ci: move provenance check out of setup action (#291)

* ci: try e18e/action-dependency-diff

* Try package changes

* Dedupe

* Update thresholds

* Move provenance out of setup

Author: lachlancollins

.github/setup/action.yml

@@ -3,10 +3,6 @@ description: Action that sets up Node, pnpm, and caching
 runs:
   using: composite
   steps:
-    - name: Check provenance
-      uses: danielroe/provenance-action@v0.1.1
-      with:
-        fail-on-downgrade: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.1.0
     - name: Setup Node

.github/workflows/pr.yml

@@ -46,3 +46,15 @@ jobs:
         run: pnpm run build:all
       - name: Publish Previews
         run: pnpx pkg-pr-new publish --pnpm --compact './packages/*' --no-template
+  provenance:
+    name: Provenance
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5.0.0
+        with:
+          fetch-depth: 0
+      - name: Check Provenance
+        uses: danielroe/provenance-action@v0.1.1
+        with:
+          fail-on-downgrade: true

pnpm-lock.yaml

@@ -50,5 +50,5 @@ catalog:
   vite-plugin-externalize-deps: ^0.9.0
   vite-tsconfig-paths: ^5.1.4
   vitest: ^3.2.4
-  vue: ^3.5.21
+  vue: ^3.5.22
   vue-eslint-parser: ^10.2.0