240 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
mungodewar	0e279bb959	fix: update pnpm to 11.1.1 (#248) ... * fix: update pnpm to v11.1.1 * fix: update bundle --------- Co-authored-by: Zoltan Kochan <z@kochan.io> v6 v6.0.8	2026-05-12 14:32:25 +02:00
Zoltan Kochan	3e835812ef	fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258) ... `patchPnpmEnv` prepended `dest/node_modules/.bin` to PATH before spawning `pnpm install` / `pnpm store prune`. On Windows in standalone mode, `.bin/pnpm.cmd` is an npm-created shim that always points at the BOOTSTRAP pnpm (currently 11.0.4) — the binary npm linked when it installed `@pnpm/exe` into `node_modules`. The self-updated pnpm written by `pnpm self-update` lives at `$PNPM_HOME/bin`, which is separately added to PATH via `addPath()` in install-pnpm. When the user requested a pnpm version different from the bootstrap under `standalone: true` on Windows, patchPnpmEnv's `.bin` entry shadowed the self-updated `$PNPM_HOME/bin` and the action's internal `pnpm install` ran on the bootstrap. On a pnpm 11.0.x bootstrap this broke any 11.1+ install flag (e.g. `--no-runtime`), reporting: ERROR Unknown option: 'runtime' POSIX standalone got lucky because `.bin` and `$PNPM_HOME` resolve to the same directory there. Non-standalone never tripped on this since the `.bin/pnpm` symlink for a regular `pnpm` package keeps working across self-updates. Removed `patchPnpmEnv` and the now-empty `src/utils/` module. `spawnSync` now inherits `process.env`, whose PATH is already correctly fronted by `$PNPM_HOME/bin` and `$PNPM_HOME` via the `addPath` calls in install-pnpm. Added `standalone_windows_self_update` to test.yaml as a regression guard: standalone on Windows + target 11.1.0 + `run_install` with `--no-runtime`. With the previous code, the install would have run under the bootstrap (11.0.4) and errored on the unknown flag. Originally found while building pnpm/setup (the new combined pnpm + runtime action).	2026-05-11 22:48:51 +02:00
Andrew Haines	551b42e879	docs(README): fix cache_dependency_path type (#257) ... * docs(README): fix `cache_dependency_path` type * docs(README): add multiple lockfile example * docs: update input description to match README	2026-05-11 16:41:41 +02:00
Zoltan Kochan	739bfe42ca	fix: self-update bootstrap to packageManager-pinned version (#233) (#256) ... * fix: self-update bootstrap to packageManager-pinned version (#233) When package.json pins pnpm via `packageManager` or an exact `devEngines.packageManager.version`, self-update the bootstrap up front. The bootstrap's `pnpm store path` skips pnpm's auto-switch (the `store` command sets `skipPackageManagerCheck = true`), so it reports the bootstrap's `STORE_VERSION` while the user's actual install runs under the pinned version and writes to a different STORE_VERSION — breaking `cache: true` and `setup-node`'s `cache: pnpm` on cold caches. * fix: check bin/ dir instead of pnpm.exe for self-update detection On Windows pnpm self-update writes `.bin/bin/pnpm` (a JS launcher), not `.bin/bin/pnpm.exe`, so the previous existsSync probe always fell back to pnpmHome and the bin_dest output pointed at the bootstrap pnpm. Check whether the `bin` directory itself exists. * fix: self-update accepts ranges; drop exact-semver gate `pnpm self-update` resolves semver ranges to a specific version, so `devEngines.packageManager.version: ">=10 <11"` can also go through the self-update path. That makes readTargetVersion total — it always returns a string or throws — so the runtime auto-switch fallback (and the `pnpm_config_pm_on_fail=download` export from #252) is no longer reachable and gets removed. Adds a range case to the cache_store_path matrix. v6.0.7	2026-05-11 14:06:33 +02:00
Zoltan Kochan	f61705d907	chore: add CODEOWNERS	2026-05-11 12:46:12 +02:00
Andrew Haines	7a5507b117	fix: restore inputs from state in post (#255)	2026-05-11 12:44:49 +02:00
Zoltan Kochan	1155470f3e	fix: honor devEngines.packageManager.onFail=error (#252) (#254) ... ## Summary - Export `pnpm_config_pm_on_fail=download` from the action so the bootstrap pnpm switches versions via `manage-package-manager-versions` instead of throwing `BAD_PM_VERSION` when a project pins `devEngines.packageManager.onFail = "error"` without supplying a `version:` input. - Adds a `test_dev_engines_on_fail_error` workflow job (Linux/macOS/Windows, exact + range) that reproduces #252. Fixes #252.	2026-05-11 01:51:30 +02:00
Zoltan Kochan	91ab88e261	fix: bin_dest output points to self-updated pnpm, not bootstrap (#249) ... * fix: bin_dest output points to self-updated pnpm, not bootstrap (#247) `pnpm self-update <version>` writes the target binary to `${PNPM_HOME}/bin/`, leaving the bootstrap symlink at `${PNPM_HOME}/pnpm` untouched. The `bin_dest` output was set to `${PNPM_HOME}`, so consumers invoking `${{ steps.pnpm.outputs.bin_dest }}/pnpm` got the bootstrap version (currently 11.0.4) instead of the version they requested. PATH lookup hid the bug: `${PNPM_HOME}/bin` was prepended ahead of `${PNPM_HOME}`, so `pnpm` resolved from PATH was the right one. Existing version-respect tests only checked `pnpm --version`, not `bin_dest`. Resolve `binDest` inside `runSelfInstaller` (target lives in `${PNPM_HOME}/bin` after self-update, otherwise stays at `${PNPM_HOME}`) and plumb it through to `setOutputs`. Add a regression test that invokes `${bin_dest}/pnpm --version` directly across Linux/macOS/Windows. * test(ci): pass bin_dest via env to survive Windows backslashes Direct GitHub-expression interpolation of `${{ steps.pnpm.outputs.bin_dest }}` into the bash script let bash eat the backslashes in the Windows path (`C:Usersrunneradminsetup-pnpmnode_modules.binbin/pnpm`), failing with "No such file or directory". Forward the value via env so the path reaches bash unmangled. * build: rebuild dist with clean lockfile-matched deps v6.0.6	2026-05-07 12:58:58 +02:00
Zoltan Kochan	e578e19d19	fix: update pnpm to 11.0.4	2026-05-04 12:08:02 +02:00
Zoltan Kochan	8912a9102a	fix: append (not prepend) action node dir to PATH for npm bootstrap (#241) v6.0.5	2026-05-02 16:10:46 +02:00
Ben Quarmby	26f6d4f2c5	fix: use npm co-located with the action node binary (#239) ... * fix: use npm co-located with the action node binary * fix: resolve npm by absolute path; guard against unset PATH Follow-up to 5a9e198. Two refinements to the GHE self-hosted runner fix: - Spawn npm via `path.join(dirname(process.execPath), 'npm[.cmd]')` instead of relying on PATH lookup. This matches the original PR description and is robust against PATH-shadowed npm installations. - Avoid `"<dir>:undefined"` leaking into PATH when `process.env.PATH` is unset (rare, but possible in stripped environments). PATH still has the node directory prepended so npm's `#!/usr/bin/env node` shebang can resolve node on Linux/macOS. * fix: revert npm to PATH lookup; runner externals lacks npm Revert 42e75a1's switch to absolute-path npm resolution. The premise that npm is co-located with the action's node binary is false on GitHub-hosted runners: `process.execPath` points into `runner/externals/node24/bin/`, which contains node only — not npm. The absolute-path spawn produced ENOENT on Linux/macOS and "not recognized" on Windows. Go back to spawning `'npm'` and relying on PATH lookup, which works on standard runners (npm is on PATH from the runner image) and on the GHE self-hosted setup that motivated the original fix. Keep the node-directory prepend so npm's `#!/usr/bin/env node` shebang resolves, and keep the unset-PATH guard. --------- Co-authored-by: Zoltan Kochan <z@kochan.io> v6.0.4	2026-04-30 22:28:41 +02:00
Zoltan Kochan	903f9c1a6e	fix: update pnpm to 11.0.0-rc.5 v6.0.3	2026-04-21 20:27:39 +02:00
Zoltan Kochan	bdf0af2a9d	test: add strict version-match jobs to reproduce #225 / #227 ... The existing version tests only check output format via regex, which is why the PATH-shadowing bug (#230) slipped through — the bootstrap pnpm's version string matched the regex just as well as the requested version. - test_version_respects_request: runs the action with `version: 9.15.5` and `version: 10.33.0` (both differ from the bootstrap) and asserts that `pnpm --version` matches exactly. Regression test for #225/#230. - test_package_manager_field: writes a `packageManager: pnpm@<v>` entry into package.json, runs the action with no `version:` input, and asserts exact match. Reproduces #227; currently expected to fail since `packageManager` extraction was intentionally not added.	2026-04-18 15:20:30 +02:00
oniani1	71c92474e7	fix: pnpm self-update binary shadowed by bootstrap on PATH (#230) ... Problem pnpm self-update installs the target version to PNPM_HOME/bin/pnpm, but the bootstrap binary at PNPM_HOME/pnpm has higher PATH precedence because addPath(pnpmHome) was called after addPath(pnpmHome/bin). @actions/core's addPath prepends, so the later call wins — the bootstrap version shadows the self-updated binary. Fix Swap the addPath call order so PNPM_HOME/bin (where self-update puts the target binary) has higher PATH precedence. The bootstrap pnpm is invoked via absolute path, so this doesn't affect the bootstrap step. v6.0.2	2026-04-18 15:00:23 +02:00
Zoltan Kochan	078e9d4164	fix: update pnpm to 11.0.0-rc.2 v6.0.1	2026-04-18 00:36:06 +02:00
Zoltan Kochan	08c4be7e2e	docs(README): update action-setup version v6.0.0	2026-04-10 23:08:33 +02:00
Zoltan Kochan	579891461a	chore: update .gitignore	2026-04-10 23:03:10 +02:00
Zoltan Kochan	ddffd66754	fix: remove accidentally committed file	2026-04-10 23:02:48 +02:00
Zoltan Kochan	b43f991918	fix: update pnpm to 11.0.0-rc.0	2026-04-10 23:00:38 +02:00
Andreas Deininger	3852509c9e	README.md: bring versions up-to-date (#222)	2026-04-10 22:48:51 +02:00
Zoltan Kochan	6e7bdbda5f	chore: bump bootstrap pnpm to 11.0.0-beta.4-1 and add update script ... Add `pnpm run update-bootstrap [version]` to regenerate the bootstrap lockfiles. Bumps from 11.0.0-beta.3 to 11.0.0-beta.4-1.	2026-03-30 00:09:19 +02:00
Zoltan Kochan	6b87c4621a	fix: Windows standalone mode — bypass broken npm shims (#217) ... * fix: overwrite npm .cmd wrappers for @pnpm/exe on Windows npm creates .cmd wrappers that invoke bin entries through `node`, but @pnpm/exe bins are native executables, not JavaScript files. This causes pnpm commands to silently fail on Windows. * fix: copy pnpm.exe to .bin/ on Windows for standalone mode The .cmd wrapper approach didn't work because CMD doesn't properly wait for extensionless PE binaries. Instead, copy the actual .exe (and .cmd for pnpx) from @pnpm/exe into .bin/ so PATHEXT finds pnpm.exe directly, bypassing npm's broken node-wrapping shim. * fix: add @pnpm/exe dir to PATH on Windows instead of .bin shims On Windows, npm's .bin shims can't properly execute the extensionless native binaries from @pnpm/exe. Instead of trying to fix the shims, add the @pnpm/exe directory directly to PATH where pnpm.exe lives. * test: validate pnpm --version output in CI All version checks now capture output and assert it matches a semver pattern. Previously, a silently failing pnpm (exit 0, no output) would pass the tests. * debug: log pnpm --version output during setup * fix: remove duplicate addPath in setOutputs that shadowed pnpm.exe setOutputs called addPath(node_modules/.bin) AFTER installPnpm had already added the correct path (@pnpm/exe on Windows). Since GITHUB_PATH entries are prepended, .bin ended up first in PATH, causing PowerShell to find npm's broken shims instead of pnpm.exe. * fix: add PNPM_HOME/bin to PATH on all platforms * fix: address review feedback — PATH ordering and regex anchoring - Swap addPath order so pnpmHome (with pnpm.exe) is prepended last and has highest precedence over pnpmHome/bin. - Anchor version regex with $ and allow prerelease suffixes.	2026-03-27 20:42:10 +01:00
Zoltan Kochan	994d756a33	feat: read pnpm version from devEngines.packageManager (#211) ... * feat: read pnpm version from devEngines.packageManager field When no version is specified in the action config or the packageManager field of package.json, fall back to devEngines.packageManager. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: skip self-update for devEngines.packageManager and add CI tests pnpm auto-switches to the right version when devEngines.packageManager is set, so self-update is unnecessary. This also enables range support (e.g. ">=9.15.0") which self-update doesn't handle. --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-27 11:10:47 +01:00
Zoltan Kochan	738f428026	docs: upgrade pnpm/action-setup from v4 to v5	2026-03-26 22:31:06 +01:00
Zoltan Kochan	62bce64275	fix: extract pnpm version from packageManager field instead of returning undefined (#216) ... When packageManager is set to e.g. "pnpm@9.1.0+sha...", strip the "pnpm@" prefix and any "+sha..." hash suffix so the action installs the correct version. Previously returning undefined caused failures on Windows.	2026-03-25 13:59:54 +01:00
Zoltan Kochan	58e6119fe4	feat!: replace bundled pnpm binary with npm + lockfile bootstrap (#212) ... * feat!: replace bundled pnpm binary with npm + lockfile bootstrap Remove the 9MB bundled pnpm.cjs/worker.js and instead use npm ci with committed package-lock.json files (~5KB) to install a bootstrap pnpm, which then installs the target version with integrity verification via the project's pnpm-lock.yaml. Also switch from ncc to esbuild and modernize to ESM. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: bundle as CJS to support @actions/* packages The @actions/* packages use CJS require() for Node.js builtins, which fails with "Dynamic require of 'os' is not supported" when bundled as ESM. Switch esbuild output to CJS format. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: remove "type": "module" from package.json Node.js treats dist/index.js as ESM due to "type": "module", but the bundle uses CJS require() calls. Remove the field so Node.js defaults to CJS for .js files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: remove packageManager field and fix Windows npm spawn - Remove packageManager from package.json to avoid version conflict when the action tests against itself (uses: ./) - Use shell: true on Windows so spawn can find npm.cmd Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: always use pnpm (not @pnpm/exe) for bootstrap and update lockfile The bootstrap only needs regular pnpm to install the target package. @pnpm/exe requires install scripts which we skip with --ignore-scripts. Also regenerate pnpm-lock.yaml to match current package.json. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: use --no-lockfile for target install --lockfile-dir pointing to GITHUB_WORKSPACE causes the bootstrap pnpm to use the project's pnpm-lock.yaml (which tracks project deps, not pnpm itself), corrupting the install. Revert to --no-lockfile for now. Lockfile-based integrity verification can be added when pnpm v11 has proper support for verifying the pnpm package itself. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: run bootstrap pnpm via node instead of bin shim Use `node .../pnpm/bin/pnpm.cjs` to run the bootstrap pnpm, matching the approach used by the old bundled pnpm.cjs. This avoids issues with the .bin symlink on different platforms. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: use pnpm self-update instead of installing target separately - Bootstrap pnpm via npm ci (verified by lockfile) - Use `pnpm self-update <version>` for explicit version - Let pnpm handle packageManager field automatically - Remove standalone/exe-specific install logic (pnpm handles this) - Update tests to not run pnpm install against the action repo itself Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: support standalone mode with @pnpm/exe bootstrap - When standalone=true, bootstrap with @pnpm/exe via npm ci - When standalone=false, bootstrap with pnpm via npm ci - Both use pnpm self-update to reach the target version - Remove --ignore-scripts from npm ci so @pnpm/exe install scripts run - Add standalone test back to CI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * debug: add logging to diagnose pnpm not found on PATH Log .bin directory contents after npm ci to understand why pnpm binary is not found in subsequent CI steps. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: ensure pnpm bin link exists after npm ci npm ci sometimes doesn't create the .bin/pnpm symlink for @pnpm/exe (observed on Linux CI). Manually create the symlink if it's missing after npm ci completes. This fixes the case where standalone=true with no explicit version (relying on packageManager field) — pnpm self-update wouldn't run, leaving .bin empty and pnpm not found on PATH. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add PNPM_HOME/bin to PATH for pnpm v11 pnpm v11 moved global binaries from PNPM_HOME to PNPM_HOME/bin. Add the new bin subdirectory to PATH so that pnpm's global bin directory check passes. This is backwards compatible — the extra PATH entry is harmless for older pnpm versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add packages field to pnpm-workspace.yaml pnpm v9 requires the packages field in pnpm-workspace.yaml. Without it, `pnpm --version` fails with "packages field missing or empty". Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix pnpm-workspace.yaml --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 14:02:31 +01:00
axel7083	2e223e0f0d	chore(workflows): adding pr-check.yaml to validate dist folder (#213) ... * chore(workflows): adding pr-check.yaml to validate dist/index.js Signed-off-by: axel7083 <42176370+axel7083@users.noreply.github.com> * fix: update dist/index.js Signed-off-by: axel7083 <42176370+axel7083@users.noreply.github.com> --------- Signed-off-by: axel7083 <42176370+axel7083@users.noreply.github.com>	2026-03-19 14:52:48 +01:00
Zoltan Kochan	fc06bc1257	feat!: run the action on Node.js 24 (#205) v4.4.0 v5 v5.0.0	2026-03-13 11:30:26 +01:00
Zoltan Kochan	b906affcce	Revert "feat!: run the action on Node.js 24 (#205)" ... This reverts commit 9b5745cdf0. v4 v4.3.0	2026-03-11 15:54:42 +01:00
Zoltan Kochan	9b5745cdf0	feat!: run the action on Node.js 24 (#205)	2026-02-17 13:30:54 +01:00
Boosted-Bonobo	1e1c8eafbd	ci: pin github actions (#199)	2025-12-15 14:31:35 +01:00
Khải	b9e1dbc72f	fix(ci): exclude macos (#197)	2025-12-10 13:54:29 +01:00
Khải	61bc82c7df	refactor: remove star imports (#196)	2025-12-10 13:14:52 +01:00
Jeremiasz Major	e94b270858	feat: store caching (#188) ... * add pnpm store caching * style: format * no semicolons * no star imports * import order * style: no star imports --------- Co-authored-by: khai96_ <hvksmr1996@gmail.com>	2025-12-07 22:16:49 +01:00
Chris Martin	ee7b8711bd	Clarify that package_json_file is relative to GITHUB_WORKSPACE (#184) ... * Clarify that package_json_file is relative to GITHUB_WORKSPACE Clarify the description for package_json_file parameter to specify that the path must be relative to the repository root. * Apply suggestion from @zkochan --------- Co-authored-by: Zoltan Kochan <z@kochan.io>	2025-12-07 01:36:02 +01:00
silverwind	3a0024f066	Remove unused @types/node-fetch dependency (#186)	2025-12-05 16:50:59 +01:00
Roman Usherenko	72f04517b7	Update README.md (#175) ... fix the string run_install example	2025-12-05 15:32:46 +01:00
Adrian Riedel	41ff726559	feat: support installation from custom NPM registry (#179) ... copy .npmrc from GitHub workspace if it exists so that PNPM respects custom registry configurations when self-installing v4.2.0	2025-10-08 10:48:14 +02:00
Matthias	f2b2b233b5	Remove --frozen-lockfile from examples (#171)	2025-07-11 00:08:35 +02:00
Matthias	77504a59bc	Fix multiline run_install example in README.md (#167)	2025-06-25 18:10:02 +02:00
Kevin Cui	d648c2dd06	fix: not allow install multiple package manager (#161) ... When a project has both npm and pnpm, using pnpm/action-setup will result in an error: `Multiple versions of pnpm specified`. The previous implementation was only meant to avoid the "ERR_PNPM_BAD_PM_VERSION" error, but it did not take into account the situation of multiple different package managers. Signed-off-by: Kevin Cui <bh@bugs.cc>	2025-03-28 08:37:14 +08:00
Zoltan Kochan	a7487c7e89	feat: update dist v4.1.0	2025-02-06 22:30:07 +01:00
Zoltan Kochan	fff70888d0	test: update pnpm to v9	2025-02-06 22:24:21 +01:00
Daniel Bayley	6e3017af18	docs: support package.yaml (#157)	2025-02-06 22:13:04 +01:00
Daniel Bayley	0cb0538c33	feat: support package.yaml (#156)	2025-02-06 22:04:41 +01:00
Azat S.	e303250a24	docs: update pnpm version in readme examples (#154)	2025-01-09 00:42:18 +01:00
Karl Horky	ac5bf11548	Update examples to use pnpm v9 (#142)	2024-08-14 16:07:48 +02:00
its-monotype	18ac635edf	docs: remove redundant manual cache due to setup-node cache (#131)	2024-07-05 15:24:26 +02:00
Zoltan Kochan	0d0b43217a	docs: add warning about v2	2024-07-05 14:37:28 +02:00
Karl Horky	0eb0e97082	Add readme example for omitting version (#134) ... * Add readme example for omitting `version` * docs: more detailed explanations --------- Co-authored-by: Khải <hvksmr1996@gmail.com>	2024-07-04 10:37:24 +02:00