From 074afd89f6b4ddd1b0fc4ab0e830f63ee24dbe2b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Oct 2026 08:18:19 +0000
Subject: [PATCH 1/2] chore(deps): bump pnpm/action-setup

Bumps the github-actions group with 1 update: [pnpm/action-setup](https://github.com/pnpm/action-setup).


Updates `pnpm/action-setup` from 6.0.10 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/0977fd99725f1db4007ccb2928dbb4e90d06cc86...ea17c68df8912ef543352723c149a84f56e3d413)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/reusable-validate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/reusable-validate.yml b/.github/workflows/reusable-validate.yml
index 2ff1bae..a235a4e 100644
--- a/.github/workflows/reusable-validate.yml
+++ b/.github/workflows/reusable-validate.yml
@@ -65,7 +65,7 @@ jobs:
 
       - name: Setup pnpm
         if: inputs.package-manager == 'pnpm'
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node.js (with cache)
         if: inputs.package-manager != 'bun'

From 2e0f1380e455bd376928d468b9e6fe77929a70dc Mon Sep 17 00:00:00 2001
From: Bryan Sayler <207279+bryansayler@users.noreply.github.com>
Date: Mon, 5 Oct 2026 05:08:14 -0500
Subject: [PATCH 2/2] docs(evidence): bind pnpm action v6.1.0 to 074afd89f6b4

---
 ...pnpm-action-setup-v6-1-0-074afd89f6b4.json | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 .quirk/evidence/pnpm-action-setup-v6-1-0-074afd89f6b4.json

diff --git a/.quirk/evidence/pnpm-action-setup-v6-1-0-074afd89f6b4.json b/.quirk/evidence/pnpm-action-setup-v6-1-0-074afd89f6b4.json
new file mode 100644
index 0000000..243a3f4
--- /dev/null
+++ b/.quirk/evidence/pnpm-action-setup-v6-1-0-074afd89f6b4.json
@@ -0,0 +1,53 @@
+{
+  "schema_version": "evidence-receipt.v1",
+  "receipt_id": "qreceipt.pnpm-action-setup-v6-1-0.074afd89f6b4",
+  "repository": "Quirk-Systems/.github",
+  "status": "verified",
+  "subject": {
+    "base_commit": "4139373b697ee33d159d103feff01da29adc9819",
+    "commit": "074afd89f6b4ddd1b0fc4ab0e830f63ee24dbe2b",
+    "changed_paths": [
+      ".github/workflows/reusable-validate.yml"
+    ]
+  },
+  "claims": [
+    {
+      "claim_id": "qclaim.pnpm-action-setup-v6-1-0.074afd89f6b4",
+      "claim_type": "evidence",
+      "authority_effect": "none",
+      "statement": "Updates only the pnpm/action-setup pin in reusable-validate.yml from 0977fd99725f1db4007ccb2928dbb4e90d06cc86 (v6.0.10) to ea17c68df8912ef543352723c149a84f56e3d413 (v6.1.0). Consumer runtime behavior and merge approval are not established by this receipt.",
+      "evidence_paths": [
+        ".github/workflows/reusable-validate.yml"
+      ]
+    }
+  ],
+  "artifacts": [
+    {
+      "path": ".github/workflows/reusable-validate.yml",
+      "state": "present",
+      "git_blob": "a235a4e39c072f1b0bb9f5b33119d85cc09ddbd2",
+      "sha256": "sha256:93c4d8c2323254c078b89c0c526512d72a75129d40fc7d70e3fb62deb63f2fe9"
+    }
+  ],
+  "verification": {
+    "commands": [
+      {
+        "command": "python3 -m unittest tests.test_workflow_pins -v",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "python3 scripts/validate_governed_decisions.py --repository Quirk-Systems/.github --root . --decisions .quirk/decisions",
+        "result": "pass",
+        "exit_code": 0
+      }
+    ],
+    "verified_at": "2026-10-05T08:18:19Z"
+  },
+  "authority": {
+    "admission_effect": "none",
+    "authority_ref": null
+  },
+  "correction": null,
+  "receipt_sha256": "sha256:ebcf3cdb860eeb9bbb834adee82ebcc848ecd094edde2f83fc13abea5605c11f"
+}