mirror of
https://github.com/pnpm/action-setup.git
synced 2026-08-14 00:11:30 +00:00
docs: tighten the verification cache comments
The module header explained the whole feature where naming the file's purpose is enough, and the ordering comment described `pnpm store prune` deleting the log without saying which versions do — pnpm/pnpm#13893 stops deleting it.
This commit is contained in:
@@ -7,12 +7,9 @@ import path from 'path'
|
||||
import { removeWindowsExtendedPathPrefix } from '../windows-path'
|
||||
|
||||
/**
|
||||
* pnpm v11+ verifies every lockfile entry against the configured
|
||||
* supply-chain policies (`minimumReleaseAge`, `trustPolicy`, …) and memoizes
|
||||
* the verdict in this file, so the next install with the same lockfile and
|
||||
* the same policies skips the registry round-trips entirely. Without it a CI
|
||||
* job re-verifies the whole lockfile on every run, which on a large
|
||||
* repository costs more than the install itself.
|
||||
* Where pnpm v11+ memoizes which lockfile passed which supply-chain policies.
|
||||
* A job without it re-checks every lockfile entry against the registry, which
|
||||
* on a large repository costs more than the install.
|
||||
*/
|
||||
const VERIFICATION_CACHE_FILE = 'lockfile-verified.jsonl'
|
||||
|
||||
|
||||
Reference in New Issue
Block a user