.github/workflows/support.yml (1)

158-158: ⚠️ Potential issue | 🟡 Minor

Sir, a remnant from the previous era — a stale Yarn reference in the diagnostic output.

Line 158 still reads "Yarn/Corepack setup problems" in the failure troubleshooting hints. Given the migration, this should reference pnpm instead.

🐛 Proposed fix

-            echo "- Yarn/Corepack setup problems"
+            echo "- pnpm/Corepack setup problems"

.github/workflows/scan.yml (1)

118-130: ⚠️ Potential issue | 🟡 Minor

The JSON audit parsing requires recalibration, sir.

Two matters require attention on this reporting step:

1. jq path mismatch: The .data.vulnerabilities path does not exist in pnpm's audit output. pnpm follows npm's audit report v2 schema, which places vulnerability summaries at .metadata.vulnerabilities (containing severity counts). The current jq expression will silently resolve to "0", rendering the reported count rather decorative. The remedy is to use .metadata.vulnerabilities.total for an accurate count.

2. Severity filter omitted: The original command included --severity moderate, but the pnpm replacement lacks --audit-level. While this step gracefully continues via || true, you may wish to restore filtering for reporting fidelity. pnpm audit fully supports --audit-level moderate.

A minor matter, as the step does not gate the build, but one warrants correcting for accurate audit reporting.

🔧 Proposed adjustment for pnpm audit JSON parsing

-          pnpm audit --json > audit.json || true
+          pnpm audit --json --audit-level moderate > audit.json || true
           if [ -f audit.json ]; then
-            vulnerabilities=$(cat audit.json | jq -r '.data.vulnerabilities // {} | length // 0' 2>/dev/null || echo "0")
+            vulnerabilities=$(cat audit.json | jq '.metadata.vulnerabilities.total // 0' 2>/dev/null || echo "0")
             echo "Found $vulnerabilities vulnerabilities"