fix(ci): exclude macos

.github/workflows/pr-check.yaml

@@ -1,28 +0,0 @@
-name: pr-check
-
-on: [ pull_request ]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-jobs:
-  check-dist:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        with:
-          run_install: true
-          version: 9
-
-      - name: Update dist/index.js
-        run: pnpm run build
-
-      - name: Check for uncommitted changes in dist
-        run: git diff --exit-code dist/index.js

.github/workflows/test.yaml

@@ -22,7 +22,7 @@ jobs:
           - windows-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
 
       - name: Run the action
         uses: ./
@@ -32,16 +32,8 @@ jobs:
       - name: 'Test: which'
         run: which pnpm; which pnpx
 
-      - name: 'Test: version'
-        run: pnpm --version
-
-      - name: 'Test: install in a fresh project'
-        run: |
-          mkdir /tmp/test-project
-          cd /tmp/test-project
-          pnpm init
-          pnpm add is-odd
-        shell: bash
+      - name: 'Test: install'
+        run: pnpm install
 
   test_dest:
     name: Test with dest
@@ -59,7 +51,7 @@ jobs:
           - windows-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
 
       - name: Run the action
         uses: ./
@@ -70,8 +62,8 @@ jobs:
       - name: 'Test: which'
         run: which pnpm && which pnpx
 
-      - name: 'Test: version'
-        run: pnpm --version
+      - name: 'Test: install'
+        run: pnpm install
 
   test_standalone:
     name: Test with standalone
@@ -82,31 +74,51 @@ jobs:
       fail-fast: false
       matrix:
         os:
+          # macos is excluded from this test because node 12 is no longer available on this platform
           - ubuntu-latest
           - windows-latest
 
+        standalone:
+          - true
+          - false
+
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
 
       - name: Run the action
         uses: ./
         with:
           version: 9.15.0
-          standalone: true
+          standalone: ${{ matrix.standalone }}
 
-      - name: 'Test: which'
+      - name: install Node.js
+        uses: actions/setup-node@v4
+        with:
+          # pnpm@7.0.0 is not compatible with Node.js 12
+          node-version: 12.22.12
+
+      - name: 'Test: which (pnpm)'
         run: which pnpm
 
-      - name: 'Test: version'
-        run: pnpm --version
+      - name: 'Test: which (pnpx)'
+        if: matrix.standalone == false
+        run: which pnpx
 
-      - name: 'Test: install in a fresh project'
-        run: |
-          mkdir /tmp/test-standalone
-          cd /tmp/test-standalone
-          pnpm init
-          pnpm add is-odd
+      - name: 'Test: install when standalone is true'
+        if: matrix.standalone
+        run: pnpm install
+
+      - name: 'Test: install when standalone is false'
+        if: matrix.standalone == false
+        # Since the default shell on windows runner is pwsh, we specify bash explicitly
         shell: bash
+        run: |
+          if pnpm install; then
+            echo "pnpm install should fail"
+            exit 1
+          else
+            echo "pnpm install failed as expected"
+          fi
 
   test_run_install:
     name: 'Test with run_install (${{ matrix.run_install.name }}, ${{ matrix.os }})'
@@ -125,6 +137,11 @@ jobs:
         run_install:
           - name: 'null'
             value: 'null'
+          - name: 'empty object'
+            value: '{}'
+          - name: 'recursive'
+            value: |
+              recursive: true
           - name: 'global'
             value: |
               args:
@@ -132,9 +149,18 @@ jobs:
                 - --global-dir=./pnpm-global
                 - npm
                 - yarn
+          - name: 'array'
+            value: |
+              - {}
+              - recursive: true
+              - args:
+                - --global
+                - --global-dir=./pnpm-global
+                - npm
+                - yarn
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4
 
       - name: Run the action
         uses: ./
@@ -145,5 +171,5 @@ jobs:
       - name: 'Test: which'
         run: which pnpm; which pnpx
 
-      - name: 'Test: version'
-        run: pnpm --version
+      - name: 'Test: install'
+        run: pnpm install

.gitignore

@@ -2,6 +2,8 @@ node_modules
 *.log
 /dist/*
 !/dist/index.js
+!/dist/pnpm.cjs
+!/dist/worker.js
 tmp
 temp
 *.tmp

action.yml

@@ -37,6 +37,6 @@ outputs:
   bin_dest:
     description: Location of `pnpm` and `pnpx` command
 runs:
-  using: node24
+  using: node20
   main: dist/index.js
   post: dist/index.js

package.json

@@ -1,10 +1,10 @@
 {
   "private": true,
   "scripts": {
-    "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --minify --outfile=dist/index.js --loader:.json=json",
-    "build": "pnpm run build:bundle",
-    "test": "vitest run",
-    "start": "pnpm run build && sh ./run.sh"
+    "build:ncc": "ncc build --minify --no-source-map-register --no-cache dist/tsc/index.js --out dist/",
+    "build": "tsc && pnpm run build:ncc",
+    "start": "pnpm run build && sh ./run.sh",
+    "update-pnpm-dist": "pnpm install && cp ./node_modules/pnpm/dist/pnpm.cjs ./dist/pnpm.cjs && cp ./node_modules/pnpm/dist/worker.js ./dist/worker.js"
   },
   "dependencies": {
     "@actions/cache": "^4.1.0",
@@ -12,14 +12,14 @@
     "@actions/exec": "^1.1.1",
     "@actions/glob": "^0.5.0",
     "@types/expand-tilde": "^2.0.2",
-    "@types/node": "^22.0.0",
+    "@types/node": "^20.11.5",
     "expand-tilde": "^2.0.2",
     "yaml": "^2.3.4",
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "esbuild": "^0.27.4",
-    "typescript": "^5.3.3",
-    "vitest": "^4.1.2"
+    "@vercel/ncc": "^0.38.1",
+    "pnpm": "^8.14.3",
+    "typescript": "^5.3.3"
   }
 }

pnpm-workspace.yaml

@@ -1,4 +0,0 @@
-packages:
-  - '.'
-allowBuilds:
-  esbuild: true

src/inputs/run-install.ts

@@ -1,5 +1,5 @@
 import { getInput, error } from '@actions/core'
-import { parse as parseYaml } from 'yaml'
+import * as yaml from 'yaml'
 import { z, ZodError } from 'zod'
 
 const RunInstallSchema = z.object({
@@ -20,7 +20,7 @@ export type RunInstall = z.infer<typeof RunInstallSchema>
 
 export function parseRunInstall(inputName: string): RunInstall[] {
   const input = getInput(inputName, { required: true })
-  const parsedInput: unknown = parseYaml(input)
+  const parsedInput: unknown = yaml.parse(input)
 
   try {
     const result: RunInstallInput = RunInstallInputSchema.parse(parsedInput)

src/install-pnpm/bootstrap/exe-lock.json

@@ -1,147 +0,0 @@
-{
-  "name": "bootstrap-exe",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "@pnpm/exe": "10.32.1"
-      }
-    },
-    "node_modules/@pnpm/exe": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-10.32.1.tgz",
-      "integrity": "sha512-baEtwHeZwmZAdBuuDDL6tbdGg5KpxhPxr3QFfYTGXvY6ws+Z1bN0mQ7ZjcaXBSC1HuLpVXnZ6NsBiaZ2DMv4vg==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "pnpm": "pnpm"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      },
-      "optionalDependencies": {
-        "@pnpm/linux-arm64": "10.32.1",
-        "@pnpm/linux-x64": "10.32.1",
-        "@pnpm/macos-arm64": "10.32.1",
-        "@pnpm/macos-x64": "10.32.1",
-        "@pnpm/win-arm64": "10.32.1",
-        "@pnpm/win-x64": "10.32.1"
-      }
-    },
-    "node_modules/@pnpm/linux-arm64": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-10.32.1.tgz",
-      "integrity": "sha512-6uB0B+XvunQwHGzIMk2JCkl4Ur6BtM4XbJSwB/mgpWmXDoX/KTJmgx2lodcTjgJSGSySCHfIVuTR9sj/F2D4EA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "bin": {
-        "pnpm": "pnpm"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
-    "node_modules/@pnpm/linux-x64": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-10.32.1.tgz",
-      "integrity": "sha512-AM2tv23Fg7h+nV+adqA/SkZKUysSIEetHfBwYFl8ArgdgkqbGoQy0rAOdKYQBb920CqfexXfI8OA8kPCzRxYng==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "bin": {
-        "pnpm": "pnpm"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
-    "node_modules/@pnpm/macos-arm64": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-10.32.1.tgz",
-      "integrity": "sha512-Zr4JkhRbtGVsYgbuGZO0dq/6FPOn072Pdo0ubmqWtc14cUATKgAJD7efG03yqr3MLgtwFHgdtUzZ1WsaYAtUTA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "bin": {
-        "pnpm": "pnpm"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
-    "node_modules/@pnpm/macos-x64": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-10.32.1.tgz",
-      "integrity": "sha512-Yk6q3oFDu//OniXJxfTSHo+aew1LX81FcbzJAtEkcCeTQ0SLbQT6J3QiOMNikp8n8IjNhsy+bn2bdkUxaw+akA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "bin": {
-        "pnpm": "pnpm"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
-    "node_modules/@pnpm/win-arm64": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-10.32.1.tgz",
-      "integrity": "sha512-P8rsP5IUetpYjr2iwggoswL2qUukYrJoToXWuMyo8immn58CsYxaXsHVQ1Oq1R3XMfmGGWTXLsiJuQ7H991MRg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "bin": {
-        "pnpm": "pnpm.exe"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
-    "node_modules/@pnpm/win-x64": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-10.32.1.tgz",
-      "integrity": "sha512-i24GwbtBO8ojrhp8WWimX7NgZs0UKH1171oRt6qcRL+a+FxE0Eggv2y0KP7ZI7F3+LZMarwr3tnYsZryfciUOg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "bin": {
-        "pnpm": "pnpm.exe"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    }
-  }
-}

src/install-pnpm/bootstrap/pnpm-lock.json

@@ -1,28 +0,0 @@
-{
-  "name": "bootstrap-pnpm",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "pnpm": "latest"
-      }
-    },
-    "node_modules/pnpm": {
-      "version": "10.32.1",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-10.32.1.tgz",
-      "integrity": "sha512-pwaTjw6JrBRWtlY+q07fHR+vM2jRGR/FxZeQ6W3JGORFarLmfWE94QQ9LoyB+HMD5rQNT/7KnfFe8a1Wc0jyvg==",
-      "license": "MIT",
-      "bin": {
-        "pnpm": "bin/pnpm.cjs",
-        "pnpx": "bin/pnpx.cjs"
-      },
-      "engines": {
-        "node": ">=18.12"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    }
-  }
-}

src/install-pnpm/ensureAliasLinks.test.ts

@@ -1,175 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest'
-import { ensureAliasLinks } from './ensureAliasLinks'
-import { mkdtemp, mkdir, writeFile, readFile, readlink } from 'fs/promises'
-import { existsSync } from 'fs'
-import path from 'path'
-import os from 'os'
-
-async function createTempDir (): Promise<string> {
-  return mkdtemp(path.join(os.tmpdir(), 'alias-links-test-'))
-}
-
-async function setupStandaloneFixture (binDir: string): Promise<void> {
-  const exeDir = path.join(binDir, '..', '@pnpm', 'exe')
-  await mkdir(exeDir, { recursive: true })
-  // Only the pnpm binary exists — pn/pnpx/pnx may not exist after self-update
-  await writeFile(path.join(exeDir, 'pnpm'), '#!/bin/sh\necho pnpm\n', { mode: 0o755 })
-}
-
-async function setupNonStandaloneFixture (binDir: string): Promise<void> {
-  const pnpmBinDir = path.join(binDir, '..', 'pnpm', 'bin')
-  await mkdir(pnpmBinDir, { recursive: true })
-  await writeFile(path.join(pnpmBinDir, 'pnpm.cjs'), 'console.log("pnpm")\n')
-}
-
-describe('ensureAliasLinks', () => {
-  let binDir: string
-
-  beforeEach(async () => {
-    const tmpDir = await createTempDir()
-    binDir = path.join(tmpDir, 'node_modules', '.bin')
-    await mkdir(binDir, { recursive: true })
-  })
-
-  describe('standalone mode', () => {
-    it('creates pn as symlink to pnpm binary on unix', async () => {
-      await setupStandaloneFixture(binDir)
-
-      await ensureAliasLinks(binDir, true, 'linux')
-
-      const pnTarget = await readlink(path.join(binDir, 'pn'))
-      expect(pnTarget).toBe(path.join('..', '@pnpm', 'exe', 'pnpm'))
-    })
-
-    it('creates pnpx and pnx as shell scripts calling pnpm dlx on unix', async () => {
-      await setupStandaloneFixture(binDir)
-
-      await ensureAliasLinks(binDir, true, 'linux')
-
-      for (const name of ['pnpx', 'pnx']) {
-        const content = await readFile(path.join(binDir, name), 'utf8')
-        expect(content).toContain('pnpm')
-        expect(content).toContain('dlx')
-        expect(content).toContain('exec')
-      }
-    })
-
-    it('creates .cmd and .ps1 shims on windows', async () => {
-      await setupStandaloneFixture(binDir)
-
-      await ensureAliasLinks(binDir, true, 'win32')
-
-      // pn shims
-      const pnCmd = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
-      expect(pnCmd).toContain('pnpm')
-      expect(pnCmd).toContain('%*')
-      expect(pnCmd).not.toContain('dlx')
-
-      const pnPs1 = await readFile(path.join(binDir, 'pn.ps1'), 'utf8')
-      expect(pnPs1).toContain('pnpm')
-      expect(pnPs1).toContain('@args')
-
-      // pnpx/pnx shims call pnpm dlx
-      const pnpxCmd = await readFile(path.join(binDir, 'pnpx.cmd'), 'utf8')
-      expect(pnpxCmd).toContain('pnpm')
-      expect(pnpxCmd).toContain('dlx')
-
-      // Should not create extensionless files on windows
-      expect(existsSync(path.join(binDir, 'pn'))).toBe(false)
-    })
-  })
-
-  describe('non-standalone mode', () => {
-    it('creates pn as symlink to pnpm.cjs on unix', async () => {
-      await setupNonStandaloneFixture(binDir)
-
-      await ensureAliasLinks(binDir, false, 'linux')
-
-      const pnTarget = await readlink(path.join(binDir, 'pn'))
-      expect(pnTarget).toBe(path.join('..', 'pnpm', 'bin', 'pnpm.cjs'))
-    })
-
-    it('creates pnpx/pnx scripts on unix', async () => {
-      await setupNonStandaloneFixture(binDir)
-
-      await ensureAliasLinks(binDir, false, 'linux')
-
-      const content = await readFile(path.join(binDir, 'pnpx'), 'utf8')
-      expect(content).toContain('pnpm.cjs')
-      expect(content).toContain('dlx')
-    })
-
-    it('creates .cmd shims on windows', async () => {
-      await setupNonStandaloneFixture(binDir)
-
-      await ensureAliasLinks(binDir, false, 'win32')
-
-      const cmdContent = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
-      expect(cmdContent).toContain(path.join('pnpm', 'bin', 'pnpm.cjs'))
-    })
-  })
-
-  describe('skips when pnpm binary does not exist', () => {
-    it('creates no links on unix', async () => {
-      await ensureAliasLinks(binDir, true, 'linux')
-
-      expect(existsSync(path.join(binDir, 'pn'))).toBe(false)
-      expect(existsSync(path.join(binDir, 'pnpx'))).toBe(false)
-      expect(existsSync(path.join(binDir, 'pnx'))).toBe(false)
-    })
-
-    it('creates no shims on windows', async () => {
-      await ensureAliasLinks(binDir, true, 'win32')
-
-      expect(existsSync(path.join(binDir, 'pn.cmd'))).toBe(false)
-    })
-  })
-
-  describe('self-update bin directory (pnpm shim in same dir)', () => {
-    it('creates aliases using pnpm shim in the same directory on unix', async () => {
-      // self-update creates a pnpm shim in $PNPM_HOME/bin/ — no package dir
-      await writeFile(path.join(binDir, 'pnpm'), '#!/bin/sh\nexec /path/to/real/pnpm "$@"\n', { mode: 0o755 })
-
-      await ensureAliasLinks(binDir, true, 'linux')
-
-      const pnTarget = await readlink(path.join(binDir, 'pn'))
-      expect(pnTarget).toBe('pnpm')
-
-      const pnxContent = await readFile(path.join(binDir, 'pnx'), 'utf8')
-      expect(pnxContent).toContain('pnpm')
-      expect(pnxContent).toContain('dlx')
-    })
-
-    it('creates .cmd shims using pnpm in same dir on windows', async () => {
-      await writeFile(path.join(binDir, 'pnpm'), 'pnpm binary')
-
-      await ensureAliasLinks(binDir, true, 'win32')
-
-      const cmdContent = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
-      expect(cmdContent).toContain('pnpm')
-    })
-  })
-
-  describe('overwrites existing broken shims', () => {
-    it('replaces npm broken shim with symlink on unix', async () => {
-      await setupStandaloneFixture(binDir)
-      // Simulate npm's broken shim pointing to .tools/ placeholder
-      await writeFile(path.join(binDir, 'pn'), '#!/bin/sh\nexec .tools/broken "$@"\n')
-
-      await ensureAliasLinks(binDir, true, 'linux')
-
-      const target = await readlink(path.join(binDir, 'pn'))
-      expect(target).toBe(path.join('..', '@pnpm', 'exe', 'pnpm'))
-    })
-
-    it('replaces existing .cmd shims on windows', async () => {
-      await setupStandaloneFixture(binDir)
-      await writeFile(path.join(binDir, 'pn.cmd'), 'broken shim')
-
-      await ensureAliasLinks(binDir, true, 'win32')
-
-      const content = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
-      expect(content).toContain('pnpm')
-    })
-  })
-})

src/install-pnpm/ensureAliasLinks.ts

@@ -1,84 +0,0 @@
-import { unlink, writeFile, symlink } from 'fs/promises'
-import { existsSync } from 'fs'
-import path from 'path'
-
-function shScript (command: string): string {
-  return `#!/bin/sh\nexec ${command} "$@"\n`
-}
-
-function cmdShim (command: string): string {
-  return `@ECHO off\r\n${command} %*\r\n`
-}
-
-function pwshShim (command: string): string {
-  return `#!/usr/bin/env pwsh\n${command} @args\n`
-}
-
-async function forceSymlink (target: string, linkPath: string): Promise<void> {
-  try { await unlink(linkPath) } catch {}
-  await symlink(target, linkPath)
-}
-
-async function forceWriteFile (filePath: string, content: string, mode?: number): Promise<void> {
-  try { await unlink(filePath) } catch {}
-  await writeFile(filePath, content, { mode })
-}
-
-/**
- * Find the pnpm binary/shim relative to binDir.
- * Checks the package directory first (node_modules/.bin/../@pnpm/exe/pnpm),
- * then falls back to a pnpm shim in binDir itself (e.g. self-update's bin/).
- */
-function findPnpmTarget (binDir: string, standalone: boolean): string | undefined {
-  const packageTarget = standalone
-    ? path.join('..', '@pnpm', 'exe', 'pnpm')
-    : path.join('..', 'pnpm', 'bin', 'pnpm.cjs')
-
-  if (existsSync(path.resolve(binDir, packageTarget))) {
-    return packageTarget
-  }
-
-  // self-update creates a pnpm shim in $PNPM_HOME/bin/ — use it directly
-  if (existsSync(path.join(binDir, 'pnpm'))) {
-    return 'pnpm'
-  }
-
-  return undefined
-}
-
-/**
- * Create pn/pnpx/pnx alias links in the bin directory.
- *
- * pn is an alias for pnpm, so it symlinks (or shims) to the pnpm binary.
- * pnpx/pnx are aliases for "pnpm dlx", created as shell scripts.
- *
- * This does NOT rely on the @pnpm/exe package having pn/pnx files, because
- * pnpm self-update only replaces the pnpm binary — it doesn't update other
- * files in the package. The aliases are created by pointing pn directly to
- * the pnpm binary, and pnpx/pnx as scripts that exec "pnpm dlx".
- */
-export async function ensureAliasLinks (binDir: string, standalone: boolean, platform: NodeJS.Platform = process.platform): Promise<void> {
-  const isWindows = platform === 'win32'
-
-  const pnpmTarget = findPnpmTarget(binDir, standalone)
-  if (!pnpmTarget) return
-
-  if (isWindows) {
-    // pn → calls pnpm directly
-    await writeFile(path.join(binDir, 'pn.cmd'), cmdShim(`"%~dp0\\${pnpmTarget}"`))
-    await writeFile(path.join(binDir, 'pn.ps1'), pwshShim(`& "$PSScriptRoot\\${pnpmTarget}"`))
-    // pnpx/pnx → calls pnpm dlx
-    for (const name of ['pnpx', 'pnx']) {
-      await writeFile(path.join(binDir, `${name}.cmd`), cmdShim(`"%~dp0\\${pnpmTarget}" dlx`))
-      await writeFile(path.join(binDir, `${name}.ps1`), pwshShim(`& "$PSScriptRoot\\${pnpmTarget}" dlx`))
-    }
-  } else {
-    // pn → symlink to pnpm binary
-    await forceSymlink(pnpmTarget, path.join(binDir, 'pn'))
-    // pnpx/pnx → shell scripts that exec pnpm dlx
-    for (const name of ['pnpx', 'pnx']) {
-      const pnpmPath = `"$(dirname "$0")/${pnpmTarget}"`
-      await forceWriteFile(path.join(binDir, name), shScript(`${pnpmPath} dlx`), 0o755)
-    }
-  }
-}

src/install-pnpm/run.ts

@@ -1,93 +1,69 @@
 import { addPath, exportVariable } from '@actions/core'
 import { spawn } from 'child_process'
-import { rm, writeFile, mkdir, symlink } from 'fs/promises'
-import { readFileSync, existsSync } from 'fs'
+import { rm, writeFile, mkdir, copyFile } from 'fs/promises'
+import { readFileSync } from 'fs'
 import path from 'path'
+import { execPath } from 'process'
 import util from 'util'
 import { Inputs } from '../inputs'
-import { parse as parseYaml } from 'yaml'
-import pnpmLock from './bootstrap/pnpm-lock.json'
-import exeLock from './bootstrap/exe-lock.json'
-import { ensureAliasLinks } from './ensureAliasLinks'
-
-const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
-const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })
+import YAML from 'yaml'
 
 export async function runSelfInstaller(inputs: Inputs): Promise<number> {
   const { version, dest, packageJsonFile, standalone } = inputs
-
-  // Install bootstrap pnpm via npm (integrity verified by committed lockfile)
-  await rm(dest, { recursive: true, force: true })
-  await mkdir(dest, { recursive: true })
-
-  const lockfile = standalone ? exeLock : pnpmLock
-  const packageJson = standalone ? BOOTSTRAP_EXE_PACKAGE_JSON : BOOTSTRAP_PNPM_PACKAGE_JSON
-  await writeFile(path.join(dest, 'package.json'), packageJson)
-  await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))
-
-  const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest })
-  if (npmExitCode !== 0) {
-    return npmExitCode
-  }
-
-  const pnpmHome = path.join(dest, 'node_modules', '.bin')
-  addPath(pnpmHome)
-  addPath(path.join(pnpmHome, 'bin'))
-  exportVariable('PNPM_HOME', pnpmHome)
-
-  // Ensure pnpm bin link exists — npm ci sometimes doesn't create it
-  const pnpmBinLink = path.join(pnpmHome, 'pnpm')
-  if (!existsSync(pnpmBinLink)) {
-    await mkdir(pnpmHome, { recursive: true })
-    const target = standalone
-      ? path.join('..', '@pnpm', 'exe', 'pnpm')
-      : path.join('..', 'pnpm', 'bin', 'pnpm.cjs')
-    await symlink(target, pnpmBinLink)
-  }
-
-  const bootstrapPnpm = standalone
-    ? path.join(dest, 'node_modules', '@pnpm', 'exe', 'pnpm')
-    : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.cjs')
-
-  // Determine the target version
-  const targetVersion = readTargetVersion({ version, packageJsonFile })
-
-  if (targetVersion) {
-    const cmd = standalone ? bootstrapPnpm : process.execPath
-    const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
-    const exitCode = await runCommand(cmd, args, { cwd: dest })
-    if (exitCode !== 0) {
-      return exitCode
-    }
-  }
-
-  // Create pn/pnx alias bin links if the installed version supports them
-  // (pnpm v11+ adds pn and pnx as short aliases).
-  // self-update links bins to $PNPM_HOME/bin/ which is also on PATH,
-  // so we must create aliases in both directories.
-  await ensureAliasLinks(pnpmHome, standalone)
-  const pnpmBinDir = path.join(pnpmHome, 'bin')
-  if (existsSync(pnpmBinDir)) {
-    await ensureAliasLinks(pnpmBinDir, standalone)
-  }
-
-  return 0
-}
-
-function readTargetVersion(opts: {
-  readonly version?: string | undefined
-  readonly packageJsonFile: string
-}): string | undefined {
-  const { version, packageJsonFile } = opts
   const { GITHUB_WORKSPACE } = process.env
 
-  let packageManager: unknown
+  // prepare self install
+  await rm(dest, { recursive: true, force: true })
+  // create dest directory after removal
+  await mkdir(dest, { recursive: true })
+  const pkgJson = path.join(dest, 'package.json')
+  // we have ensured the dest directory exists, we can write the file directly
+  await writeFile(pkgJson, JSON.stringify({ private: true }))
+
+  // copy .npmrc if it exists to install from custom registry
+  if (GITHUB_WORKSPACE) {
+    try {
+      await copyFile(path.join(GITHUB_WORKSPACE, '.npmrc'), path.join(dest, '.npmrc'))
+    } catch (error) {
+      // Swallow error if .npmrc doesn't exist
+      if (!util.types.isNativeError(error) || !('code' in error) || error.code !== 'ENOENT') throw error
+    }
+  }
+
+  // prepare target pnpm
+  const target = await readTarget({ version, packageJsonFile, standalone })
+  const cp = spawn(execPath, [path.join(__dirname, 'pnpm.cjs'), 'install', target, '--no-lockfile'], {
+    cwd: dest,
+    stdio: ['pipe', 'inherit', 'inherit'],
+  })
+
+  const exitCode = await new Promise<number>((resolve, reject) => {
+    cp.on('error', reject)
+    cp.on('close', resolve)
+  })
+  if (exitCode === 0) {
+    const pnpmHome = path.join(dest, 'node_modules/.bin')
+    addPath(pnpmHome)
+    exportVariable('PNPM_HOME', pnpmHome)
+  }
+  return exitCode
+}
+
+async function readTarget(opts: {
+  readonly version?: string | undefined
+  readonly packageJsonFile: string
+  readonly standalone: boolean
+}) {
+  const { version, packageJsonFile, standalone } = opts
+  const { GITHUB_WORKSPACE } = process.env
+
+  let packageManager
 
   if (GITHUB_WORKSPACE) {
     try {
       const content = readFileSync(path.join(GITHUB_WORKSPACE, packageJsonFile), 'utf8');
       ({ packageManager } = packageJsonFile.endsWith(".yaml")
-        ? parseYaml(content, { merge: true })
+        ? YAML.parse(content, { merge: true })
         : JSON.parse(content)
       )
     } catch (error: unknown) {
@@ -108,12 +84,7 @@ function readTargetVersion(opts: {
 Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_PM_VERSION`)
     }
 
-    return version
-  }
-
-  if (typeof packageManager === 'string' && packageManager.startsWith('pnpm@')) {
-    // Strip the "pnpm@" prefix and any "+sha..." hash suffix
-    return packageManager.replace('pnpm@', '').replace(/\+.*$/, '')
+    return `${ standalone ? '@pnpm/exe' : 'pnpm' }@${version}`
   }
 
   if (!GITHUB_WORKSPACE) {
@@ -123,22 +94,22 @@ please run the actions/checkout before pnpm/action-setup.
 Otherwise, please specify the pnpm version in the action configuration.`)
   }
 
+  if (typeof packageManager !== 'string') {
     throw new Error(`No pnpm version is specified.
 Please specify it by one of the following ways:
   - in the GitHub Action config with the key "version"
   - in the package.json with the key "packageManager"`)
-}
+  }
 
-function runCommand(cmd: string, args: string[], opts: { cwd: string }): Promise<number> {
-  return new Promise<number>((resolve, reject) => {
-    const cp = spawn(cmd, args, {
-      cwd: opts.cwd,
-      stdio: ['pipe', 'inherit', 'inherit'],
-      shell: process.platform === 'win32',
-    })
-    cp.on('error', reject)
-    cp.on('close', resolve)
-  })
+  if (!packageManager.startsWith('pnpm@')) {
+    throw new Error('Invalid packageManager field in package.json')
+  }
+
+  if (standalone) {
+    return packageManager.replace('pnpm@', '@pnpm/exe@')
+  }
+
+  return packageManager
 }
 
 export default runSelfInstaller

src/utils/index.ts

@@ -6,5 +6,5 @@ export const getBinDest = (inputs: Inputs): string => path.join(inputs.dest, 'no
 
 export const patchPnpmEnv = (inputs: Inputs): NodeJS.ProcessEnv => ({
   ...process.env,
-  PATH: path.join(getBinDest(inputs), 'bin') + path.delimiter + getBinDest(inputs) + path.delimiter + process.env.PATH,
+  PATH: getBinDest(inputs) + path.delimiter + process.env.PATH,
 })

tsconfig.json

@@ -1,19 +1,26 @@
+
 {
   "compilerOptions": {
     "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
+    "module": "Node16",
     "resolveJsonModule": true,
     "lib": [
       "ES2023"
     ],
-    "noEmit": true,
+    "outDir": "./dist/tsc",
+    "preserveConstEnums": true,
+    "incremental": false,
+    "declaration": true,
+    "sourceMap": true,
+    "importHelpers": false,
     "strict": true,
     "pretty": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noImplicitReturns": true,
     "noFallthroughCasesInSwitch": true,
-    "esModuleInterop": true
+    "esModuleInterop": true,
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true
   }
 }