---
title: “Cannot Find Matching Keyid” Errors or “Corepack/PNPM Not Found” on GitHub Actions
description: How to debug and address this corepack issue with GitHub Actions.
url: /kb/guide/corepack-errors-github-actions
canonical_url: "https://vercel.com/kb/guide/corepack-errors-github-actions"
published: 2025-11-03
last_updated: 2025-11-10
authors: Lee Robinson
related: []
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

If your builds suddenly fail with messages like `cannot find matching keyid: {"signatures":[...],"keys":[...]}`, it usually means **npm registry keys have been rotated**, and your older Corepack can’t verify new versions of `pnpm` (like 9.15.4 or 10.1.0+).

This can happen on GitHub Actions, GitLab, Docker, or anywhere else you’re using Corepack to manage package managers.

## Quick Debug Steps

1. **Check Node.js version:** `node -v` (If you see `v16.x`, you’re on Node 16; if you see `v18.x` or higher, you’re on Node 18+.)
   
2. **Check Corepack version:** `corepack --version.` Anything older than `0.31.0` may not have the new key set.
   
3. **Look for conditional logic.** Some workflows only update Corepack on Node 16. If you’re building on Node 18+, that logic might skip the update entirely.
   

## How to Fix It

### 1\. If You’re on Node 18+ (or Newer)

**Upgrade** to the latest Corepack (≥ `0.31.0`):

```bash
steps:
  - name: Use Latest Corepack
    run: |
      echo "Before: corepack version => $(corepack --version || echo 'not installed')"
      npm install -g corepack@latest
      echo "After : corepack version => $(corepack --version)"
      corepack enable
      pnpm --version
```

This ensures you have the **new signing keys** that match the npm registry changes.

### 2\. If You’re on Node 16 (Cannot Drop Node 16 Support)

Use **Corepack** **`0.20`**, which is the last release that still supports Node 16 _and_ includes the updated keys for recent pnpm versions:

```bash
steps:
  - name: Pin Corepack 0.20
    run: |
      echo "Before: corepack => $(corepack --version || echo 'not installed')"
      npm install -g corepack@0.20
      echo "After : corepack => $(corepack --version)"
      corepack enable
      pnpm --version
```

After `0.20`, newer Corepack versions drop Node 16 support, so this is a safe “stopgap” if you can’t move off Node 16 yet.

### 3\. Avoid Disabling Signature Checks

While setting `COREPACK_INTEGRITY_KEYS=0` (to skip signature checks) _can_ bypass the error, it also bypasses **important security**. Use that approach **only** if you fully understand the risks.

## Summary

1. **Check** your Node and Corepack versions.
   
2. **Upgrade** to Corepack ≥ `0.31.0` if you’re on Node 18+ (or pinned to `0.20` if you need Node 16).
   
3. **Remove** any conditional logic that prevents the Corepack upgrade from running on your actual environment.
   
4. **Done!** Your CI builds should succeed, and you stay secure.
   

For more details, see [Corepack Issue #612](https://github.com/nodejs/corepack/issues/612) and the [Corepack Releases](https://github.com/nodejs/corepack/releases).