devops

To set up a GitHub Actions CI pipeline for pnpm, configure pinned action versions, enable dependency caching, and enforce frozen-lockfile installs to keep builds deterministic and fast. Run checks in a strict order: lint, typecheck, test, build, then security audit.

pnpm lockfile drift breaks CI when dependencies are installed without the frozen-lockfile flag, allowing unexpected version updates. Prevent this by enforcing frozen-lockfile installations in your GitHub Actions workflow and requiring this status check on protected branches.

The best way to configure branch protection is to require lint, typecheck, test, build, and security audit status checks without bypass permissions. This ensures every pull request to main passes predictable, deterministic checks before merging safely.

Yes, GitHub Actions supports caching for pnpm to speed up TypeScript CI pipelines. Configure pnpm dependency caching in your workflow to reduce installation times and maintain deterministic builds across pipeline runs.

To fix flaky tests and OOM builds in a TypeScript Node CI pipeline, apply standardized troubleshooting patterns for common failures. Ensure your GitHub Actions workflow uses pinned action versions and proper dependency caching to reduce resource inconsistencies.

You should run a security audit in your CI pipeline after lint, typecheck, test, and build steps complete. Running a high-severity security audit at the end of the ordered job ensures vulnerabilities are caught consistently before any safe deployment.