---
title: “Cannot Find Matching Keyid” Errors or “Corepack/PNPM Not Found” on GitHub Actions
description: How to debug and address this corepack issue with GitHub Actions.
url: /kb/guide/corepack-errors-github-actions
canonical_url: "https://vercel.com/kb/guide/corepack-errors-github-actions"
published: 2025-11-03
last_updated: 2025-11-10
authors: Lee Robinson
related: []
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---
<!-- docsgraph:related -->
## Related pages

> **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below.

- [React2Shell Security Bulletin](https://vercel.com/blog/resources-for-protecting-against-react2shell?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related)
- [Critical npm supply chain attack response – September 8, 2025](https://vercel.com/blog/critical-npm-supply-chain-attack-response-september-8-2025?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related)
- [Deployment Checks](https://vercel.com/docs/deployment-checks?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Set conditions that must be met before proceeding to the next phase of the deployment lifecycle.
- [Advanced Node.js Usage](https://vercel.com/docs/functions/runtimes/node-js/advanced-node-configuration?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Learn about advanced configurations for Vercel functions on Vercel.
- [Deploying GitHub Projects with Vercel](https://vercel.com/docs/git/vercel-for-github?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Vercel for GitHub automatically deploys your GitHub projects with Vercel, providing Preview Deployment URLs, and automat
- [How do I use the latest npm version for my Vercel Deployment?](https://vercel.com/kb/guide/how-do-i-use-the-latest-npm-version-for-my-vercel-deployment?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Learn how to use the latest npm version for Vercel deployments.
- [Fixing deployments that hang after the build step succeeds](https://vercel.com/kb/guide/fixing-deployments-that-hang-after-the-build-step-succeeds?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Vercel deployment stuck in "Building" after the build succeeds, with checks and domain assignment pending? The cause is
- [How do I resolve a 'module not found' error?](https://vercel.com/kb/guide/how-do-i-resolve-a-module-not-found-error?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Information on resolving a 'module not found' error.
- [Dependencies from package.json are missing after install](https://vercel.com/kb/guide/dependencies-from-package-json-missing-after-install?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Understand why dependencies may not being installed during a build and how to fix.
- [How do I use the "Ignored Build Step" field on Vercel?](https://vercel.com/kb/guide/how-do-i-use-the-ignored-build-step-field-on-vercel?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=related) — Instructions on how to use the "Ignored Build Step" field to programmatically prevent a new deployment from being built.

Full cross-link map for this page: [/kb/guide/corepack-errors-github-actions.graph.md](/kb/guide/corepack-errors-github-actions.graph.md?from=related&source_path=%2Fkb%2Fguide%2Fcorepack-errors-github-actions&source_site=vercel-kb&relationship=graph)
<!-- /docsgraph:related -->


If your builds suddenly fail with messages like `cannot find matching keyid: {"signatures":[...],"keys":[...]}`, it usually means **npm registry keys have been rotated**, and your older Corepack can’t verify new versions of `pnpm` (like 9.15.4 or 10.1.0+).

This can happen on GitHub Actions, GitLab, Docker, or anywhere else you’re using Corepack to manage package managers.

## Quick Debug Steps

1. **Check Node.js version:** `node -v` (If you see `v16.x`, you’re on Node 16; if you see `v18.x` or higher, you’re on Node 18+.)
   
2. **Check Corepack version:** `corepack --version.` Anything older than `0.31.0` may not have the new key set.
   
3. **Look for conditional logic.** Some workflows only update Corepack on Node 16. If you’re building on Node 18+, that logic might skip the update entirely.
   

## How to Fix It

### 1\. If You’re on Node 18+ (or Newer)

**Upgrade** to the latest Corepack (≥ `0.31.0`):

```bash
steps:
  - name: Use Latest Corepack
    run: |
      echo "Before: corepack version => $(corepack --version || echo 'not installed')"
      npm install -g corepack@latest
      echo "After : corepack version => $(corepack --version)"
      corepack enable
      pnpm --version
```

This ensures you have the **new signing keys** that match the npm registry changes.

### 2\. If You’re on Node 16 (Cannot Drop Node 16 Support)

Use **Corepack** **`0.20`**, which is the last release that still supports Node 16 _and_ includes the updated keys for recent pnpm versions:

```bash
steps:
  - name: Pin Corepack 0.20
    run: |
      echo "Before: corepack => $(corepack --version || echo 'not installed')"
      npm install -g corepack@0.20
      echo "After : corepack => $(corepack --version)"
      corepack enable
      pnpm --version
```

After `0.20`, newer Corepack versions drop Node 16 support, so this is a safe “stopgap” if you can’t move off Node 16 yet.

### 3\. Avoid Disabling Signature Checks

While setting `COREPACK_INTEGRITY_KEYS=0` (to skip signature checks) _can_ bypass the error, it also bypasses **important security**. Use that approach **only** if you fully understand the risks.

## Summary

1. **Check** your Node and Corepack versions.
   
2. **Upgrade** to Corepack ≥ `0.31.0` if you’re on Node 18+ (or pinned to `0.20` if you need Node 16).
   
3. **Remove** any conditional logic that prevents the Corepack upgrade from running on your actual environment.
   
4. **Done!** Your CI builds should succeed, and you stay secure.
   

For more details, see [Corepack Issue #612](https://github.com/nodejs/corepack/issues/612) and the [Corepack Releases](https://github.com/nodejs/corepack/releases).