chore: bump bootstrap pnpm to 11.0.0-beta.4-1 and add update script

Add `pnpm run update-bootstrap [version]` to regenerate the bootstrap
lockfiles. Bumps from 11.0.0-beta.3 to 11.0.0-beta.4-1.

.github/workflows/test.yaml

@@ -33,7 +33,14 @@ jobs:
         run: which pnpm; which pnpx
 
       - name: 'Test: version'
-        run: pnpm --version
+        run: |
+          actual="$(pnpm --version)"
+          echo "pnpm version: ${actual}"
+          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
+            echo "ERROR: pnpm --version did not produce valid output"
+            exit 1
+          fi
+        shell: bash
 
       - name: 'Test: install in a fresh project'
         run: |
@@ -71,7 +78,14 @@ jobs:
         run: which pnpm && which pnpx
 
       - name: 'Test: version'
-        run: pnpm --version
+        run: |
+          actual="$(pnpm --version)"
+          echo "pnpm version: ${actual}"
+          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
+            echo "ERROR: pnpm --version did not produce valid output"
+            exit 1
+          fi
+        shell: bash
 
   test_standalone:
     name: Test with standalone
@@ -98,7 +112,14 @@ jobs:
         run: which pnpm
 
       - name: 'Test: version'
-        run: pnpm --version
+        run: |
+          actual="$(pnpm --version)"
+          echo "pnpm version: ${actual}"
+          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
+            echo "ERROR: pnpm --version did not produce valid output"
+            exit 1
+          fi
+        shell: bash
 
       - name: 'Test: install in a fresh project'
         run: |
@@ -196,4 +217,11 @@ jobs:
         run: which pnpm; which pnpx
 
       - name: 'Test: version'
-        run: pnpm --version
+        run: |
+          actual="$(pnpm --version)"
+          echo "pnpm version: ${actual}"
+          if [[ ! "${actual}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
+            echo "ERROR: pnpm --version did not produce valid output"
+            exit 1
+          fi
+        shell: bash

package.json

@@ -3,7 +3,8 @@
   "scripts": {
     "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --minify --outfile=dist/index.js --loader:.json=json",
     "build": "pnpm run build:bundle",
-    "start": "pnpm run build && sh ./run.sh"
+    "start": "pnpm run build && sh ./run.sh",
+    "update-bootstrap": "node scripts/update-bootstrap.mjs"
   },
   "dependencies": {
     "@actions/cache": "^4.1.0",

scripts/update-bootstrap.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+// Usage: node scripts/update-bootstrap.mjs [version]
+// If version is omitted, fetches the latest next-11 tag from npm.
+// Regenerates the bootstrap lockfiles used by action-setup to install pnpm via npm.
+
+import { execSync } from 'child_process'
+import { mkdtempSync, rmSync, readFileSync, writeFileSync } from 'fs'
+import { join } from 'path'
+import { tmpdir } from 'os'
+
+const BOOTSTRAP_DIR = new URL('../src/install-pnpm/bootstrap/', import.meta.url).pathname
+
+const version = process.argv[2] || resolveLatestVersion()
+
+console.log(`Updating bootstrap lockfiles to pnpm@${version} ...`)
+
+generateLock('pnpm-lock.json', { pnpm: version }, 'bootstrap-pnpm')
+generateLock('exe-lock.json', { '@pnpm/exe': version }, 'bootstrap-exe')
+
+console.log('Done!')
+
+function resolveLatestVersion() {
+  const json = execSync('npm view @pnpm/exe dist-tags --json', { encoding: 'utf8' })
+  const tags = JSON.parse(json)
+  const version = tags['next-11'] || tags['latest']
+  if (!version) {
+    console.error('Could not determine latest pnpm version from npm dist-tags')
+    process.exit(1)
+  }
+  return version
+}
+
+function generateLock(filename, dependencies, name) {
+  const tmp = mkdtempSync(join(tmpdir(), 'pnpm-bootstrap-'))
+  try {
+    writeFileSync(join(tmp, 'package.json'), JSON.stringify({ private: true, dependencies }))
+    execSync('npm install --package-lock-only --ignore-scripts', { cwd: tmp, stdio: 'pipe' })
+    const lock = readFileSync(join(tmp, 'package-lock.json'), 'utf8')
+    const parsed = JSON.parse(lock)
+    parsed.name = name
+    writeFileSync(join(BOOTSTRAP_DIR, filename), JSON.stringify(parsed, null, 2) + '\n')
+    console.log(`  ${filename} -> ${Object.values(dependencies)[0]}@${version}`)
+  } finally {
+    rmSync(tmp, { recursive: true, force: true })
+  }
+}

src/install-pnpm/bootstrap/exe-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@pnpm/exe": "11.0.0-beta.3"
+        "@pnpm/exe": "11.0.0-beta.4-1"
       }
     },
     "node_modules/@pnpm/exe": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-beta.3.tgz",
-      "integrity": "sha512-yWNlHHdYmvf4c0MCkCzAa4csJDPdA+7yJCbXBUDXMbUu/0Zv/AxtO77q24MwlnBUC0dWeA+0F/pPmdkR9aTV2A==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-2VzvynS54qE+Q0LGXzTCFKChq79Yr1xKLTAEkvIcBLoM+puRuI3xyrqtWx47esxhjbQlF0jRUyU8ISbSG92yBQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -27,18 +27,18 @@
         "url": "https://opencollective.com/pnpm"
       },
       "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.0.0-beta.3",
-        "@pnpm/linux-x64": "11.0.0-beta.3",
-        "@pnpm/macos-arm64": "11.0.0-beta.3",
-        "@pnpm/macos-x64": "11.0.0-beta.3",
-        "@pnpm/win-arm64": "11.0.0-beta.3",
-        "@pnpm/win-x64": "11.0.0-beta.3"
+        "@pnpm/linux-arm64": "11.0.0-beta.4-1",
+        "@pnpm/linux-x64": "11.0.0-beta.4-1",
+        "@pnpm/macos-arm64": "11.0.0-beta.4-1",
+        "@pnpm/macos-x64": "11.0.0-beta.4-1",
+        "@pnpm/win-arm64": "11.0.0-beta.4-1",
+        "@pnpm/win-x64": "11.0.0-beta.4-1"
       }
     },
     "node_modules/@pnpm/linux-arm64": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-TF2fyuCY9GggR4kfhjo1hMmgn+rIohenwNoH0tLPM7JlBK7/UAIFt1LI+o999tRwTCEw7gnxHFwtI2vyQuDfNw==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-aPf2hhCwWQQ1vNm3Sxq6BLtqnvv6eZ8iJq/oqJOm2WFzq9l59jbmn0eaUtDOlafjfzkijqg+cj46h0XT2Dqsfw==",
       "cpu": [
         "arm64"
       ],
@@ -52,9 +52,9 @@
       }
     },
     "node_modules/@pnpm/linux-x64": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-7GrLsnSuDH62y486GUTwJdohGIC1ugz9ZJkbKOHgxIAkNGcSTJ1IkkdARtv7/WMmOEwwESDmtpOQ6LmjnpDMSA==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-1hTcyZSVJWpPNHs3u7RbfbAmZXPBLIZQVt/z1XjcDnzI8S49NGIvir876/gq9jL69ZPoE1a6z+qSe3zUPmw0ng==",
       "cpu": [
         "x64"
       ],
@@ -68,9 +68,9 @@
       }
     },
     "node_modules/@pnpm/macos-arm64": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-NQKgI1DURrEiOUzpxL0Mc+yn7DV4tpShqGnjaJLbz8ZCXsX/qhmybebvCG3r+IfSk3P5KID66lcgC/Osiaz0Dg==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-7iJdDfWaRWeoGBvU3gJcxbReYM83IhiWFZPHMSW+ga44W/qTzczYIeGeCorsxQRKBPnw2qK3hh9bevkyX6XOWw==",
       "cpu": [
         "arm64"
       ],
@@ -84,9 +84,9 @@
       }
     },
     "node_modules/@pnpm/macos-x64": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-Ky22KFYHXx8+8WU4KJT9NXVgzFioL2w9pHTQjsqTK70AbxiErscPYhrFIehlCNbXjgs+tGVIy13QNKkiwvmS8w==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-wREXbc2hrSd6r/dyPYuFIkkFoIbtmke5rlJrcITe65OvIQmSW+Fp3X8PBIYcnx3lJyk4809YlqI184yovUaMZA==",
       "cpu": [
         "x64"
       ],
@@ -100,9 +100,9 @@
       }
     },
     "node_modules/@pnpm/win-arm64": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-7L8TFNDm25m+XYSyhcola3YFd/li6BZzzl56SsyGnZabsvUslMwnDiJad48wOz8IuN7zsrTSGh+X/x6F+GdrFQ==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-ygHjDdc0h2uCIcBa30Cnd2ciGWFNC0qm2t0w88PYEC/1rmbGCDfqeGtf/8R8THzTVOuw/pOzIDTs6QEhB6aPOg==",
       "cpu": [
         "arm64"
       ],
@@ -116,9 +116,9 @@
       }
     },
     "node_modules/@pnpm/win-x64": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-Z/6OpMUaIpggXjCtWEhp6kWjiT/2EImhkJAu8AodOORqeNcWouGEq3sO4XU0em6d+pAHmdV0hWMQ2xCUmPVuiA==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-//5eHf7Zw4MtgJhlD4VUbemngxMnhwySgZNGu0ngkNBRVjnESE7NoXZZ5kHIdatv6VQpqkCthNZrheaiJedSGw==",
       "cpu": [
         "x64"
       ],

src/install-pnpm/bootstrap/pnpm-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "pnpm": "11.0.0-beta.3"
+        "pnpm": "11.0.0-beta.4-1"
       }
     },
     "node_modules/pnpm": {
-      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-beta.3.tgz",
-      "integrity": "sha512-6PrfRjycZV4vRX6ttG9oR6pOgbI2/OcF2QLOzHm35UcRuvtqP4zf3wQfAAPwEbeu1uAbpSg/Q5cL8h32tumy6Q==",
+      "version": "11.0.0-beta.4-1",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-beta.4-1.tgz",
+      "integrity": "sha512-zkZWSclaXz4NI43dkF0uYx8bGXjoy7T1KNPKjaGt1pQcJVD6foShIVum5dO47t5hpTvDNfPUGUGxXcM/RXRZRQ==",
       "license": "MIT",
       "bin": {
         "pn": "bin/pnpm.mjs",

src/install-pnpm/run.ts

@@ -34,23 +34,33 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
     return npmExitCode
   }
 
-  const pnpmHome = path.join(dest, 'node_modules', '.bin')
-  addPath(pnpmHome)
+  // On Windows with standalone mode, npm's .bin shims can't properly
+  // execute the extensionless @pnpm/exe native binaries. Add the
+  // @pnpm/exe directory directly to PATH so pnpm.exe is found natively.
+  const pnpmHome = standalone && process.platform === 'win32'
+    ? path.join(dest, 'node_modules', '@pnpm', 'exe')
+    : path.join(dest, 'node_modules', '.bin')
+  // pnpm expects PNPM_HOME/bin in PATH for global binaries (e.g. node
+  // installed via `pnpm runtime`). Add it first so the next addPath
+  // (pnpmHome itself, which contains pnpm.exe) has higher precedence.
   addPath(path.join(pnpmHome, 'bin'))
+  addPath(pnpmHome)
   exportVariable('PNPM_HOME', pnpmHome)
 
   // Ensure pnpm bin link exists — npm ci sometimes doesn't create it
-  const pnpmBinLink = path.join(pnpmHome, 'pnpm')
+  if (process.platform !== 'win32') {
+    const pnpmBinLink = path.join(dest, 'node_modules', '.bin', 'pnpm')
     if (!existsSync(pnpmBinLink)) {
-    await mkdir(pnpmHome, { recursive: true })
+      await mkdir(path.join(dest, 'node_modules', '.bin'), { recursive: true })
       const target = standalone
         ? path.join('..', '@pnpm', 'exe', 'pnpm')
         : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
       await symlink(target, pnpmBinLink)
     }
+  }
 
   const bootstrapPnpm = standalone
-    ? path.join(dest, 'node_modules', '@pnpm', 'exe', 'pnpm')
+    ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
     : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
 
   // Determine the target version

src/outputs/index.ts

@@ -1,10 +1,11 @@
-import { setOutput, addPath } from '@actions/core'
+import { setOutput } from '@actions/core'
 import { Inputs } from '../inputs'
 import { getBinDest } from '../utils'
 
 export function setOutputs(inputs: Inputs) {
   const binDest = getBinDest(inputs)
-  addPath(binDest)
+  // NOTE: addPath is already called in installPnpm — do not call it again
+  // here, as a second addPath would shadow the correct entry on Windows.
   setOutput('dest', inputs.dest)
   setOutput('bin_dest', binDest)
 }