build(deps): bump pnpm/setup from 1 to 2

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
@@ -38,7 +38,7 @@ jobs:
         node-version: ['22.19.0', '24', '26']
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false

.github/workflows/native-host-smoke.yml

@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         if: inputs.host == 'both' || inputs.host == matrix.host
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         if: inputs.host == 'both' || inputs.host == matrix.host
         with:
           cache: true

.github/workflows/package-preview.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: echo "enabled=${{ env.NPM_TOKEN != '' }}" >> "$GITHUB_OUTPUT"
       - if: steps.gate.outputs.enabled == 'true'
-        uses: pnpm/setup@v1
+        uses: pnpm/setup@v2
         with:
           cache: true
           install: false

packages/agent-bundle/tests/native-host-smoke-workflow.test.ts

@@ -58,5 +58,5 @@ it('keeps source and installed-tarball native smokes in the manual self-hosted m
   expect(launcher).toContain("spawn(npm, args, { env: environment, stdio: 'inherit' })");
   expect(launcher).not.toMatch(/(?:^|\s)AGENT_BUNDLE_PACKED_NATIVE_[A-Z_]+=1\s+npm/u);
   expect(workflow).not.toMatch(/\bcorepack\b/u);
-  expect(workflow).toContain('uses: pnpm/setup@v1');
+  expect(workflow).toContain('uses: pnpm/setup@v2');
 });

packages/agent-bundle/tests/package-lint-workflow.test.ts

@@ -30,7 +30,7 @@ it('runs publint explicitly in CI and the local release audit', async () => {
   const steps = parsed.jobs?.verify?.steps ?? [];
   const rscSteps = parsed.jobs?.['rsc-runtime-micro-eval']?.steps ?? [];
   const packageLintIndex = steps.findIndex((step) => step.run === 'pnpm lint:package');
-  const setup = steps.find((step) => step.uses === 'pnpm/setup@v1');
+  const setup = steps.find((step) => step.uses === 'pnpm/setup@v2');
 
   expect(packageJson.scripts?.['lint:package']).toBe('publint packages/agent-bundle');
   expect(packageJson.scripts?.['audit:release']).toMatch(/^pnpm lint:package && /u);
@@ -40,7 +40,7 @@ it('runs publint explicitly in CI and the local release audit', async () => {
   expect(steps[packageLintIndex - 1]?.run).toBe('pnpm build');
   expect(rscSteps.map((step) => step.uses ?? step.run)).toEqual([
     'actions/checkout@v7',
-    'pnpm/setup@v1',
+    'pnpm/setup@v2',
     'pnpm install --frozen-lockfile',
     'pnpm eval:spot',
   ]);

packages/agent-bundle/tests/package-preview-workflow.test.ts

@@ -37,7 +37,7 @@ it('publishes one locked package preview for pull requests', async () => {
   expect(parsed.permissions).toEqual({});
   expect(steps.map((step) => step.uses ?? step.run)).toEqual([
     'actions/checkout@v7',
-    'pnpm/setup@v1',
+    'pnpm/setup@v2',
     'pnpm install --frozen-lockfile',
     'pnpm build',
     'pnpm preview:publish',