From eb2576b8c03d59b9049a754a190299edc9c58a95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?=
 <david.barragan@kaleidos.net>
Date: Mon, 28 Sep 2026 21:06:06 +0200
Subject: [PATCH] :construction_worker: Run plugins package deploy inside
 devenv container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parallel deploy jobs on the shared self-hosted host raced on
/home/runner/setup-pnpm (ENOTEMPTY / missing tarball errors).
Use penpotapp/devenv, which already ships the Node and pnpm versions
pinned in develop, and mount a persistent pnpm store from the host
instead of pnpm/setup + actions/cache.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
---
 .github/workflows/plugins-deploy-api-doc.yml  |  2 +-
 .github/workflows/plugins-deploy-package.yml  | 34 ++++++-------------
 .../workflows/plugins-deploy-styles-doc.yml   |  2 +-
 3 files changed, 12 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/plugins-deploy-api-doc.yml b/.github/workflows/plugins-deploy-api-doc.yml
index 12e6352688..dc74f61fdd 100644
--- a/.github/workflows/plugins-deploy-api-doc.yml
+++ b/.github/workflows/plugins-deploy-api-doc.yml
@@ -120,7 +120,7 @@ jobs:
           EOF
 
       - name: Deploy to Cloudflare Workers
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           workingDirectory: plugins
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
diff --git a/.github/workflows/plugins-deploy-package.yml b/.github/workflows/plugins-deploy-package.yml
index c8422566d8..8a65ef686f 100644
--- a/.github/workflows/plugins-deploy-package.yml
+++ b/.github/workflows/plugins-deploy-package.yml
@@ -35,6 +35,15 @@ permissions:
 jobs:
   deploy:
     runs-on: penpot-standar-runner
+    container:
+      image: penpotapp/devenv:latest
+      volumes:
+        # Persistent pnpm store shared by all runner instances on the host.
+        # pnpm's content-addressable store is safe for concurrent access.
+        - /var/cache/github-runner/pnpm-store:/root/.local/share/pnpm/store
+    defaults:
+      run:
+        shell: bash
     env:
       GH_REF: ${{ inputs.gh_ref }}
       PLUGIN_NAME: ${{ inputs.plugin_name }}
@@ -55,29 +64,6 @@ jobs:
           fetch-depth: 0
           ref: ${{ inputs.gh_ref }}
 
-      # START: Setup Node and PNPM enabling cache
-      - name: Setup pnpm + Node.js
-        uses: pnpm/setup@v2
-        with:
-          working-directory: plugins
-          runtime: node@24.21.0
-          install: false
-
-      - name: Get pnpm store path
-        id: pnpm-store
-        working-directory: ./plugins
-        shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm store
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('plugins/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-      # END: Setup Node and PNPM enabling cache
-
       - name: Install deps
         working-directory: ./plugins
         shell: bash
@@ -112,7 +98,7 @@ jobs:
           sed -i "s/WORKER_URI/${WORKER_URI}/g" "apps/${PLUGIN_NAME}-plugin/wrangler.toml"
 
       - name: Deploy to Cloudflare Workers
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           workingDirectory: plugins
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
diff --git a/.github/workflows/plugins-deploy-styles-doc.yml b/.github/workflows/plugins-deploy-styles-doc.yml
index 39c14580c2..2d356962bf 100644
--- a/.github/workflows/plugins-deploy-styles-doc.yml
+++ b/.github/workflows/plugins-deploy-styles-doc.yml
@@ -118,7 +118,7 @@ jobs:
           EOF
 
       - name: Deploy to Cloudflare Workers
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           workingDirectory: plugins
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}