fix: self-update bootstrap to packageManager-pinned version (#233) (#256)

* fix: self-update bootstrap to packageManager-pinned version (#233)

When package.json pins pnpm via `packageManager` or an exact
`devEngines.packageManager.version`, self-update the bootstrap up
front. The bootstrap's `pnpm store path` skips pnpm's auto-switch
(the `store` command sets `skipPackageManagerCheck = true`), so it
reports the bootstrap's `STORE_VERSION` while the user's actual
install runs under the pinned version and writes to a different
STORE_VERSION — breaking `cache: true` and `setup-node`'s
`cache: pnpm` on cold caches.

* fix: check bin/ dir instead of pnpm.exe for self-update detection

On Windows pnpm self-update writes `.bin/bin/pnpm` (a JS launcher),
not `.bin/bin/pnpm.exe`, so the previous existsSync probe always
fell back to pnpmHome and the bin_dest output pointed at the
bootstrap pnpm. Check whether the `bin` directory itself exists.

* fix: self-update accepts ranges; drop exact-semver gate

`pnpm self-update` resolves semver ranges to a specific version, so
`devEngines.packageManager.version: ">=10 <11"` can also go through
the self-update path. That makes readTargetVersion total — it always
returns a string or throws — so the runtime auto-switch fallback (and
the `pnpm_config_pm_on_fail=download` export from #252) is no longer
reachable and gets removed.

Adds a range case to the cache_store_path matrix.

.github/workflows/test.yaml

@@ -194,6 +194,54 @@ jobs:
           pnpm add is-odd
         shell: bash
 
+  cache_store_path:
+    # Regression guard for #233. When package.json pins a pnpm major that
+    # differs from the bootstrap pnpm's major, the bootstrap reports its
+    # own STORE_VERSION from `pnpm store path` (the `store` command skips
+    # pnpm's auto-switch). The user's actual `pnpm install` runs under the
+    # pinned version and writes to a different STORE_VERSION, so the post
+    # step's saveCache then fails with "Path Validation Error". The fix is
+    # to self-update the bootstrap to the pinned version up front.
+    name: 'Cache store path matches install (#233): ${{ matrix.label }}'
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: 'packageManager pnpm@10.33.0'
+            manifest: '{"packageManager":"pnpm@10.33.0","dependencies":{"is-odd":"3.0.1"}}'
+          - label: 'devEngines exact pnpm@10.33.0'
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"10.33.0"}},"dependencies":{"is-odd":"3.0.1"}}'
+          - label: 'devEngines range >=10 <11'
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=10 <11"}},"dependencies":{"is-odd":"3.0.1"}}'
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Set up package.json
+        run: echo '${{ matrix.manifest }}' > package.json
+        shell: bash
+
+      - id: pnpm
+        uses: ./
+        with:
+          cache: true
+          run_install: |
+            - args: [--no-frozen-lockfile]
+
+      - name: 'Test: store path computed by the action exists on disk'
+        run: |
+          set -e
+          actual="$(pnpm store path --silent)"
+          echo "pnpm store path: ${actual}"
+          if [ ! -d "${actual}" ]; then
+            echo "Expected store path to exist on disk; cache save would fail"
+            exit 1
+          fi
+        shell: bash
+
   run_install:
     name: 'run_install (${{ matrix.run_install.name }})'
 

src/install-pnpm/run.ts

@@ -84,37 +84,31 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
     ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
     : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
 
-  // Determine the target version
+  // Self-update the bootstrap to the requested pnpm version. readTargetVersion
+  // either returns a value or throws, so this always runs.
   const targetVersion = readTargetVersion({ version, packageJsonFile })
-
+  const cmd = standalone ? bootstrapPnpm : process.execPath
-  if (targetVersion) {
+  const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
-    const cmd = standalone ? bootstrapPnpm : process.execPath
+  const exitCode = await runCommand(cmd, args, { cwd: dest })
-    const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
+  if (exitCode !== 0) {
-    const exitCode = await runCommand(cmd, args, { cwd: dest })
+    return { exitCode, binDest: pnpmHome }
-    if (exitCode !== 0) {
-      return { exitCode, binDest: pnpmHome }
-    }
-    // self-update writes the target pnpm/pnpx into PNPM_HOME/bin, leaving
-    // the bootstrap symlinks in pnpmHome pointing at the old version. Use
-    // PNPM_HOME/bin so consumers of the bin_dest output (e.g.
-    // `${steps.pnpm.outputs.bin_dest}/pnpm`) invoke the requested version.
-    return { exitCode: 0, binDest: path.join(pnpmHome, 'bin') }
   }
-
+  // self-update writes the target pnpm/pnpx into PNPM_HOME/bin, leaving
-  // No explicit target version: rely on the bootstrap pnpm to switch to
+  // the bootstrap symlinks in pnpmHome pointing at the old version. Use
-  // the version declared in packageManager/devEngines at runtime. Force
+  // PNPM_HOME/bin so consumers of the bin_dest output (e.g.
-  // `pmOnFail=download` so a project that pins
+  // `${steps.pnpm.outputs.bin_dest}/pnpm`) invoke the requested version.
-  // `devEngines.packageManager.onFail = "error"` doesn't trip BAD_PM_VERSION
+  //
-  // before the switch can happen (issue #252). Scoped to this branch so users
+  // When the requested version resolves to the bootstrap version, self-update
-  // who pass an explicit `version:` input keep strict onFail behavior.
+  // is a no-op and PNPM_HOME/bin is not created — fall back to pnpmHome,
-  exportVariable('pnpm_config_pm_on_fail', 'download')
+  // whose symlinks already point at the right version.
-  return { exitCode: 0, binDest: pnpmHome }
+  const updatedBinDir = path.join(pnpmHome, 'bin')
+  return { exitCode: 0, binDest: existsSync(updatedBinDir) ? updatedBinDir : pnpmHome }
 }
 
 function readTargetVersion(opts: {
   readonly version?: string | undefined
   readonly packageJsonFile: string
-}): string | undefined {
+}): string {
   const { version, packageJsonFile } = opts
   const { GITHUB_WORKSPACE } = process.env
 
@@ -135,12 +129,15 @@ function readTargetVersion(opts: {
     }
   }
 
+  // packageManager is always exact `pnpm@<version>[+<integrity>]` per spec.
+  // Strip the integrity hash for self-update.
+  const packageManagerVersion =
+    typeof packageManager === 'string' && packageManager.startsWith('pnpm@')
+      ? packageManager.slice('pnpm@'.length).split('+')[0]
+      : undefined
+
   if (version) {
-    if (
+    if (packageManagerVersion && packageManagerVersion !== version) {
-      typeof packageManager === 'string' &&
-      packageManager.startsWith('pnpm@') &&
-      packageManager.replace('pnpm@', '') !== version
-    ) {
       throw new Error(`Multiple versions of pnpm specified:
   - version ${version} in the GitHub Action config with the key "version"
   - version ${packageManager} in the package.json with the key "packageManager"
@@ -150,13 +147,22 @@ Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_
     return version
   }
 
-  // pnpm will automatically download and switch to the right version
+  // Self-update the bootstrap pnpm to the version pinned in package.json so
-  if (typeof packageManager === 'string' && packageManager.startsWith('pnpm@')) {
+  // PATH-resolved `pnpm` (and the bin_dest output) reflect the target
-    return undefined
+  // version. Without this, `pnpm store path` runs as the bootstrap and
+  // reports a different STORE_VERSION than the one the user's actual
+  // install writes to — breaking cache: true and actions/setup-node's
+  // `cache: pnpm` on cold caches (issue #233).
+  //
+  // devEngines.packageManager takes priority over packageManager, matching
+  // pnpm's getWantedPackageManager logic. `pnpm self-update` accepts both
+  // exact versions and semver ranges, so we pass either through directly.
+  if (devEngines?.packageManager?.name === 'pnpm' && devEngines.packageManager.version) {
+    return devEngines.packageManager.version
   }
 
-  if (devEngines?.packageManager?.name === 'pnpm' && devEngines.packageManager.version) {
+  if (packageManagerVersion) {
-    return undefined
+    return packageManagerVersion
   }
 
   if (!GITHUB_WORKSPACE) {