From 544072d0b980150b47ef863baaf7ea4c1211182f Mon Sep 17 00:00:00 2001
From: Zoltan Kochan <z@kochan.io>
Date: Thu, 13 Aug 2026 16:47:45 +0200
Subject: [PATCH] docs: tighten the verification cache comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The module header explained the whole feature where naming the file's purpose
is enough, and the ordering comment described `pnpm store prune` deleting the
log without saying which versions do — pnpm/pnpm#13893 stops deleting it.
---
 src/index.ts                             | 3 +--
 src/lockfile-verification-cache/index.ts | 9 +++------
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index cfe86eb..5b4ff9e 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -33,8 +33,7 @@ async function runMain() {
 
 async function runPost() {
   const inputs = JSON.parse(getState('inputs')) as Inputs
-  // Saved ahead of the prune because `pnpm store prune` drops the
-  // verification log along with the rest of the store's derived state.
+  // pnpm versions before pnpm/pnpm#13893 delete the log during a store prune.
   await saveVerificationCache()
   pruneStore(inputs)
   await saveCache(inputs)
diff --git a/src/lockfile-verification-cache/index.ts b/src/lockfile-verification-cache/index.ts
index 2b3ddf6..dad4ab1 100644
--- a/src/lockfile-verification-cache/index.ts
+++ b/src/lockfile-verification-cache/index.ts
@@ -7,12 +7,9 @@ import path from 'path'
 import { removeWindowsExtendedPathPrefix } from '../windows-path'
 
 /**
- * pnpm v11+ verifies every lockfile entry against the configured
- * supply-chain policies (`minimumReleaseAge`, `trustPolicy`, …) and memoizes
- * the verdict in this file, so the next install with the same lockfile and
- * the same policies skips the registry round-trips entirely. Without it a CI
- * job re-verifies the whole lockfile on every run, which on a large
- * repository costs more than the install itself.
+ * Where pnpm v11+ memoizes which lockfile passed which supply-chain policies.
+ * A job without it re-checks every lockfile entry against the registry, which
+ * on a large repository costs more than the install.
  */
 const VERIFICATION_CACHE_FILE = 'lockfile-verified.jsonl'