ci: hold pnpm/action-setup at v5 for the self-hosted runner

v6 rewrote the self-installer to shell out to `npm ci`. Our self-hosted
Linux runner has no npm on PATH other than the one in the runner's own
Node.js 24 externals, and that copy is broken:

    Error: Cannot find module '../lib/cli.js'
    Require stack:
    - .../externals.2.336.0/node24/bin/npm

so "Test app (Android)" failed at the setup step. v4 and v5 bootstrap
from a pnpm bundled inside the action and never invoke npm, and v5 is
already a node24 action, so it clears the deprecation warning without
taking on the new npm dependency.

Also collapses the per-step ccache pin comments into one note per
workflow, now covering both held-back actions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE

Author: claude

.github/workflows/check.yml

@@ -25,13 +25,26 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Two actions below are deliberately held back from their newest release, both
+# because of the Node.js 20 deprecation:
+#
+# - pnpm/action-setup is pinned to v5, not v6. v6 rewrote the self-installer to
+#   shell out to `npm ci`, and our self-hosted Linux runner has no npm on PATH
+#   beyond the runner's own Node.js 24 externals — where it is broken. v5 is a
+#   Node.js 24 action too, and still bootstraps from a bundled pnpm, so it
+#   clears the deprecation without the new npm dependency. Move to v6 once that
+#   runner has a working npm.
+# - hendrikmuhs/ccache-action is pinned to an exact patch because its floating
+#   v1 / v1.2 tags still point at a Node.js 20 build. Float again once upstream
+#   moves them to >= v1.2.22.
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -41,8 +54,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
@@ -82,7 +93,7 @@ jobs:
     name: Unit tests (${{ matrix.runner }})
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -92,8 +103,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
@@ -123,7 +132,7 @@ jobs:
     name: Weak Node-API tests (${{ matrix.runner }})
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -133,8 +142,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
@@ -154,7 +161,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -164,8 +171,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
@@ -200,7 +205,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -210,8 +215,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
@@ -250,7 +253,7 @@ jobs:
     runs-on: ubuntu-self-hosted
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -260,8 +263,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
@@ -342,7 +343,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -352,8 +353,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}

.github/workflows/release.yml

@@ -20,6 +20,9 @@ on:
 # refreshing the "Version Packages" pull request until someone approves. The
 # two jobs that must not overlap carry their own groups instead.
 
+# pnpm/action-setup is pinned to v5 and hendrikmuhs/ccache-action to an exact
+# patch, both for Node.js 20 deprecation reasons. See the note in check.yml.
+
 jobs:
   # changesets/action's sub-actions split the "what should happen?" decision out
   # of the doing, which is what lets only the publish half sit behind the "main"
@@ -36,7 +39,7 @@ jobs:
       mode: ${{ steps.select.outputs.mode }}
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -68,7 +71,7 @@ jobs:
       pull-requests: write # the "Version Packages" pull request
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -95,7 +98,7 @@ jobs:
       id-token: write # NPM trusted publishing
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
@@ -105,8 +108,6 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a
-        # Node.js 20 build. Float again once upstream moves them to >= v1.2.22.
         uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}