Configure Volta for frontend toolchain - #1280
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔵 Needs a closer look
It changes CI/toolchain provisioning and relies on runtime downloads, so it needs a human to validate reliability across the affected workflows.
Pull request overview
Pins and standardizes the frontend Node.js/pnpm toolchain via Volta, updates CI to use Volta instead of setup-node + global pnpm installs, and aligns developer/agent documentation with the new policy.
Changes:
- Added Volta toolchain pins (Node + pnpm) to
ui/menu-website/package.json. - Switched relevant GitHub Actions jobs to
volta-cli/action@v4and enabledVOLTA_FEATURE_PNPM. - Updated frontend/agent docs to describe the Volta +
VOLTA_FEATURE_PNPMrequirement.
File summaries
| File | Description |
|---|---|
| ui/menu-website/README.md | Documents Volta as the supported toolchain and calls out VOLTA_FEATURE_PNPM=1. |
| ui/menu-website/package.json | Adds volta pins for Node and pnpm. |
| AGENTS.md | Updates repo guidance to reflect Volta as the supported frontend toolchain and CI setup. |
| .github/workflows/main.yml | Replaces Node/pnpm setup with Volta in pnpm-using CI jobs and sets VOLTA_FEATURE_PNPM. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Pin the frontend Node.js and pnpm versions in package.json and use Volta in the pnpm-based GitHub Actions jobs. Update the agent and frontend setup guidance to match. Co-authored-by: Codex <codex@openai.com>
Address the GitHub Advanced Security and SonarCloud findings by pinning each Volta action use to the verified v4 commit. Co-authored-by: Codex <codex@openai.com>
92c1cde to
ac49e48
Compare
This quality-gate finding is valid and will be fixed rather than dismissed. SonarCloud’s three findings are the same mutable |
|
Summary
ui/menu-website/package.jsonfor Volta.volta-cli/action@v4and Volta's pnpm feature in every pnpm-using CI job.Changes
22.22.2and pnpm11.21.0.actions/setup-nodeand floatingpnpm@latestsetup in the frontend validation, frontend E2E, and E2E report jobs.ui/menu-website/package.jsonto the Volta action and enabledVOLTA_FEATURE_PNPM.Verification
Passed:
pnpm install --frozen-lockfilepnpm run lint(16 existing warnings, zero errors)pnpm run test:unit— 15 files, 156 tests passedgit diff --checkFailed or blocked:
pnpm run build— fails on untouched recipe-form TypeScript errors and the missing generated OpenAPI module.pnpm run test:storybook— Chromium launch is blocked by the sandbox withspawn EPERM.22.22.2fromnodejs.org; the distribution URL is available.