ci(deps): Bump pnpm/action-setup from 6.0.8 to 6.0.9 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: pnpm/action-setup.

Updates pnpm/action-setup from 6.0.8 to 6.0.9

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.9

What's Changed

• fix: update pnpm to v11.7.0 by @​zkochan in pnpm/action-setup#267

Full Changelog: pnpm/action-setup@v6...v6.0.9

Commits

• 0ebf471 fix: update pnpm to v11.7.0 (#267)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

LGTM — mechanical Dependabot patch bump of pnpm/action-setup (v6.0.8 → v6.0.9), pinned by commit SHA.

Extended reasoning...

Overview

This is a Dependabot patch bump of the pnpm/action-setup GitHub Action from v6.0.8 to v6.0.9 across five uses: lines in two workflows (.github/workflows/ci.yml and .github/workflows/update-dist-on-label.yml). The only upstream change is a pnpm version bump (to v11.7.0); the action itself is pinned by full commit SHA before and after.

Security risks

None of substance. The action remains pinned by full commit SHA, which preserves the supply-chain guarantee. The PR does not touch the privileged update-dist-on-label.yml gating logic (label name, dependabot user id check, same-repo check, token handling) — it only swaps the action's SHA. No secrets, permissions, or trigger surfaces are altered.

Level of scrutiny

Low. This is a mechanical patch-version dependency bump in CI infrastructure with no behavioral change beyond a bundled pnpm minor update. The bug hunting system found nothing.

Other factors

All five occurrences were updated consistently to the same SHA, matching the Dependabot release notes. Safe to auto-approve.

[github-actions]

Experiment Results: 5741172

Experiment	Status	Actions
Uppercase (py)	✅ Pass	View GitHub Action Run · View in Langfuse
Uppercase (ts)	✅ Pass	View GitHub Action Run · View in Langfuse
Mixed dir (node)	✅ Pass	View GitHub Action Run · View in Langfuse
Mixed dir (python)	✅ Pass	View GitHub Action Run · View in Langfuse
Regression fixture	❌ Regression	View GitHub Action Run · View in Langfuse

Details

✅ Uppercase (py) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

✅ Uppercase (ts) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

✅ Mixed dir (node) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

✅ Mixed dir (python) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

❌ Regression fixture (Source)

RegressionError: synthetic regression triggered by e2e fixture

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000