fix: address review feedback — PATH ordering and regex anchoring

- Swap addPath order so pnpmHome (with pnpm.exe) is prepended last and has highest precedence over pnpmHome/bin. - Anchor version regex with $ and allow prerelease suffixes.
fix: add PNPM_HOME/bin to PATH on all platforms
2026-04-04 11:20:11 +08:00 · 2026-03-27 20:38:35 +01:00 · 2026-03-27 20:16:32 +01:00 · 2026-03-27 20:05:21 +01:00 · 2026-03-27 19:44:58 +01:00 · 2026-03-27 19:33:54 +01:00
5 changed files with 34 additions and 82 deletions
--- a/dist/index.js
+++ b/dist/index.js
--- a/package.json
+++ b/package.json
@@ -3,8 +3,7 @@
  "scripts": {
    "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --minify --outfile=dist/index.js --loader:.json=json",
    "build": "pnpm run build:bundle",
-    "start": "pnpm run build && sh ./run.sh",
-    "update-bootstrap": "node scripts/update-bootstrap.mjs"
+    "start": "pnpm run build && sh ./run.sh"
  },
  "dependencies": {
    "@actions/cache": "^4.1.0",
--- a/scripts/update-bootstrap.mjs
+++ b/scripts/update-bootstrap.mjs
@@ -1,47 +0,0 @@
-#!/usr/bin/env node
-
-// Usage: node scripts/update-bootstrap.mjs [version]
-// If version is omitted, fetches the latest next-11 tag from npm.
-// Regenerates the bootstrap lockfiles used by action-setup to install pnpm via npm.
-
-import { execSync } from 'child_process'
-import { mkdtempSync, rmSync, readFileSync, writeFileSync } from 'fs'
-import { join } from 'path'
-import { tmpdir } from 'os'
-
-const BOOTSTRAP_DIR = new URL('../src/install-pnpm/bootstrap/', import.meta.url).pathname
-
-const version = process.argv[2] || resolveLatestVersion()
-
-console.log(`Updating bootstrap lockfiles to pnpm@${version} ...`)
-
-generateLock('pnpm-lock.json', { pnpm: version }, 'bootstrap-pnpm')
-generateLock('exe-lock.json', { '@pnpm/exe': version }, 'bootstrap-exe')
-
-console.log('Done!')
-
-function resolveLatestVersion() {
-  const json = execSync('npm view @pnpm/exe dist-tags --json', { encoding: 'utf8' })
-  const tags = JSON.parse(json)
-  const version = tags['next-11'] || tags['latest']
-  if (!version) {
-    console.error('Could not determine latest pnpm version from npm dist-tags')
-    process.exit(1)
-  }
-  return version
-}
-
-function generateLock(filename, dependencies, name) {
-  const tmp = mkdtempSync(join(tmpdir(), 'pnpm-bootstrap-'))
-  try {
-    writeFileSync(join(tmp, 'package.json'), JSON.stringify({ private: true, dependencies }))
-    execSync('npm install --package-lock-only --ignore-scripts', { cwd: tmp, stdio: 'pipe' })
-    const lock = readFileSync(join(tmp, 'package-lock.json'), 'utf8')
-    const parsed = JSON.parse(lock)
-    parsed.name = name
-    writeFileSync(join(BOOTSTRAP_DIR, filename), JSON.stringify(parsed, null, 2) + '\n')
-    console.log(`  ${filename} -> ${Object.values(dependencies)[0]}@${version}`)
-  } finally {
-    rmSync(tmp, { recursive: true, force: true })
-  }
-}
--- a/src/install-pnpm/bootstrap/exe-lock.json
+++ b/src/install-pnpm/bootstrap/exe-lock.json
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@pnpm/exe": "11.0.0-beta.4-1"
+        "@pnpm/exe": "11.0.0-beta.3"
      }
    },
    "node_modules/@pnpm/exe": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-2VzvynS54qE+Q0LGXzTCFKChq79Yr1xKLTAEkvIcBLoM+puRuI3xyrqtWx47esxhjbQlF0jRUyU8ISbSG92yBQ==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-beta.3.tgz",
+      "integrity": "sha512-yWNlHHdYmvf4c0MCkCzAa4csJDPdA+7yJCbXBUDXMbUu/0Zv/AxtO77q24MwlnBUC0dWeA+0F/pPmdkR9aTV2A==",
      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
@@ -27,18 +27,18 @@
        "url": "https://opencollective.com/pnpm"
      },
      "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.0.0-beta.4-1",
-        "@pnpm/linux-x64": "11.0.0-beta.4-1",
-        "@pnpm/macos-arm64": "11.0.0-beta.4-1",
-        "@pnpm/macos-x64": "11.0.0-beta.4-1",
-        "@pnpm/win-arm64": "11.0.0-beta.4-1",
-        "@pnpm/win-x64": "11.0.0-beta.4-1"
+        "@pnpm/linux-arm64": "11.0.0-beta.3",
+        "@pnpm/linux-x64": "11.0.0-beta.3",
+        "@pnpm/macos-arm64": "11.0.0-beta.3",
+        "@pnpm/macos-x64": "11.0.0-beta.3",
+        "@pnpm/win-arm64": "11.0.0-beta.3",
+        "@pnpm/win-x64": "11.0.0-beta.3"
      }
    },
    "node_modules/@pnpm/linux-arm64": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-aPf2hhCwWQQ1vNm3Sxq6BLtqnvv6eZ8iJq/oqJOm2WFzq9l59jbmn0eaUtDOlafjfzkijqg+cj46h0XT2Dqsfw==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-beta.3.tgz",
+      "integrity": "sha512-TF2fyuCY9GggR4kfhjo1hMmgn+rIohenwNoH0tLPM7JlBK7/UAIFt1LI+o999tRwTCEw7gnxHFwtI2vyQuDfNw==",
      "cpu": [
        "arm64"
      ],
@@ -52,9 +52,9 @@
      }
    },
    "node_modules/@pnpm/linux-x64": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-1hTcyZSVJWpPNHs3u7RbfbAmZXPBLIZQVt/z1XjcDnzI8S49NGIvir876/gq9jL69ZPoE1a6z+qSe3zUPmw0ng==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-beta.3.tgz",
+      "integrity": "sha512-7GrLsnSuDH62y486GUTwJdohGIC1ugz9ZJkbKOHgxIAkNGcSTJ1IkkdARtv7/WMmOEwwESDmtpOQ6LmjnpDMSA==",
      "cpu": [
        "x64"
      ],
@@ -68,9 +68,9 @@
      }
    },
    "node_modules/@pnpm/macos-arm64": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-7iJdDfWaRWeoGBvU3gJcxbReYM83IhiWFZPHMSW+ga44W/qTzczYIeGeCorsxQRKBPnw2qK3hh9bevkyX6XOWw==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-beta.3.tgz",
+      "integrity": "sha512-NQKgI1DURrEiOUzpxL0Mc+yn7DV4tpShqGnjaJLbz8ZCXsX/qhmybebvCG3r+IfSk3P5KID66lcgC/Osiaz0Dg==",
      "cpu": [
        "arm64"
      ],
@@ -84,9 +84,9 @@
      }
    },
    "node_modules/@pnpm/macos-x64": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-wREXbc2hrSd6r/dyPYuFIkkFoIbtmke5rlJrcITe65OvIQmSW+Fp3X8PBIYcnx3lJyk4809YlqI184yovUaMZA==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-beta.3.tgz",
+      "integrity": "sha512-Ky22KFYHXx8+8WU4KJT9NXVgzFioL2w9pHTQjsqTK70AbxiErscPYhrFIehlCNbXjgs+tGVIy13QNKkiwvmS8w==",
      "cpu": [
        "x64"
      ],
@@ -100,9 +100,9 @@
      }
    },
    "node_modules/@pnpm/win-arm64": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-ygHjDdc0h2uCIcBa30Cnd2ciGWFNC0qm2t0w88PYEC/1rmbGCDfqeGtf/8R8THzTVOuw/pOzIDTs6QEhB6aPOg==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-beta.3.tgz",
+      "integrity": "sha512-7L8TFNDm25m+XYSyhcola3YFd/li6BZzzl56SsyGnZabsvUslMwnDiJad48wOz8IuN7zsrTSGh+X/x6F+GdrFQ==",
      "cpu": [
        "arm64"
      ],
@@ -116,9 +116,9 @@
      }
    },
    "node_modules/@pnpm/win-x64": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-//5eHf7Zw4MtgJhlD4VUbemngxMnhwySgZNGu0ngkNBRVjnESE7NoXZZ5kHIdatv6VQpqkCthNZrheaiJedSGw==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-beta.3.tgz",
+      "integrity": "sha512-Z/6OpMUaIpggXjCtWEhp6kWjiT/2EImhkJAu8AodOORqeNcWouGEq3sO4XU0em6d+pAHmdV0hWMQ2xCUmPVuiA==",
      "cpu": [
        "x64"
      ],
--- a/src/install-pnpm/bootstrap/pnpm-lock.json
+++ b/src/install-pnpm/bootstrap/pnpm-lock.json
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "pnpm": "11.0.0-beta.4-1"
+        "pnpm": "11.0.0-beta.3"
      }
    },
    "node_modules/pnpm": {
-      "version": "11.0.0-beta.4-1",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-beta.4-1.tgz",
-      "integrity": "sha512-zkZWSclaXz4NI43dkF0uYx8bGXjoy7T1KNPKjaGt1pQcJVD6foShIVum5dO47t5hpTvDNfPUGUGxXcM/RXRZRQ==",
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-beta.3.tgz",
+      "integrity": "sha512-6PrfRjycZV4vRX6ttG9oR6pOgbI2/OcF2QLOzHm35UcRuvtqP4zf3wQfAAPwEbeu1uAbpSg/Q5cL8h32tumy6Q==",
      "license": "MIT",
      "bin": {
        "pn": "bin/pnpm.mjs",
Author	SHA1	Message	Date
Zoltan Kochan	19566048c2	fix: address review feedback — PATH ordering and regex anchoring - Swap addPath order so pnpmHome (with pnpm.exe) is prepended last and has highest precedence over pnpmHome/bin. - Anchor version regex with $ and allow prerelease suffixes.	2026-03-27 20:38:35 +01:00
Zoltan Kochan	825c5d3936	fix: add PNPM_HOME/bin to PATH on all platforms	2026-03-27 20:16:32 +01:00
Zoltan Kochan	8cb9261afe	fix: remove duplicate addPath in setOutputs that shadowed pnpm.exe setOutputs called addPath(node_modules/.bin) AFTER installPnpm had already added the correct path (@pnpm/exe on Windows). Since GITHUB_PATH entries are prepended, .bin ended up first in PATH, causing PowerShell to find npm's broken shims instead of pnpm.exe.	2026-03-27 20:05:21 +01:00
Zoltan Kochan	43028df61b	debug: log pnpm --version output during setup	2026-03-27 19:44:58 +01:00
Zoltan Kochan	54e420f032	test: validate pnpm --version output in CI All version checks now capture output and assert it matches a semver pattern. Previously, a silently failing pnpm (exit 0, no output) would pass the tests.	2026-03-27 19:33:54 +01:00
Zoltan Kochan	5a859cc8cb	fix: add @pnpm/exe dir to PATH on Windows instead of .bin shims On Windows, npm's .bin shims can't properly execute the extensionless native binaries from @pnpm/exe. Instead of trying to fix the shims, add the @pnpm/exe directory directly to PATH where pnpm.exe lives.	2026-03-27 19:30:36 +01:00
Zoltan Kochan	cd98fe77eb	fix: copy pnpm.exe to .bin/ on Windows for standalone mode The .cmd wrapper approach didn't work because CMD doesn't properly wait for extensionless PE binaries. Instead, copy the actual .exe (and .cmd for pnpx) from @pnpm/exe into .bin/ so PATHEXT finds pnpm.exe directly, bypassing npm's broken node-wrapping shim.	2026-03-27 19:15:32 +01:00
Zoltan Kochan	6bbd5b7dd6	fix: overwrite npm .cmd wrappers for @pnpm/exe on Windows npm creates .cmd wrappers that invoke bin entries through `node`, but @pnpm/exe bins are native executables, not JavaScript files. This causes pnpm commands to silently fail on Windows.	2026-03-27 19:01:02 +01:00