chore(repo-maintain): consolidated repository maintenance pass

.github/workflows/ci.yml

@@ -34,6 +34,23 @@ jobs:
         with:
           node-version-file: .node-version
       - run: corepack enable
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          store_path="$(corepack pnpm store path --silent)"
+          delim="EOF_$(od -An -N8 -tx1 /dev/urandom | tr -d ' \n')"
+          {
+            printf 'STORE_PATH<<%s\n' "$delim"
+            printf '%s\n' "$store_path"
+            printf '%s\n' "$delim"
+          } >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
       - run: corepack pnpm install --frozen-lockfile --ignore-scripts
       - run: corepack pnpm "${{ matrix.command }}"
       - run: git diff --exit-code
@@ -56,7 +73,7 @@ jobs:
           command: run
           working-directory: .
           eval-paths: tests/fixtures/pass.eval.yaml
-          vally-version: 0.19.0
+          vally-version: 0.21.0
           report-id: native-pass
       - name: Verify native verdict failure through the same installed CLI
         id: failing
@@ -66,7 +83,7 @@ jobs:
           command: run
           working-directory: .
           eval-paths: tests/fixtures/fail.eval.yaml
-          vally-version: 0.19.0
+          vally-version: 0.21.0
           report-id: native-fail
       - name: Lint through the same installed CLI
         id: lint
@@ -75,7 +92,7 @@ jobs:
         with:
           command: lint
           working-directory: tests/fixtures
-          vally-version: 0.19.0
+          vally-version: 0.21.0
           report-id: native-lint
       - name: Check native results and structured uploads
         env:

README.md

@@ -93,7 +93,7 @@ version instead, add `vally-version`, for example:
 with:
   working-directory: evals
   suite: smoke
-  vally-version: '0.19.0' # Optional; omit for latest stable
+  vally-version: '0.21.0' # Optional; omit for latest stable
 ```
 
 The Action version (`@v0` or `@v0.1.0`) and Vally version are independent. Selecting a
@@ -431,7 +431,7 @@ dependencies can still change between jobs according to upstream ranges.
 Both modes trust npm and the upstream dependency graph; recorded digests are
 provenance, not a claim that the graph was reviewed with the Action.
 
-The development dependency remains pinned to Vally 0.19.0 for deterministic,
+The development dependency remains pinned to Vally 0.21.0 for deterministic,
 model-free CLI contract tests. It is a test fixture, not a runtime allowlist.
 
 Bundled dependencies are listed in

dist/THIRD-PARTY-NOTICES.txt

@@ -3112,7 +3112,7 @@ SOFTWARE.
 
 ========================================================================
 Package: fast-xml-parser
-Version: 5.11.2
+Version: 5.12.0
 License: MIT
 Notice status: license-text-included
 
@@ -4175,7 +4175,7 @@ SOFTWARE.
 
 ========================================================================
 Package: is-unsafe
-Version: 2.0.2
+Version: 2.0.3
 License: MIT
 Notice status: license-text-included
 

dist/bundled-dependencies.json

@@ -654,7 +654,7 @@
   },
   {
     "name": "fast-xml-parser",
-    "version": "5.11.2",
+    "version": "5.12.0",
     "declaredLicense": "MIT",
     "status": "license-text-included",
     "sources": [
@@ -987,7 +987,7 @@
   },
   {
     "name": "is-unsafe",
-    "version": "2.0.2",
+    "version": "2.0.3",
     "declaredLicense": "MIT",
     "status": "license-text-included",
     "sources": [

package.json

@@ -23,11 +23,11 @@
     "yaml": "2.9.1"
   },
   "devDependencies": {
-    "@microsoft/vally-cli": "0.19.0",
-    "@types/node": "24.19.0",
+    "@microsoft/vally-cli": "0.21.0",
+    "@types/node": "24.19.2",
     "@vitest/coverage-v8": "5.0.3",
     "esbuild": "0.28.2",
-    "oxlint": "1.87.0",
+    "oxlint": "1.90.0",
     "typescript": "7.0.2",
     "vitest": "5.0.3"
   }