chore: ensure that pnpm also enforces minimumReleaseAge (#40476)

On top of our Renovate configuration[0] not allowing Renovate to prepare
updates until npm packages have been available for 7 days, we can
provide "defence in depth" by also wiring in pnpm's configuration.

This takes the rules from [0] and applies them to explicitly allowlist
our packages, as well as set the limit to 7 days.

To make sure our E2E tests still operate, we can - in a slightly hacky
manner - disable `minimumReleaseAge` by deleting the
`pnpm-workspace.yaml`, as it doesn't seem to be possible to
`--ignore-workspace` while using `minimumReleaseAge`, as it still
requires the `minimumReleaseAge` to pass.

[0]: https://github.com/renovatebot/.github/blob/095f454e8b1141edb1045dd389bee4c59c51613e/default.json

Author: jamietanna

.github/workflows/build.yml

@@ -43,6 +43,7 @@ env:
     patches/
     tools/
     package.json
+    pnpm-workspace.yaml
     pnpm-lock.yaml
 
 jobs:
@@ -745,7 +746,11 @@ jobs:
         run: pnpm test-e2e:pack
 
       - name: Install dependencies
-        run: pnpm test-e2e:install
+        run: |
+          # as `--ignore-workspace` doesn't seem to apply to `minimumReleaseAge`, forcibly delete our workspace
+          rm pnpm-workspace.yaml
+
+          pnpm test-e2e:install
 
       - name: E2E Test
         run: pnpm test-e2e:run

pnpm-workspace.yaml

@@ -1,3 +1,17 @@
 packages: []
 
 strictPeerDependencies: true
+
+# in line with https://github.com/renovatebot/.github/blob/main/default.json,
+# all non-Renovate or non-Containerbase packages should only be installed after
+# 7 days
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@renovatebot/detect-tools'
+  - '@renovatebot/osv-offline'
+  - '@renovatebot/pep440'
+  - '@renovatebot/pgp'
+  - '@renovatebot/ruby-semver'
+  - '@containerbase/eslint-plugin'
+  - '@containerbase/istanbul-reports-html'
+  - '@containerbase/semantic-release-pnpm'