From d57ec661b3c930dc338806b73b648d7d92a0dece Mon Sep 17 00:00:00 2001
From: Taesu <bytaesu@gmail.com>
Date: Wed, 27 May 2026 17:56:15 +0900
Subject: [PATCH] ci: pin actions to sha and bump pnpm/node toolchain

---
 .github/workflows/ci.yml      | 14 ++++++--------
 .github/workflows/release.yml | 14 ++++++--------
 .nvmrc                        |  1 +
 package.json                  |  1 +
 4 files changed, 14 insertions(+), 16 deletions(-)
 create mode 100644 .nvmrc

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51632f6..50dc1d2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,26 +2,24 @@ name: CI
 
 on: 
     pull_request:  
-        branches: main
+        branches: [main]
     push: 
-        branches: main
+        branches: [main]
     merge_group: {}
 
 jobs:
     test:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
               with:
                     fetch-depth: 0
 
-            - uses: pnpm/action-setup@v4
-              with:
-                version: 9.9.0
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
               with:
-                node-version: 20.x
+                node-version-file: '.nvmrc'
                 registry-url: 'https://registry.npmjs.org'
                 cache: pnpm
             
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 139fb8f..9d7244d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,25 +12,23 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
-          node-version: 20.x
+          node-version-file: '.nvmrc'
 
       - run: npx changelogithub
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
           
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9.9.0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
-            node-version: 20.x
+            node-version-file: '.nvmrc'
             registry-url: 'https://registry.npmjs.org'
 
       - run: pnpm install
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..a45fd52
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24
diff --git a/package.json b/package.json
index 0543261..e2e5b13 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,7 @@
 	"name": "@better-auth/utils",
 	"version": "0.4.0",
 	"license": "MIT",
+	"packageManager": "pnpm@11.1.1",
 	"description": "A collection of utilities for better-auth",
 	"main": "./dist/index.cjs",
 	"module": "./dist/index.mjs",