fix: pnpm self-update binary shadowed by bootstrap on PATH (#230)

Problem
pnpm self-update installs the target version to PNPM_HOME/bin/pnpm, but the bootstrap binary at PNPM_HOME/pnpm has higher PATH precedence because addPath(pnpmHome) was called after addPath(pnpmHome/bin). @actions/core's addPath prepends, so the later call wins — the bootstrap version shadows the self-updated binary.

Fix
Swap the addPath call order so PNPM_HOME/bin (where self-update puts the target binary) has higher PATH precedence. The bootstrap pnpm is invoked via absolute path, so this doesn't affect the bootstrap step.
This commit is contained in:
oniani1
2026-04-18 17:00:23 +04:00
committed by GitHub
parent 078e9d4164
commit fecec9e040
2 changed files with 155 additions and 154 deletions

299
dist/index.js vendored

File diff suppressed because one or more lines are too long

View File

@@ -40,11 +40,13 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
const pnpmHome = standalone && process.platform === 'win32' const pnpmHome = standalone && process.platform === 'win32'
? path.join(dest, 'node_modules', '@pnpm', 'exe') ? path.join(dest, 'node_modules', '@pnpm', 'exe')
: path.join(dest, 'node_modules', '.bin') : path.join(dest, 'node_modules', '.bin')
// pnpm expects PNPM_HOME/bin in PATH for global binaries (e.g. node // PNPM_HOME/bin is where `pnpm self-update` places the target version
// installed via `pnpm runtime`). Add it first so the next addPath // binary. It must have higher PATH precedence than pnpmHome (which
// (pnpmHome itself, which contains pnpm.exe) has higher precedence. // contains the bootstrap binary) so the self-updated version is found
addPath(path.join(pnpmHome, 'bin')) // first. The bootstrap pnpm is invoked via absolute path, not PATH,
// so this ordering does not affect the bootstrap step.
addPath(pnpmHome) addPath(pnpmHome)
addPath(path.join(pnpmHome, 'bin'))
exportVariable('PNPM_HOME', pnpmHome) exportVariable('PNPM_HOME', pnpmHome)
// Ensure pnpm bin link exists — npm ci sometimes doesn't create it // Ensure pnpm bin link exists — npm ci sometimes doesn't create it