feat: read pnpm version from devEngines.packageManager (#211)

* feat: read pnpm version from devEngines.packageManager field

When no version is specified in the action config or the packageManager
field of package.json, fall back to devEngines.packageManager.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: skip self-update for devEngines.packageManager and add CI tests

pnpm auto-switches to the right version when devEngines.packageManager
is set, so self-update is unnecessary. This also enables range support
(e.g. ">=9.15.0") which self-update doesn't handle.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

src/install-pnpm/run.ts

@@ -13,7 +13,12 @@ const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies
 const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })
 
 export async function runSelfInstaller(inputs: Inputs): Promise<number> {
-  const { version, dest, packageJsonFile, standalone } = inputs
+  const { version, dest, packageJsonFile } = inputs
+
+  // pnpm v11 requires Node >= 22.13; use standalone (exe) bootstrap which
+  // bundles its own Node.js when the system Node is too old
+  const systemNode = await getSystemNodeVersion()
+  const standalone = inputs.standalone || systemNode.major < 22 || (systemNode.major === 22 && systemNode.minor < 13)
 
   // Install bootstrap pnpm via npm (integrity verified by committed lockfile)
   await rm(dest, { recursive: true, force: true })
@@ -40,13 +45,13 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
     await mkdir(pnpmHome, { recursive: true })
     const target = standalone
       ? path.join('..', '@pnpm', 'exe', 'pnpm')
-      : path.join('..', 'pnpm', 'bin', 'pnpm.cjs')
+      : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
     await symlink(target, pnpmBinLink)
   }
 
   const bootstrapPnpm = standalone
     ? path.join(dest, 'node_modules', '@pnpm', 'exe', 'pnpm')
-    : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.cjs')
+    : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
 
   // Determine the target version
   const targetVersion = readTargetVersion({ version, packageJsonFile })
@@ -70,15 +75,17 @@ function readTargetVersion(opts: {
   const { version, packageJsonFile } = opts
   const { GITHUB_WORKSPACE } = process.env
 
-  let packageManager: unknown
+  let packageManager: string | undefined
+  let devEngines: { packageManager?: { name?: string; version?: string } } | undefined
 
   if (GITHUB_WORKSPACE) {
     try {
       const content = readFileSync(path.join(GITHUB_WORKSPACE, packageJsonFile), 'utf8');
-      ({ packageManager } = packageJsonFile.endsWith(".yaml")
+      const manifest = packageJsonFile.endsWith(".yaml")
         ? parseYaml(content, { merge: true })
         : JSON.parse(content)
-      )
+      packageManager = manifest.packageManager
+      devEngines = manifest.devEngines
     } catch (error: unknown) {
       // Swallow error if package.json doesn't exist in root
       if (!util.types.isNativeError(error) || !('code' in error) || error.code !== 'ENOENT') throw error
@@ -100,9 +107,13 @@ Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_
     return version
   }
 
+  // pnpm will automatically download and switch to the right version
   if (typeof packageManager === 'string' && packageManager.startsWith('pnpm@')) {
-    // Strip the "pnpm@" prefix and any "+sha..." hash suffix
-    return packageManager.replace('pnpm@', '').replace(/\+.*$/, '')
+    return undefined
+  }
+
+  if (devEngines?.packageManager?.name === 'pnpm' && devEngines.packageManager.version) {
+    return undefined
   }
 
   if (!GITHUB_WORKSPACE) {
@@ -115,7 +126,21 @@ Otherwise, please specify the pnpm version in the action configuration.`)
   throw new Error(`No pnpm version is specified.
 Please specify it by one of the following ways:
   - in the GitHub Action config with the key "version"
-  - in the package.json with the key "packageManager"`)
+  - in the package.json with the key "packageManager"
+  - in the package.json with the key "devEngines.packageManager"`)
+}
+
+function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
+  return new Promise((resolve) => {
+    const cp = spawn('node', ['--version'], { stdio: ['pipe', 'pipe', 'pipe'], shell: process.platform === 'win32' })
+    let output = ''
+    cp.stdout.on('data', (data: Buffer) => { output += data.toString() })
+    cp.on('close', () => {
+      const match = output.match(/^v(\d+)\.(\d+)/)
+      resolve(match ? { major: parseInt(match[1], 10), minor: parseInt(match[2], 10) } : { major: 0, minor: 0 })
+    })
+    cp.on('error', () => resolve({ major: 0, minor: 0 }))
+  })
 }
 
 function runCommand(cmd: string, args: string[], opts: { cwd: string }): Promise<number> {