.resolve.outputs.tag }}"
-          title: "chore(deps): update actions/setup to ${{ steps.resolve.outputs.tag }}"
+          commit-message: "chore(deps): update ${{ steps.resolve.outputs.action_path }} to ${{ steps.resolve.outputs.tag }}"
+          title: "chore(deps): update ${{ steps.resolve.outputs.action_path }} to ${{ steps.resolve.outputs.tag }}"
           body: |
-            Updates `actions/setup` references to SHA-pinned [`${{ env.TAG }}`](https://github.com/${{ github.repository }}/tree/${{ env.TAG }}).
+            Updates `${{ env.ACTION_PATH }}` references to SHA-pinned [`${{ env.TAG }}`](https://github.com/${{ github.repository }}/tree/${{ env.TAG }}).
 
             |         |                  |
             | ------- | ---------------- |
@@ -109,7 +114,9 @@ jobs:
             ${{ env.DIFF }}
             ```
           branch: "chore/update-action-refs"
-          add-paths: .github/workflows/
+          add-paths: |
+            .github/workflows/
+            actions/
           base: main
           committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
           author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
@@ -66,7 +66,6 @@ runs:
         scope: ${{ inputs.scope }}
 
     - name: install dependencies
-      shell: bash
-      env:
-        INSTALL_ARGS: ${{ inputs.install-args }}
-      run: pnpm install --frozen-lockfile $INSTALL_ARGS
+      uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+      with:
+        args: install --frozen-lockfile ${{ inputs.install-args }}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -94,4 +94,4 @@ The caller job should grant `contents: read` because the reusable workflow check

		The workflow modifies the checked out workspace by adding the selected build tool package before running commands. It does not commit or upload those changes.

		The build, test, and typecheck inputs are passed as arguments to `pnpm`, so callers should only pass trusted command names or arguments.
		The build, test, and typecheck inputs are passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.