chore: rebuild bundle after reverting bootstrap pnpm to 11.0.4

test: assert env var directly instead of relying on pnpm runtime behavior
The previous version of this test self-updated to pnpm 10.33.0 and expected pnpm --version to fail under devEngines.onFail=error. But pnpm v10 only reads the packageManager field, not devEngines, so the check never fired and the test failed. Switch the assertion to the contract the af8e203 scope fix actually enforces: when an explicit version: is supplied, pnpm_config_pm_on_fail must not be exported by the action. That's deterministic and pnpm-version-agnostic.
2026-05-15 06:43:32 +08:00 · 2026-05-11 01:49:47 +02:00 · 2026-05-11 01:49:23 +02:00 · 2026-05-11 01:49:23 +02:00 · 2026-05-11 01:49:22 +02:00 · 2026-05-11 01:49:22 +02:00
8 changed files with 430 additions and 326 deletions
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -1,43 +1,73 @@
 name: Test Action

 on:
-  - push
-  - pull_request
-  - workflow_dispatch
+  pull_request:
+  push:
+    branches:
+      - master
+  workflow_dispatch:

 jobs:
-  test_default_inputs:
-    name: Test with default inputs
+  smoke:
+    # Cross-OS coverage. Exercises the bootstrap install + PATH on each platform,
+    # the version-respects-request regression (#225 / #230 — Windows PATH shadow),
+    # and the bin_dest output regression (#247). Multi-version coverage on Linux
+    # so we don't pay 3x for major-version differences.
+    name: 'Smoke (${{ matrix.name }})'

    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
-        pnpm:
-          - 9.15.5
-        os:
-          - ubuntu-latest
-          - macos-latest
-          - windows-latest
+        include:
+          - name: 'ubuntu / v9.15.5'
+            os: ubuntu-latest
+            version: '9.15.5'
+          - name: 'ubuntu / v10.33.0'
+            os: ubuntu-latest
+            version: '10.33.0'
+          - name: 'ubuntu / v9.15.5 / custom-dest'
+            os: ubuntu-latest
+            version: '9.15.5'
+            dest: '~/test/pnpm'
+          - name: 'macos / v9.15.5'
+            os: macos-latest
+            version: '9.15.5'
+          - name: 'windows / v9.15.5'
+            os: windows-latest
+            version: '9.15.5'

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

-      - name: Run the action
+      - id: pnpm
+        name: Run the action
        uses: ./
        with:
-          version: 9.15.5
+          version: ${{ matrix.version }}
+          dest: ${{ matrix.dest || '~/setup-pnpm' }}

-      - name: 'Test: which'
-        run: which pnpm; which pnpx
-
-      - name: 'Test: version'
+      - name: 'Test: pnpm/pnpx on PATH report the requested version (incl. via bin_dest)'
+        # Pass paths via env, not template interpolation, so Windows
+        # backslashes in `bin_dest` aren't eaten by bash's escape handling.
+        env:
+          BIN_DEST: ${{ steps.pnpm.outputs.bin_dest }}
+          REQUIRED: ${{ matrix.version }}
        run: |
+          set -e
+          which pnpm
+          which pnpx
          actual="$(pnpm --version)"
-          echo "pnpm version: ${actual}"
-          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
-            echo "ERROR: pnpm --version did not produce valid output"
+          echo "pnpm --version: ${actual}"
+          if [ "${actual}" != "${REQUIRED}" ]; then
+            echo "Expected pnpm version ${REQUIRED}, but got ${actual}"
+            exit 1
+          fi
+          bin_dest_version="$("$BIN_DEST/pnpm" --version)"
+          echo "bin_dest pnpm --version: ${bin_dest_version}"
+          if [ "${bin_dest_version}" != "${REQUIRED}" ]; then
+            echo "Expected ${REQUIRED} via bin_dest, but got ${bin_dest_version}"
            exit 1
          fi
        shell: bash
@@ -50,54 +80,95 @@ jobs:
          pnpm add is-odd
        shell: bash

-  test_dest:
-    name: Test with dest
+  manifest_pin:
+    # Folds the old test_package_manager_field, test_dev_engines, and
+    # test_dev_engines_on_fail_error jobs. The action's manifest handling is
+    # OS-independent, so ubuntu-only is sufficient.
+    name: 'Manifest pin: ${{ matrix.label }}'

-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
-        pnpm:
-          - 9.15.5
-        os:
-          - ubuntu-latest
-          - macos-latest
-          - windows-latest
+        include:
+          - label: 'packageManager pnpm@9.15.5 (#227)'
+            manifest: '{"packageManager":"pnpm@9.15.5"}'
+            version: '9.15.5'
+          - label: 'packageManager pnpm@10.33.0'
+            manifest: '{"packageManager":"pnpm@10.33.0"}'
+            version: '10.33.0'
+          - label: 'devEngines onFail=download, exact'
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"9.15.5","onFail":"download"}}}'
+            version: '9.15.5'
+          - label: 'devEngines onFail=download, range'
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=9.15.0","onFail":"download"}}}'
+            version: '>=9.15.0'
+          - label: 'devEngines onFail=error, exact (#252)'
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"9.15.5","onFail":"error"}}}'
+            version: '9.15.5'
+          - label: 'devEngines onFail=error, range (#252)'
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=9.15.0","onFail":"error"}}}'
+            version: '>=9.15.0'
+          - label: 'explicit version: pnpm_config_pm_on_fail not exported'
+            # Regression guard for the af8e203 scope fix: when the user passes an
+            # explicit `version:` input, the action must NOT export
+            # pnpm_config_pm_on_fail=download, so the user's strict onFail policy
+            # is preserved. Asserted directly on the env var rather than pnpm
+            # runtime behavior — different pnpm majors read devEngines
+            # differently (v10 ignores it, v11+ honors it).
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"9.15.5","onFail":"error"}}}'
+            explicit_version: '10.33.0'
+            expect_pm_on_fail_unset: true

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

+      - name: Set up package.json
+        run: echo '${{ matrix.manifest }}' > package.json
+        shell: bash
+
      - name: Run the action
        uses: ./
        with:
-          version: 9.15.5
-          dest: ~/test/pnpm
+          version: ${{ matrix.explicit_version }}

-      - name: 'Test: which'
-        run: which pnpm && which pnpx
-
-      - name: 'Test: version'
+      - name: 'Test: pnpm reports the pinned version'
+        if: ${{ !matrix.expect_pm_on_fail_unset }}
+        env:
+          REQUIRED: ${{ matrix.version }}
        run: |
+          set -e
          actual="$(pnpm --version)"
          echo "pnpm version: ${actual}"
-          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
-            echo "ERROR: pnpm --version did not produce valid output"
+          if [ "${REQUIRED}" = ">=9.15.0" ]; then
+            min="9.15.0"
+            if [ "$(printf '%s\n' "${min}" "${actual}" | sort -V | head -n1)" != "${min}" ]; then
+              echo "Expected pnpm version >= ${min}, but got ${actual}"
              exit 1
            fi
+          else
+            if [ "${actual}" != "${REQUIRED}" ]; then
+              echo "Expected pnpm version ${REQUIRED}, but got ${actual}"
+              exit 1
+            fi
+          fi
        shell: bash

-  test_standalone:
-    name: Test with standalone
+      - name: 'Test: pnpm_config_pm_on_fail not exported (explicit version preserves strict policy)'
+        if: ${{ matrix.expect_pm_on_fail_unset }}
+        run: |
+          if [ -n "${pnpm_config_pm_on_fail:-}" ]; then
+            echo "Expected pnpm_config_pm_on_fail to be unset, but got: '${pnpm_config_pm_on_fail}'"
+            exit 1
+          fi
+          echo "pnpm_config_pm_on_fail is unset, as expected"
+        shell: bash

-    runs-on: ${{ matrix.os }}
+  standalone:
+    name: Standalone mode

-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
+    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -108,91 +179,29 @@ jobs:
          version: 9.15.0
          standalone: true

-      - name: 'Test: which'
-        run: which pnpm
-
-      - name: 'Test: version'
+      - name: 'Test: pnpm works'
        run: |
+          set -e
+          which pnpm
          actual="$(pnpm --version)"
-          echo "pnpm version: ${actual}"
-          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
-            echo "ERROR: pnpm --version did not produce valid output"
+          if [ "${actual}" != "9.15.0" ]; then
+            echo "Expected 9.15.0, got ${actual}"
            exit 1
          fi
-        shell: bash
-
-      - name: 'Test: install in a fresh project'
-        run: |
          mkdir /tmp/test-standalone
          cd /tmp/test-standalone
          pnpm init
          pnpm add is-odd
        shell: bash

-  test_dev_engines:
-    name: Test with devEngines.packageManager
+  run_install:
+    name: 'run_install (${{ matrix.run_install.name }})'

-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
-        os:
-          - ubuntu-latest
-          - macos-latest
-          - windows-latest
-        version:
-          - '9.15.5'
-          - '>=9.15.0'
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up package.json with devEngines.packageManager
-        run: echo '{"devEngines":{"packageManager":{"name":"pnpm","version":"${{ matrix.version }}","onFail":"download"}}}' > package.json
-        shell: bash
-
-      - name: Run the action
-        uses: ./
-
-      - name: 'Test: which'
-        run: which pnpm; which pnpx
-
-      - name: 'Test: version'
-        run: |
-          set -e
-          required='${{ matrix.version }}'
-          actual="$(pnpm --version)"
-          echo "pnpm version: ${actual}"
-
-          if [ "${required}" = ">=9.15.0" ]; then
-            min="9.15.0"
-            if [ "$(printf '%s\n' "${min}" "${actual}" | sort -V | head -n1)" != "${min}" ]; then
-              echo "Expected pnpm version >= ${min}, but got ${actual}"
-              exit 1
-            fi
-          else
-            if [ "${actual}" != "${required}" ]; then
-              echo "Expected pnpm version ${required}, but got ${actual}"
-              exit 1
-            fi
-          fi
-        shell: bash
-
-  test_run_install:
-    name: 'Test with run_install (${{ matrix.run_install.name }}, ${{ matrix.os }})'
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        pnpm:
-          - 9.15.5
-        os:
-          - ubuntu-latest
-          - macos-latest
-          - windows-latest
        run_install:
          - name: 'null'
            value: 'null'
@@ -213,15 +222,14 @@ jobs:
          version: 9.15.5
          run_install: ${{ matrix.run_install.value }}

-      - name: 'Test: which'
-        run: which pnpm; which pnpx
-
-      - name: 'Test: version'
+      - name: 'Test: pnpm works'
        run: |
+          set -e
+          which pnpm
+          which pnpx
          actual="$(pnpm --version)"
-          echo "pnpm version: ${actual}"
-          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
-            echo "ERROR: pnpm --version did not produce valid output"
+          if [ "${actual}" != "9.15.5" ]; then
+            echo "Expected 9.15.5, got ${actual}"
            exit 1
          fi
        shell: bash
--- a/dist/index.js
+++ b/dist/index.js
--- a/src/index.ts
+++ b/src/index.ts
@@ -20,9 +20,10 @@ async function main() {
 async function runMain(inputs: Inputs) {
  saveState('is_post', 'true')

-  await installPnpm(inputs)
+  const binDest = await installPnpm(inputs)
+  if (binDest === undefined) return
  console.log('Installation Completed!')
-  setOutputs(inputs)
+  setOutputs(inputs, binDest)

  await restoreCache(inputs)

--- a/src/install-pnpm/bootstrap/exe-lock.json
+++ b/src/install-pnpm/bootstrap/exe-lock.json
@@ -5,17 +5,18 @@
  "packages": {
    "": {
      "dependencies": {
-        "@pnpm/exe": "11.0.0-rc.2"
+        "@pnpm/exe": "11.0.4"
      }
    },
    "node_modules/@pnpm/exe": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-rc.2.tgz",
-      "integrity": "sha512-EkL8nZApA0wUA7c5hDdbeuyNUkmkDRBn8evxx4O79SMlEX1D6XspEu9EkLmT+sqrHsAwKzHTHsNYwTSOuKavRg==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.4.tgz",
+      "integrity": "sha512-3OwYqbbj1KtuUqoMo5OEkY8nU/WutZ7L5ADFl0bbW9oyqU55U37aDqA3NJNSk28CyszNARfrjerAF2DW2TsV7w==",
      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
-        "@reflink/reflink": "0.1.19"
+        "@reflink/reflink": "0.1.19",
+        "detect-libc": "^2.0.3"
      },
      "bin": {
        "pn": "pn",
@@ -27,18 +28,20 @@
        "url": "https://opencollective.com/pnpm"
      },
      "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.0.0-rc.2",
-        "@pnpm/linux-x64": "11.0.0-rc.2",
-        "@pnpm/macos-arm64": "11.0.0-rc.2",
-        "@pnpm/macos-x64": "11.0.0-rc.2",
-        "@pnpm/win-arm64": "11.0.0-rc.2",
-        "@pnpm/win-x64": "11.0.0-rc.2"
+        "@pnpm/linux-arm64": "11.0.4",
+        "@pnpm/linux-x64": "11.0.4",
+        "@pnpm/linuxstatic-arm64": "11.0.4",
+        "@pnpm/linuxstatic-x64": "11.0.4",
+        "@pnpm/macos-arm64": "11.0.4",
+        "@pnpm/macos-x64": "11.0.4",
+        "@pnpm/win-arm64": "11.0.4",
+        "@pnpm/win-x64": "11.0.4"
      }
    },
    "node_modules/@pnpm/linux-arm64": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-rc.2.tgz",
-      "integrity": "sha512-aw7wUq6ffXAfP7r9ZKa7GQmCoh/2EJcdb5ghkc8cgz0O2RZCmIaHqMV2O049iSAtblANkOu5uhwAZW7DKMJa3A==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.4.tgz",
+      "integrity": "sha512-Bz7V2sFypoGHX/t5w/w7jnCw5DCK3C8s5q8whHJJ3iS5kRznX3Q1F4LwSjjy+lsi777fHyNIvD7qtNmdt9IKoA==",
      "cpu": [
        "arm64"
      ],
@@ -52,9 +55,9 @@
      }
    },
    "node_modules/@pnpm/linux-x64": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-rc.2.tgz",
-      "integrity": "sha512-aCItGORv4lUjYldScyhd7uxgXQI3s1B1s99u5Eb42KRRC4Q8DAf7dboXbLGk7rQLjx8F9xIiaD7QX7YR8+MWEQ==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.4.tgz",
+      "integrity": "sha512-u0Yn1gytR1vKdPk6fYF500H8ZWQlj0cTuIQPp+5GYVPkMmA5bSw41RNIDPBfjDlE8ERmQWaQcrgmTcmTZ+n22A==",
      "cpu": [
        "x64"
      ],
@@ -67,10 +70,48 @@
        "url": "https://opencollective.com/pnpm"
      }
    },
+    "node_modules/@pnpm/linuxstatic-arm64": {
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.0.4.tgz",
+      "integrity": "sha512-0aitEcfhWNXNZhfJGt/kJaRvfcdtJzXZpV+toJN94kfawSJnhuawfnUSXMi/3m0G97HkJc7BH8rOz3sojUKt0g==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/linuxstatic-x64": {
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.0.4.tgz",
+      "integrity": "sha512-xDJdeJ7D2YvDBy2/IH9lEqMKiSuZiV8190XKWOgQgxUGGeuW4z3j6Ewpl0S5bXsWuNjAgC+uCKp7Qp3P7cXAvw==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
    "node_modules/@pnpm/macos-arm64": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-rc.2.tgz",
-      "integrity": "sha512-WsLK8St9Hpwp26qqdFVdLdDlJ3CLJVIkcFwP7G9b+HtkPZOx+Z9AGZ8iam1B7HSrf8XomZWlq0vntHDsc2uPTg==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.4.tgz",
+      "integrity": "sha512-dNR69jUARtGFuyyLE9VuyxhRUKC8MO/7/xIyAdeIMZAD5ej0Y/Ct0DYCa/FLbgFL1nXaXmp4+gRMfJBkkrKfQQ==",
      "cpu": [
        "arm64"
      ],
@@ -84,9 +125,9 @@
      }
    },
    "node_modules/@pnpm/macos-x64": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-rc.2.tgz",
-      "integrity": "sha512-hiC0khjWqSu6l25rs52izVhPM+6IVbp89pLRyBMYTe5x2a9iydUsCloPl7E+SuNiZ5cNnG28qj3PDzc5upeH/Q==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.4.tgz",
+      "integrity": "sha512-RfyrxSBajeEU16dZsgFjbdagDV9F4HNCJfbBgm8IbGjL0+J95naM/VmCDLd6S3+1tISeI2MxtcyCxqjKJsD/BA==",
      "cpu": [
        "x64"
      ],
@@ -100,9 +141,9 @@
      }
    },
    "node_modules/@pnpm/win-arm64": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-rc.2.tgz",
-      "integrity": "sha512-+bo8RmPQyPCKq+h1GE/QHJ7Ybt/4bWZLUSgXJQS6UOB7ar56g2g4ii1X5+8htkkdXxS5Uoj2TVqRjKp6hkkAdA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.4.tgz",
+      "integrity": "sha512-fOQEv8b9KxZlUAxPPXSQQUUIrt2nY24Qwd4RzCPpatacBnsE4JIadlr/B4V5z2zFxmV7FdHr7nYUhv2RqTlY/w==",
      "cpu": [
        "arm64"
      ],
@@ -116,9 +157,9 @@
      }
    },
    "node_modules/@pnpm/win-x64": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-rc.2.tgz",
-      "integrity": "sha512-srkbMALQgb4taTzKMlwqBZV+JHTh15jN4/FOVOGQ5XadjXdpJOievkvp/m87WankP8MX8th+mJhD9RX/rDOSOw==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.4.tgz",
+      "integrity": "sha512-pErHAV8m3NZuPSeCmH3senTSHX0nwkH5lLzQSpiFuyt08hq8sqL3jDymT4ri9N7ixPN9RFZghZIiT3h+Croaew==",
      "cpu": [
        "x64"
      ],
@@ -189,6 +230,9 @@
      "cpu": [
        "arm64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -205,6 +249,9 @@
      "cpu": [
        "arm64"
      ],
+      "libc": [
+        "musl"
+      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -221,6 +268,9 @@
      "cpu": [
        "x64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -237,6 +287,9 @@
      "cpu": [
        "x64"
      ],
+      "libc": [
+        "musl"
+      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -277,6 +330,15 @@
      "engines": {
        "node": ">= 10"
      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
    }
  }
 }
--- a/src/install-pnpm/bootstrap/pnpm-lock.json
+++ b/src/install-pnpm/bootstrap/pnpm-lock.json
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "pnpm": "11.0.0-rc.2"
+        "pnpm": "11.0.4"
      }
    },
    "node_modules/pnpm": {
-      "version": "11.0.0-rc.2",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-rc.2.tgz",
-      "integrity": "sha512-JkEMwm1mi63d4ToKzyx1ytALgqR3vMHi/mKd1B1reP4/stm7Ujr/951qkfBr6bkKYDJUPzC19zkxI5yCCqXwAQ==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.4.tgz",
+      "integrity": "sha512-CjlxZQB6AU7VKRmmHl9GxIubyohATDA+yuzGP2Le9WOJjTxril1epYEes5jP4DqwXaGlzpY/Em1erUwC+TuDww==",
      "license": "MIT",
      "bin": {
        "pn": "bin/pnpm.mjs",
--- a/src/install-pnpm/index.ts
+++ b/src/install-pnpm/index.ts
@@ -4,13 +4,15 @@ import runSelfInstaller from './run'

 export { runSelfInstaller }

-export async function install(inputs: Inputs) {
+export async function install(inputs: Inputs): Promise<string | undefined> {
  startGroup('Running self-installer...')
-  const status = await runSelfInstaller(inputs)
+  const { exitCode, binDest } = await runSelfInstaller(inputs)
  endGroup()
-  if (status) {
-    return setFailed(`Something went wrong, self-installer exits with code ${status}`)
+  if (exitCode) {
+    setFailed(`Something went wrong, self-installer exits with code ${exitCode}`)
+    return undefined
  }
+  return binDest
 }

 export default install
--- a/src/install-pnpm/run.ts
+++ b/src/install-pnpm/run.ts
@@ -12,7 +12,12 @@ import exeLock from './bootstrap/exe-lock.json'
 const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
 const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })

-export async function runSelfInstaller(inputs: Inputs): Promise<number> {
+export interface SelfInstallerResult {
+  exitCode: number
+  binDest: string
+}
+
+export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerResult> {
  const { version, dest, packageJsonFile } = inputs

  // pnpm v11 requires Node >= 22.13; use standalone (exe) bootstrap which
@@ -29,9 +34,23 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
  await writeFile(path.join(dest, 'package.json'), packageJson)
  await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))

-  const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest })
+  // Append the action's node directory to PATH so npm's
+  // `#!/usr/bin/env node` shebang resolves on runners (e.g. GHE
+  // self-hosted) where node isn't already on PATH. Append (not
+  // prepend) so a user-installed toolchain on PATH — e.g. from a
+  // prior `setup-node` step — keeps precedence; otherwise the
+  // runner-bundled node would shadow it and pair the user's npm
+  // with a mismatched node version. npm itself is resolved via
+  // PATH — on the GitHub Actions runner it is not co-located with
+  // `process.execPath`.
+  const nodeDir = path.dirname(process.execPath)
+  // On Windows, the PATH key casing varies; search case-insensitively.
+  const pathKey = Object.keys(process.env).find(k => k.toUpperCase() === 'PATH') ?? 'PATH'
+  const currentPath = process.env[pathKey]
+  const npmEnv = { ...process.env, [pathKey]: currentPath ? currentPath + path.delimiter + nodeDir : nodeDir }
+  const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest, env: npmEnv })
  if (npmExitCode !== 0) {
-    return npmExitCode
+    return { exitCode: npmExitCode, binDest: path.join(dest, 'node_modules', '.bin') }
  }

  // On Windows with standalone mode, npm's .bin shims can't properly
@@ -40,11 +59,13 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
  const pnpmHome = standalone && process.platform === 'win32'
    ? path.join(dest, 'node_modules', '@pnpm', 'exe')
    : path.join(dest, 'node_modules', '.bin')
-  // pnpm expects PNPM_HOME/bin in PATH for global binaries (e.g. node
-  // installed via `pnpm runtime`). Add it first so the next addPath
-  // (pnpmHome itself, which contains pnpm.exe) has higher precedence.
-  addPath(path.join(pnpmHome, 'bin'))
+  // PNPM_HOME/bin is where `pnpm self-update` places the target version
+  // binary. It must have higher PATH precedence than pnpmHome (which
+  // contains the bootstrap binary) so the self-updated version is found
+  // first. The bootstrap pnpm is invoked via absolute path, not PATH,
+  // so this ordering does not affect the bootstrap step.
  addPath(pnpmHome)
+  addPath(path.join(pnpmHome, 'bin'))
  exportVariable('PNPM_HOME', pnpmHome)

  // Ensure pnpm bin link exists — npm ci sometimes doesn't create it
@@ -71,11 +92,23 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
    const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
    const exitCode = await runCommand(cmd, args, { cwd: dest })
    if (exitCode !== 0) {
-      return exitCode
+      return { exitCode, binDest: pnpmHome }
    }
+    // self-update writes the target pnpm/pnpx into PNPM_HOME/bin, leaving
+    // the bootstrap symlinks in pnpmHome pointing at the old version. Use
+    // PNPM_HOME/bin so consumers of the bin_dest output (e.g.
+    // `${steps.pnpm.outputs.bin_dest}/pnpm`) invoke the requested version.
+    return { exitCode: 0, binDest: path.join(pnpmHome, 'bin') }
  }

-  return 0
+  // No explicit target version: rely on the bootstrap pnpm to switch to
+  // the version declared in packageManager/devEngines at runtime. Force
+  // `pmOnFail=download` so a project that pins
+  // `devEngines.packageManager.onFail = "error"` doesn't trip BAD_PM_VERSION
+  // before the switch can happen (issue #252). Scoped to this branch so users
+  // who pass an explicit `version:` input keep strict onFail behavior.
+  exportVariable('pnpm_config_pm_on_fail', 'download')
+  return { exitCode: 0, binDest: pnpmHome }
 }

 function readTargetVersion(opts: {
@@ -153,10 +186,11 @@ function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
  })
 }

-function runCommand(cmd: string, args: string[], opts: { cwd: string }): Promise<number> {
+function runCommand(cmd: string, args: string[], opts: { cwd: string; env?: Record<string, string | undefined> }): Promise<number> {
  return new Promise<number>((resolve, reject) => {
    const cp = spawn(cmd, args, {
      cwd: opts.cwd,
+      env: opts.env,
      stdio: ['pipe', 'inherit', 'inherit'],
      shell: process.platform === 'win32',
    })
--- a/src/outputs/index.ts
+++ b/src/outputs/index.ts
@@ -1,9 +1,7 @@
 import { setOutput } from '@actions/core'
 import { Inputs } from '../inputs'
-import { getBinDest } from '../utils'

-export function setOutputs(inputs: Inputs) {
-  const binDest = getBinDest(inputs)
+export function setOutputs(inputs: Inputs, binDest: string) {
  // NOTE: addPath is already called in installPnpm — do not call it again
  // here, as a second addPath would shadow the correct entry on Windows.
  setOutput('dest', inputs.dest)
Author	SHA1	Message	Date
Zoltan Kochan	b635341b3e	chore: rebuild bundle after reverting bootstrap pnpm to 11.0.4	2026-05-11 01:49:47 +02:00
Zoltan Kochan	025de3876f	test: assert env var directly instead of relying on pnpm runtime behavior The previous version of this test self-updated to pnpm 10.33.0 and expected pnpm --version to fail under devEngines.onFail=error. But pnpm v10 only reads the packageManager field, not devEngines, so the check never fired and the test failed. Switch the assertion to the contract the af8e203 scope fix actually enforces: when an explicit version: is supplied, pnpm_config_pm_on_fail must not be exported by the action. That's deterministic and pnpm-version-agnostic.	2026-05-11 01:49:23 +02:00
Zoltan Kochan	5c388c2b3b	test: assert onFail=error stays strict when explicit version is supplied Adds a manifest_pin matrix entry combining `version: 10.33.0` with `devEngines.packageManager` pinned to 9.15.5/onFail=error. The action self-updates to 10.33.0, then `pnpm --version` must fail with BAD_PM_VERSION — confirming pnpm_config_pm_on_fail=download is scoped to the no-target-version branch and does not silently override the user's strict policy.	2026-05-11 01:49:23 +02:00
Zoltan Kochan	84fa52c3d7	ci: consolidate test matrix and stop double-firing on PRs - Limit push trigger to master so PRs run jobs once instead of twice. - Fold test_default_inputs / test_dest / test_version_respects_request / test_bin_dest_output into one cross-OS `smoke` job (5 matrix entries: ubuntu × 2 versions + ubuntu custom-dest + macos + windows). - Fold test_package_manager_field / test_dev_engines / test_dev_engines_on_fail_error into one ubuntu-only `manifest_pin` job (6 matrix entries) — manifest handling is OS-independent. - Keep standalone and run_install but ubuntu-only. Total runs per PR push: ~88 → 14.	2026-05-11 01:49:22 +02:00
Zoltan Kochan	07ad39cba4	refactor: scope pm_on_fail override to the no-target-version branch Only export `pnpm_config_pm_on_fail=download` when the action is relying on bootstrap pnpm's runtime switch. When the user passes an explicit `version:` input, self-update aligns the binary and we should not silently override their `devEngines.packageManager.onFail = "error"` policy.	2026-05-11 01:49:22 +02:00
Zoltan Kochan	052c4ffb7d	fix: honor devEngines.packageManager.onFail=error (#252 ) Export pnpm_config_pm_on_fail=download so the bootstrap pnpm switches to the version pinned in devEngines.packageManager instead of throwing BAD_PM_VERSION on the user's first invocation.	2026-05-11 01:49:22 +02:00
Zoltan Kochan	91ab88e261	fix: bin_dest output points to self-updated pnpm, not bootstrap (#249 ) * fix: bin_dest output points to self-updated pnpm, not bootstrap (#247) `pnpm self-update <version>` writes the target binary to `${PNPM_HOME}/bin/`, leaving the bootstrap symlink at `${PNPM_HOME}/pnpm` untouched. The `bin_dest` output was set to `${PNPM_HOME}`, so consumers invoking `${{ steps.pnpm.outputs.bin_dest }}/pnpm` got the bootstrap version (currently 11.0.4) instead of the version they requested. PATH lookup hid the bug: `${PNPM_HOME}/bin` was prepended ahead of `${PNPM_HOME}`, so `pnpm` resolved from PATH was the right one. Existing version-respect tests only checked `pnpm --version`, not `bin_dest`. Resolve `binDest` inside `runSelfInstaller` (target lives in `${PNPM_HOME}/bin` after self-update, otherwise stays at `${PNPM_HOME}`) and plumb it through to `setOutputs`. Add a regression test that invokes `${bin_dest}/pnpm --version` directly across Linux/macOS/Windows. * test(ci): pass bin_dest via env to survive Windows backslashes Direct GitHub-expression interpolation of `${{ steps.pnpm.outputs.bin_dest }}` into the bash script let bash eat the backslashes in the Windows path (`C:Usersrunneradminsetup-pnpmnode_modules.binbin/pnpm`), failing with "No such file or directory". Forward the value via env so the path reaches bash unmangled. * build: rebuild dist with clean lockfile-matched deps	2026-05-07 12:58:58 +02:00
Zoltan Kochan	e578e19d19	fix: update pnpm to 11.0.4	2026-05-04 12:08:02 +02:00
Zoltan Kochan	8912a9102a	fix: append (not prepend) action node dir to PATH for npm bootstrap (#241 )	2026-05-02 16:10:46 +02:00
Ben Quarmby	26f6d4f2c5	fix: use npm co-located with the action node binary (#239 ) * fix: use npm co-located with the action node binary * fix: resolve npm by absolute path; guard against unset PATH Follow-up to `5a9e198`. Two refinements to the GHE self-hosted runner fix: - Spawn npm via `path.join(dirname(process.execPath), 'npm[.cmd]')` instead of relying on PATH lookup. This matches the original PR description and is robust against PATH-shadowed npm installations. - Avoid `"<dir>:undefined"` leaking into PATH when `process.env.PATH` is unset (rare, but possible in stripped environments). PATH still has the node directory prepended so npm's `#!/usr/bin/env node` shebang can resolve node on Linux/macOS. * fix: revert npm to PATH lookup; runner externals lacks npm Revert 42e75a1's switch to absolute-path npm resolution. The premise that npm is co-located with the action's node binary is false on GitHub-hosted runners: `process.execPath` points into `runner/externals/node24/bin/`, which contains node only — not npm. The absolute-path spawn produced ENOENT on Linux/macOS and "not recognized" on Windows. Go back to spawning `'npm'` and relying on PATH lookup, which works on standard runners (npm is on PATH from the runner image) and on the GHE self-hosted setup that motivated the original fix. Keep the node-directory prepend so npm's `#!/usr/bin/env node` shebang resolves, and keep the unset-PATH guard. --------- Co-authored-by: Zoltan Kochan <z@kochan.io>	2026-04-30 22:28:41 +02:00
Zoltan Kochan	903f9c1a6e	fix: update pnpm to 11.0.0-rc.5	2026-04-21 20:27:39 +02:00
Zoltan Kochan	bdf0af2a9d	test: add strict version-match jobs to reproduce #225 / #227 The existing version tests only check output format via regex, which is why the PATH-shadowing bug (#230) slipped through — the bootstrap pnpm's version string matched the regex just as well as the requested version. - test_version_respects_request: runs the action with `version: 9.15.5` and `version: 10.33.0` (both differ from the bootstrap) and asserts that `pnpm --version` matches exactly. Regression test for #225/#230. - test_package_manager_field: writes a `packageManager: pnpm@<v>` entry into package.json, runs the action with no `version:` input, and asserts exact match. Reproduces #227; currently expected to fail since `packageManager` extraction was intentionally not added.	2026-04-18 15:20:30 +02:00
oniani1	71c92474e7	fix: pnpm self-update binary shadowed by bootstrap on PATH (#230 ) Problem pnpm self-update installs the target version to PNPM_HOME/bin/pnpm, but the bootstrap binary at PNPM_HOME/pnpm has higher PATH precedence because addPath(pnpmHome) was called after addPath(pnpmHome/bin). @actions/core's addPath prepends, so the later call wins — the bootstrap version shadows the self-updated binary. Fix Swap the addPath call order so PNPM_HOME/bin (where self-update puts the target binary) has higher PATH precedence. The bootstrap pnpm is invoked via absolute path, so this doesn't affect the bootstrap step.	2026-04-18 15:00:23 +02:00