ci: census pnpm acquisition by need, not by mechanism spelling (#11779)

A grep for `corepack enable` across .github/workflows/ is on its way to 0 as
those sites move onto .github/actions/setup-pnpm. That zero is a true answer
about Corepack that reads as a complete answer about pnpm acquisition, and it
is not one: showcase-smoke.yml acquires pnpm through pnpm/action-setup, which
contains no Corepack string and is invisible to that key. A metric that reaches
zero while its subject survives is worse than no metric.

check-pnpm-acquisition keys the population on the NEED -- every job that RUNS
pnpm -- rather than on any one mechanism spelling, so a mechanism nobody has
taught it cannot become a silent zero: it surfaces as a job running pnpm with
no recognised acquisition, a loud failure. The full census prints on SUCCESS,
every mechanism keeping a row including the ones at 0.

It also pins the ordering that killed two jobs here with "Unable to locate
executable file: pnpm": a setup-node asking for the pnpm store cache shells out
to pnpm, so pnpm must be acquired strictly earlier. That is what makes
showcase-smoke.yml's inverted order safe to leave in place, and what catches the
naive conversion of it.


Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.github/workflows/lint.yml

@@ -1671,6 +1671,30 @@ jobs:
       - name: Node-version drift guard
         run: pnpm check:node-version
 
+      # pnpm-acquisition census. Sibling of the guard above, and here for the
+      # failure the guard above cannot have: a census that reaches ZERO while
+      # the thing it measures is still there. The `corepack enable` sites are
+      # moving onto .github/actions/setup-pnpm, and when that finishes a grep
+      # for `corepack enable` returns 0 — a true answer about Corepack that
+      # reads as a complete answer about pnpm acquisition. It is not one:
+      # showcase-smoke.yml acquires pnpm through `pnpm/action-setup`, which
+      # contains no Corepack string and is invisible to that key. A metric that
+      # hits zero while its subject survives is worse than no metric, because it
+      # retires the attention.
+      #
+      # So this gate is keyed on the NEED, not the mechanism: the population is
+      # every job that RUNS pnpm. A mechanism nobody has taught it cannot become
+      # a silent zero — it surfaces as a job running pnpm with no recognised
+      # acquisition, which fails loudly. It prints the full census on SUCCESS
+      # (every mechanism keeps a row, including the ones at 0), so the answer to
+      # "how does CI get pnpm" is one job log rather than a grep nobody thinks
+      # to re-derive. It also pins the ordering that killed two jobs in this
+      # repo with "Unable to locate executable file: pnpm": a setup-node asking
+      # for the pnpm store cache shells out to pnpm, so pnpm must be acquired
+      # strictly earlier. Runs its own --self-test first.
+      - name: pnpm-acquisition census
+        run: pnpm check:pnpm-acquisition
+
       # Workflow status-function guard (#5343, from #4900 and #4928). GitHub
       # wraps any `if:` that names no status function in an IMPLICIT success().
       # So a job-level condition written to read an upstream job's OUTPUT VALUE

.github/workflows/showcase-smoke.yml

@@ -19,6 +19,31 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v7
+      # ⚠️ This is the ONLY job in the repo that acquires pnpm through
+      # `pnpm/action-setup`, and the only one using setup-node's `cache: pnpm`.
+      # Those are the same fact, and the order below is load-bearing — read this
+      # before "tidying" it onto `.github/actions/setup-pnpm` like every other
+      # caller.
+      #
+      # `cache: pnpm` makes setup-node shell out to pnpm to locate the store, so
+      # pnpm must already be on PATH when setup-node runs. That is the OPPOSITE
+      # ordering from every setup-pnpm caller here (setup-node first, then the
+      # composite). Getting it backwards does not degrade, it kills the job in
+      # the setup step with "Unable to locate executable file: pnpm" — the
+      # failure `partof-closing-keyword-guard.yml` and `single-claim-path-guard.yml`
+      # both carry receipts for. `pnpm check:pnpm-acquisition` fails on that
+      # inversion, so the naive conversion is caught rather than shipped.
+      #
+      # Converting is therefore not a swap: it means DROPPING `cache: pnpm` and
+      # adding the house pair (`pnpm store path` → actions/cache, as ci.yml does
+      # seven times over). Deliberately not done here. This job is nightly and
+      # non-blocking, its one uncached pnpm download is a single fetch rather
+      # than the per-queue-build multiplier the composite was built to remove,
+      # and the restructure trades that for re-plumbing the dependency cache of
+      # a green job nothing gates on. The site is not hidden by staying: it is
+      # counted and printed by `pnpm check:pnpm-acquisition`, which is keyed on
+      # jobs that RUN pnpm rather than on any one spelling — precisely so this
+      # path cannot vanish from a `corepack enable`-shaped census again.
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:

package.json

@@ -105,6 +105,7 @@
     "check:release-page-status": "node scripts/check-release-page-status.mjs --self-test && node scripts/check-release-page-status.mjs",
     "check:release-body": "node scripts/release-github-releases.mjs --self-test",
     "check:node-version": "node scripts/check-node-version.mjs",
+    "check:pnpm-acquisition": "node scripts/check-pnpm-acquisition.mjs --self-test && node scripts/check-pnpm-acquisition.mjs",
     "check:workflow-status-functions": "node scripts/check-workflow-status-functions.mjs --self-test && node scripts/check-workflow-status-functions.mjs",
     "check:shard-attestation": "node scripts/check-shard-attestation.mjs --self-test && node scripts/check-shard-attestation.mjs",
     "check:required-contexts": "node scripts/check-required-contexts.mjs --self-test && node scripts/check-required-contexts.mjs",