fix: fall back to pnpm shim in same directory for self-update bin/

ensureAliasLinks had a hardcoded relative path to @pnpm/exe/pnpm which
only works from node_modules/.bin/. In self-update's bin/ directory
($PNPM_HOME/bin/), that path doesn't resolve. Now falls back to using
the pnpm shim in the same directory when the package path doesn't exist.

.github/workflows/pr-check.yaml

@@ -0,0 +1,28 @@
+name: pr-check
+
+on: [ pull_request ]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  check-dist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          run_install: true
+          version: 9
+
+      - name: Update dist/index.js
+        run: pnpm run build
+
+      - name: Check for uncommitted changes in dist
+        run: git diff --exit-code dist/index.js

.github/workflows/test.yaml

@@ -22,7 +22,7 @@ jobs:
           - windows-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./
@@ -32,8 +32,16 @@ jobs:
       - name: 'Test: which'
         run: which pnpm; which pnpx
 
-      - name: 'Test: install'
-        run: pnpm install
+      - name: 'Test: version'
+        run: pnpm --version
+
+      - name: 'Test: install in a fresh project'
+        run: |
+          mkdir /tmp/test-project
+          cd /tmp/test-project
+          pnpm init
+          pnpm add is-odd
+        shell: bash
 
   test_dest:
     name: Test with dest
@@ -51,7 +59,7 @@ jobs:
           - windows-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./
@@ -62,8 +70,8 @@ jobs:
       - name: 'Test: which'
         run: which pnpm && which pnpx
 
-      - name: 'Test: install'
-        run: pnpm install
+      - name: 'Test: version'
+        run: pnpm --version
 
   test_standalone:
     name: Test with standalone
@@ -75,50 +83,30 @@ jobs:
       matrix:
         os:
           - ubuntu-latest
-          - macos-latest
           - windows-latest
 
-        standalone:
-          - true
-          - false
-
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./
         with:
           version: 9.15.0
-          standalone: ${{ matrix.standalone }}
+          standalone: true
 
-      - name: install Node.js
-        uses: actions/setup-node@v4
-        with:
-          # pnpm@7.0.0 is not compatible with Node.js 12
-          node-version: 12.22.12
-
-      - name: 'Test: which (pnpm)'
+      - name: 'Test: which'
         run: which pnpm
 
-      - name: 'Test: which (pnpx)'
-        if: matrix.standalone == false
-        run: which pnpx
+      - name: 'Test: version'
+        run: pnpm --version
 
-      - name: 'Test: install when standalone is true'
-        if: matrix.standalone
-        run: pnpm install
-
-      - name: 'Test: install when standalone is false'
-        if: matrix.standalone == false
-        # Since the default shell on windows runner is pwsh, we specify bash explicitly
-        shell: bash
+      - name: 'Test: install in a fresh project'
         run: |
-          if pnpm install; then
-            echo "pnpm install should fail"
-            exit 1
-          else
-            echo "pnpm install failed as expected"
-          fi
+          mkdir /tmp/test-standalone
+          cd /tmp/test-standalone
+          pnpm init
+          pnpm add is-odd
+        shell: bash
 
   test_run_install:
     name: 'Test with run_install (${{ matrix.run_install.name }}, ${{ matrix.os }})'
@@ -137,11 +125,6 @@ jobs:
         run_install:
           - name: 'null'
             value: 'null'
-          - name: 'empty object'
-            value: '{}'
-          - name: 'recursive'
-            value: |
-              recursive: true
           - name: 'global'
             value: |
               args:
@@ -149,18 +132,9 @@ jobs:
                 - --global-dir=./pnpm-global
                 - npm
                 - yarn
-          - name: 'array'
-            value: |
-              - {}
-              - recursive: true
-              - args:
-                - --global
-                - --global-dir=./pnpm-global
-                - npm
-                - yarn
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./
@@ -171,5 +145,5 @@ jobs:
       - name: 'Test: which'
         run: which pnpm; which pnpx
 
-      - name: 'Test: install'
-        run: pnpm install
+      - name: 'Test: version'
+        run: pnpm --version

.gitignore

@@ -2,8 +2,6 @@ node_modules
 *.log
 /dist/*
 !/dist/index.js
-!/dist/pnpm.cjs
-!/dist/worker.js
 tmp
 temp
 *.tmp

action.yml

@@ -37,6 +37,6 @@ outputs:
   bin_dest:
     description: Location of `pnpm` and `pnpx` command
 runs:
-  using: node20
+  using: node24
   main: dist/index.js
   post: dist/index.js

package.json

@@ -1,10 +1,10 @@
 {
   "private": true,
   "scripts": {
-    "build:ncc": "ncc build --minify --no-source-map-register --no-cache dist/tsc/index.js --out dist/",
-    "build": "tsc && pnpm run build:ncc",
-    "start": "pnpm run build && sh ./run.sh",
-    "update-pnpm-dist": "pnpm install && cp ./node_modules/pnpm/dist/pnpm.cjs ./dist/pnpm.cjs && cp ./node_modules/pnpm/dist/worker.js ./dist/worker.js"
+    "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --minify --outfile=dist/index.js --loader:.json=json",
+    "build": "pnpm run build:bundle",
+    "test": "vitest run",
+    "start": "pnpm run build && sh ./run.sh"
   },
   "dependencies": {
     "@actions/cache": "^4.1.0",
@@ -12,14 +12,14 @@
     "@actions/exec": "^1.1.1",
     "@actions/glob": "^0.5.0",
     "@types/expand-tilde": "^2.0.2",
-    "@types/node": "^20.11.5",
+    "@types/node": "^22.0.0",
     "expand-tilde": "^2.0.2",
     "yaml": "^2.3.4",
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@vercel/ncc": "^0.38.1",
-    "pnpm": "^8.14.3",
-    "typescript": "^5.3.3"
+    "esbuild": "^0.27.4",
+    "typescript": "^5.3.3",
+    "vitest": "^4.1.2"
   }
 }

pnpm-workspace.yaml

@@ -0,0 +1,4 @@
+packages:
+  - '.'
+allowBuilds:
+  esbuild: true

src/inputs/run-install.ts

@@ -1,5 +1,5 @@
 import { getInput, error } from '@actions/core'
-import * as yaml from 'yaml'
+import { parse as parseYaml } from 'yaml'
 import { z, ZodError } from 'zod'
 
 const RunInstallSchema = z.object({
@@ -20,7 +20,7 @@ export type RunInstall = z.infer<typeof RunInstallSchema>
 
 export function parseRunInstall(inputName: string): RunInstall[] {
   const input = getInput(inputName, { required: true })
-  const parsedInput: unknown = yaml.parse(input)
+  const parsedInput: unknown = parseYaml(input)
 
   try {
     const result: RunInstallInput = RunInstallInputSchema.parse(parsedInput)

src/install-pnpm/bootstrap/exe-lock.json

@@ -0,0 +1,147 @@
+{
+  "name": "bootstrap-exe",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "@pnpm/exe": "10.32.1"
+      }
+    },
+    "node_modules/@pnpm/exe": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-10.32.1.tgz",
+      "integrity": "sha512-baEtwHeZwmZAdBuuDDL6tbdGg5KpxhPxr3QFfYTGXvY6ws+Z1bN0mQ7ZjcaXBSC1HuLpVXnZ6NsBiaZ2DMv4vg==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "pnpm": "pnpm"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      },
+      "optionalDependencies": {
+        "@pnpm/linux-arm64": "10.32.1",
+        "@pnpm/linux-x64": "10.32.1",
+        "@pnpm/macos-arm64": "10.32.1",
+        "@pnpm/macos-x64": "10.32.1",
+        "@pnpm/win-arm64": "10.32.1",
+        "@pnpm/win-x64": "10.32.1"
+      }
+    },
+    "node_modules/@pnpm/linux-arm64": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-10.32.1.tgz",
+      "integrity": "sha512-6uB0B+XvunQwHGzIMk2JCkl4Ur6BtM4XbJSwB/mgpWmXDoX/KTJmgx2lodcTjgJSGSySCHfIVuTR9sj/F2D4EA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "bin": {
+        "pnpm": "pnpm"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/linux-x64": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-10.32.1.tgz",
+      "integrity": "sha512-AM2tv23Fg7h+nV+adqA/SkZKUysSIEetHfBwYFl8ArgdgkqbGoQy0rAOdKYQBb920CqfexXfI8OA8kPCzRxYng==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "bin": {
+        "pnpm": "pnpm"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/macos-arm64": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-10.32.1.tgz",
+      "integrity": "sha512-Zr4JkhRbtGVsYgbuGZO0dq/6FPOn072Pdo0ubmqWtc14cUATKgAJD7efG03yqr3MLgtwFHgdtUzZ1WsaYAtUTA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "bin": {
+        "pnpm": "pnpm"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/macos-x64": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-10.32.1.tgz",
+      "integrity": "sha512-Yk6q3oFDu//OniXJxfTSHo+aew1LX81FcbzJAtEkcCeTQ0SLbQT6J3QiOMNikp8n8IjNhsy+bn2bdkUxaw+akA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "bin": {
+        "pnpm": "pnpm"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/win-arm64": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-10.32.1.tgz",
+      "integrity": "sha512-P8rsP5IUetpYjr2iwggoswL2qUukYrJoToXWuMyo8immn58CsYxaXsHVQ1Oq1R3XMfmGGWTXLsiJuQ7H991MRg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "bin": {
+        "pnpm": "pnpm.exe"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/win-x64": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-10.32.1.tgz",
+      "integrity": "sha512-i24GwbtBO8ojrhp8WWimX7NgZs0UKH1171oRt6qcRL+a+FxE0Eggv2y0KP7ZI7F3+LZMarwr3tnYsZryfciUOg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "bin": {
+        "pnpm": "pnpm.exe"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    }
+  }
+}

src/install-pnpm/bootstrap/pnpm-lock.json

@@ -0,0 +1,28 @@
+{
+  "name": "bootstrap-pnpm",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "pnpm": "latest"
+      }
+    },
+    "node_modules/pnpm": {
+      "version": "10.32.1",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-10.32.1.tgz",
+      "integrity": "sha512-pwaTjw6JrBRWtlY+q07fHR+vM2jRGR/FxZeQ6W3JGORFarLmfWE94QQ9LoyB+HMD5rQNT/7KnfFe8a1Wc0jyvg==",
+      "license": "MIT",
+      "bin": {
+        "pnpm": "bin/pnpm.cjs",
+        "pnpx": "bin/pnpx.cjs"
+      },
+      "engines": {
+        "node": ">=18.12"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    }
+  }
+}

src/install-pnpm/ensureAliasLinks.test.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { ensureAliasLinks } from './ensureAliasLinks'
+import { mkdtemp, mkdir, writeFile, readFile, readlink } from 'fs/promises'
+import { existsSync } from 'fs'
+import path from 'path'
+import os from 'os'
+
+async function createTempDir (): Promise<string> {
+  return mkdtemp(path.join(os.tmpdir(), 'alias-links-test-'))
+}
+
+async function setupStandaloneFixture (binDir: string): Promise<void> {
+  const exeDir = path.join(binDir, '..', '@pnpm', 'exe')
+  await mkdir(exeDir, { recursive: true })
+  // Only the pnpm binary exists — pn/pnpx/pnx may not exist after self-update
+  await writeFile(path.join(exeDir, 'pnpm'), '#!/bin/sh\necho pnpm\n', { mode: 0o755 })
+}
+
+async function setupNonStandaloneFixture (binDir: string): Promise<void> {
+  const pnpmBinDir = path.join(binDir, '..', 'pnpm', 'bin')
+  await mkdir(pnpmBinDir, { recursive: true })
+  await writeFile(path.join(pnpmBinDir, 'pnpm.cjs'), 'console.log("pnpm")\n')
+}
+
+describe('ensureAliasLinks', () => {
+  let binDir: string
+
+  beforeEach(async () => {
+    const tmpDir = await createTempDir()
+    binDir = path.join(tmpDir, 'node_modules', '.bin')
+    await mkdir(binDir, { recursive: true })
+  })
+
+  describe('standalone mode', () => {
+    it('creates pn as symlink to pnpm binary on unix', async () => {
+      await setupStandaloneFixture(binDir)
+
+      await ensureAliasLinks(binDir, true, 'linux')
+
+      const pnTarget = await readlink(path.join(binDir, 'pn'))
+      expect(pnTarget).toBe(path.join('..', '@pnpm', 'exe', 'pnpm'))
+    })
+
+    it('creates pnpx and pnx as shell scripts calling pnpm dlx on unix', async () => {
+      await setupStandaloneFixture(binDir)
+
+      await ensureAliasLinks(binDir, true, 'linux')
+
+      for (const name of ['pnpx', 'pnx']) {
+        const content = await readFile(path.join(binDir, name), 'utf8')
+        expect(content).toContain('pnpm')
+        expect(content).toContain('dlx')
+        expect(content).toContain('exec')
+      }
+    })
+
+    it('creates .cmd and .ps1 shims on windows', async () => {
+      await setupStandaloneFixture(binDir)
+
+      await ensureAliasLinks(binDir, true, 'win32')
+
+      // pn shims
+      const pnCmd = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
+      expect(pnCmd).toContain('pnpm')
+      expect(pnCmd).toContain('%*')
+      expect(pnCmd).not.toContain('dlx')
+
+      const pnPs1 = await readFile(path.join(binDir, 'pn.ps1'), 'utf8')
+      expect(pnPs1).toContain('pnpm')
+      expect(pnPs1).toContain('@args')
+
+      // pnpx/pnx shims call pnpm dlx
+      const pnpxCmd = await readFile(path.join(binDir, 'pnpx.cmd'), 'utf8')
+      expect(pnpxCmd).toContain('pnpm')
+      expect(pnpxCmd).toContain('dlx')
+
+      // Should not create extensionless files on windows
+      expect(existsSync(path.join(binDir, 'pn'))).toBe(false)
+    })
+  })
+
+  describe('non-standalone mode', () => {
+    it('creates pn as symlink to pnpm.cjs on unix', async () => {
+      await setupNonStandaloneFixture(binDir)
+
+      await ensureAliasLinks(binDir, false, 'linux')
+
+      const pnTarget = await readlink(path.join(binDir, 'pn'))
+      expect(pnTarget).toBe(path.join('..', 'pnpm', 'bin', 'pnpm.cjs'))
+    })
+
+    it('creates pnpx/pnx scripts on unix', async () => {
+      await setupNonStandaloneFixture(binDir)
+
+      await ensureAliasLinks(binDir, false, 'linux')
+
+      const content = await readFile(path.join(binDir, 'pnpx'), 'utf8')
+      expect(content).toContain('pnpm.cjs')
+      expect(content).toContain('dlx')
+    })
+
+    it('creates .cmd shims on windows', async () => {
+      await setupNonStandaloneFixture(binDir)
+
+      await ensureAliasLinks(binDir, false, 'win32')
+
+      const cmdContent = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
+      expect(cmdContent).toContain(path.join('pnpm', 'bin', 'pnpm.cjs'))
+    })
+  })
+
+  describe('skips when pnpm binary does not exist', () => {
+    it('creates no links on unix', async () => {
+      await ensureAliasLinks(binDir, true, 'linux')
+
+      expect(existsSync(path.join(binDir, 'pn'))).toBe(false)
+      expect(existsSync(path.join(binDir, 'pnpx'))).toBe(false)
+      expect(existsSync(path.join(binDir, 'pnx'))).toBe(false)
+    })
+
+    it('creates no shims on windows', async () => {
+      await ensureAliasLinks(binDir, true, 'win32')
+
+      expect(existsSync(path.join(binDir, 'pn.cmd'))).toBe(false)
+    })
+  })
+
+  describe('self-update bin directory (pnpm shim in same dir)', () => {
+    it('creates aliases using pnpm shim in the same directory on unix', async () => {
+      // self-update creates a pnpm shim in $PNPM_HOME/bin/ — no package dir
+      await writeFile(path.join(binDir, 'pnpm'), '#!/bin/sh\nexec /path/to/real/pnpm "$@"\n', { mode: 0o755 })
+
+      await ensureAliasLinks(binDir, true, 'linux')
+
+      const pnTarget = await readlink(path.join(binDir, 'pn'))
+      expect(pnTarget).toBe('pnpm')
+
+      const pnxContent = await readFile(path.join(binDir, 'pnx'), 'utf8')
+      expect(pnxContent).toContain('pnpm')
+      expect(pnxContent).toContain('dlx')
+    })
+
+    it('creates .cmd shims using pnpm in same dir on windows', async () => {
+      await writeFile(path.join(binDir, 'pnpm'), 'pnpm binary')
+
+      await ensureAliasLinks(binDir, true, 'win32')
+
+      const cmdContent = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
+      expect(cmdContent).toContain('pnpm')
+    })
+  })
+
+  describe('overwrites existing broken shims', () => {
+    it('replaces npm broken shim with symlink on unix', async () => {
+      await setupStandaloneFixture(binDir)
+      // Simulate npm's broken shim pointing to .tools/ placeholder
+      await writeFile(path.join(binDir, 'pn'), '#!/bin/sh\nexec .tools/broken "$@"\n')
+
+      await ensureAliasLinks(binDir, true, 'linux')
+
+      const target = await readlink(path.join(binDir, 'pn'))
+      expect(target).toBe(path.join('..', '@pnpm', 'exe', 'pnpm'))
+    })
+
+    it('replaces existing .cmd shims on windows', async () => {
+      await setupStandaloneFixture(binDir)
+      await writeFile(path.join(binDir, 'pn.cmd'), 'broken shim')
+
+      await ensureAliasLinks(binDir, true, 'win32')
+
+      const content = await readFile(path.join(binDir, 'pn.cmd'), 'utf8')
+      expect(content).toContain('pnpm')
+    })
+  })
+})

src/install-pnpm/ensureAliasLinks.ts

@@ -0,0 +1,84 @@
+import { unlink, writeFile, symlink } from 'fs/promises'
+import { existsSync } from 'fs'
+import path from 'path'
+
+function shScript (command: string): string {
+  return `#!/bin/sh\nexec ${command} "$@"\n`
+}
+
+function cmdShim (command: string): string {
+  return `@ECHO off\r\n${command} %*\r\n`
+}
+
+function pwshShim (command: string): string {
+  return `#!/usr/bin/env pwsh\n${command} @args\n`
+}
+
+async function forceSymlink (target: string, linkPath: string): Promise<void> {
+  try { await unlink(linkPath) } catch {}
+  await symlink(target, linkPath)
+}
+
+async function forceWriteFile (filePath: string, content: string, mode?: number): Promise<void> {
+  try { await unlink(filePath) } catch {}
+  await writeFile(filePath, content, { mode })
+}
+
+/**
+ * Find the pnpm binary/shim relative to binDir.
+ * Checks the package directory first (node_modules/.bin/../@pnpm/exe/pnpm),
+ * then falls back to a pnpm shim in binDir itself (e.g. self-update's bin/).
+ */
+function findPnpmTarget (binDir: string, standalone: boolean): string | undefined {
+  const packageTarget = standalone
+    ? path.join('..', '@pnpm', 'exe', 'pnpm')
+    : path.join('..', 'pnpm', 'bin', 'pnpm.cjs')
+
+  if (existsSync(path.resolve(binDir, packageTarget))) {
+    return packageTarget
+  }
+
+  // self-update creates a pnpm shim in $PNPM_HOME/bin/ — use it directly
+  if (existsSync(path.join(binDir, 'pnpm'))) {
+    return 'pnpm'
+  }
+
+  return undefined
+}
+
+/**
+ * Create pn/pnpx/pnx alias links in the bin directory.
+ *
+ * pn is an alias for pnpm, so it symlinks (or shims) to the pnpm binary.
+ * pnpx/pnx are aliases for "pnpm dlx", created as shell scripts.
+ *
+ * This does NOT rely on the @pnpm/exe package having pn/pnx files, because
+ * pnpm self-update only replaces the pnpm binary — it doesn't update other
+ * files in the package. The aliases are created by pointing pn directly to
+ * the pnpm binary, and pnpx/pnx as scripts that exec "pnpm dlx".
+ */
+export async function ensureAliasLinks (binDir: string, standalone: boolean, platform: NodeJS.Platform = process.platform): Promise<void> {
+  const isWindows = platform === 'win32'
+
+  const pnpmTarget = findPnpmTarget(binDir, standalone)
+  if (!pnpmTarget) return
+
+  if (isWindows) {
+    // pn → calls pnpm directly
+    await writeFile(path.join(binDir, 'pn.cmd'), cmdShim(`"%~dp0\\${pnpmTarget}"`))
+    await writeFile(path.join(binDir, 'pn.ps1'), pwshShim(`& "$PSScriptRoot\\${pnpmTarget}"`))
+    // pnpx/pnx → calls pnpm dlx
+    for (const name of ['pnpx', 'pnx']) {
+      await writeFile(path.join(binDir, `${name}.cmd`), cmdShim(`"%~dp0\\${pnpmTarget}" dlx`))
+      await writeFile(path.join(binDir, `${name}.ps1`), pwshShim(`& "$PSScriptRoot\\${pnpmTarget}" dlx`))
+    }
+  } else {
+    // pn → symlink to pnpm binary
+    await forceSymlink(pnpmTarget, path.join(binDir, 'pn'))
+    // pnpx/pnx → shell scripts that exec pnpm dlx
+    for (const name of ['pnpx', 'pnx']) {
+      const pnpmPath = `"$(dirname "$0")/${pnpmTarget}"`
+      await forceWriteFile(path.join(binDir, name), shScript(`${pnpmPath} dlx`), 0o755)
+    }
+  }
+}

src/install-pnpm/run.ts

@@ -1,69 +1,93 @@
 import { addPath, exportVariable } from '@actions/core'
 import { spawn } from 'child_process'
-import { rm, writeFile, mkdir, copyFile } from 'fs/promises'
-import { readFileSync } from 'fs'
+import { rm, writeFile, mkdir, symlink } from 'fs/promises'
+import { readFileSync, existsSync } from 'fs'
 import path from 'path'
-import { execPath } from 'process'
 import util from 'util'
 import { Inputs } from '../inputs'
-import YAML from 'yaml'
+import { parse as parseYaml } from 'yaml'
+import pnpmLock from './bootstrap/pnpm-lock.json'
+import exeLock from './bootstrap/exe-lock.json'
+import { ensureAliasLinks } from './ensureAliasLinks'
+
+const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
+const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })
 
 export async function runSelfInstaller(inputs: Inputs): Promise<number> {
   const { version, dest, packageJsonFile, standalone } = inputs
-  const { GITHUB_WORKSPACE } = process.env
 
-  // prepare self install
+  // Install bootstrap pnpm via npm (integrity verified by committed lockfile)
   await rm(dest, { recursive: true, force: true })
-  // create dest directory after removal
   await mkdir(dest, { recursive: true })
-  const pkgJson = path.join(dest, 'package.json')
-  // we have ensured the dest directory exists, we can write the file directly
-  await writeFile(pkgJson, JSON.stringify({ private: true }))
 
-  // copy .npmrc if it exists to install from custom registry
-  if (GITHUB_WORKSPACE) {
-    try {
-      await copyFile(path.join(GITHUB_WORKSPACE, '.npmrc'), path.join(dest, '.npmrc'))
-    } catch (error) {
-      // Swallow error if .npmrc doesn't exist
-      if (!util.types.isNativeError(error) || !('code' in error) || error.code !== 'ENOENT') throw error
-    }
+  const lockfile = standalone ? exeLock : pnpmLock
+  const packageJson = standalone ? BOOTSTRAP_EXE_PACKAGE_JSON : BOOTSTRAP_PNPM_PACKAGE_JSON
+  await writeFile(path.join(dest, 'package.json'), packageJson)
+  await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))
+
+  const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest })
+  if (npmExitCode !== 0) {
+    return npmExitCode
   }
 
-  // prepare target pnpm
-  const target = await readTarget({ version, packageJsonFile, standalone })
-  const cp = spawn(execPath, [path.join(__dirname, 'pnpm.cjs'), 'install', target, '--no-lockfile'], {
-    cwd: dest,
-    stdio: ['pipe', 'inherit', 'inherit'],
-  })
-
-  const exitCode = await new Promise<number>((resolve, reject) => {
-    cp.on('error', reject)
-    cp.on('close', resolve)
-  })
-  if (exitCode === 0) {
-    const pnpmHome = path.join(dest, 'node_modules/.bin')
+  const pnpmHome = path.join(dest, 'node_modules', '.bin')
   addPath(pnpmHome)
+  addPath(path.join(pnpmHome, 'bin'))
   exportVariable('PNPM_HOME', pnpmHome)
+
+  // Ensure pnpm bin link exists — npm ci sometimes doesn't create it
+  const pnpmBinLink = path.join(pnpmHome, 'pnpm')
+  if (!existsSync(pnpmBinLink)) {
+    await mkdir(pnpmHome, { recursive: true })
+    const target = standalone
+      ? path.join('..', '@pnpm', 'exe', 'pnpm')
+      : path.join('..', 'pnpm', 'bin', 'pnpm.cjs')
+    await symlink(target, pnpmBinLink)
   }
+
+  const bootstrapPnpm = standalone
+    ? path.join(dest, 'node_modules', '@pnpm', 'exe', 'pnpm')
+    : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.cjs')
+
+  // Determine the target version
+  const targetVersion = readTargetVersion({ version, packageJsonFile })
+
+  if (targetVersion) {
+    const cmd = standalone ? bootstrapPnpm : process.execPath
+    const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
+    const exitCode = await runCommand(cmd, args, { cwd: dest })
+    if (exitCode !== 0) {
       return exitCode
+    }
+  }
+
+  // Create pn/pnx alias bin links if the installed version supports them
+  // (pnpm v11+ adds pn and pnx as short aliases).
+  // self-update links bins to $PNPM_HOME/bin/ which is also on PATH,
+  // so we must create aliases in both directories.
+  await ensureAliasLinks(pnpmHome, standalone)
+  const pnpmBinDir = path.join(pnpmHome, 'bin')
+  if (existsSync(pnpmBinDir)) {
+    await ensureAliasLinks(pnpmBinDir, standalone)
+  }
+
+  return 0
 }
 
-async function readTarget(opts: {
+function readTargetVersion(opts: {
   readonly version?: string | undefined
   readonly packageJsonFile: string
-  readonly standalone: boolean
-}) {
-  const { version, packageJsonFile, standalone } = opts
+}): string | undefined {
+  const { version, packageJsonFile } = opts
   const { GITHUB_WORKSPACE } = process.env
 
-  let packageManager
+  let packageManager: unknown
 
   if (GITHUB_WORKSPACE) {
     try {
       const content = readFileSync(path.join(GITHUB_WORKSPACE, packageJsonFile), 'utf8');
       ({ packageManager } = packageJsonFile.endsWith(".yaml")
-        ? YAML.parse(content, { merge: true })
+        ? parseYaml(content, { merge: true })
         : JSON.parse(content)
       )
     } catch (error: unknown) {
@@ -84,7 +108,12 @@ async function readTarget(opts: {
 Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_PM_VERSION`)
     }
 
-    return `${ standalone ? '@pnpm/exe' : 'pnpm' }@${version}`
+    return version
+  }
+
+  if (typeof packageManager === 'string' && packageManager.startsWith('pnpm@')) {
+    // Strip the "pnpm@" prefix and any "+sha..." hash suffix
+    return packageManager.replace('pnpm@', '').replace(/\+.*$/, '')
   }
 
   if (!GITHUB_WORKSPACE) {
@@ -94,22 +123,22 @@ please run the actions/checkout before pnpm/action-setup.
 Otherwise, please specify the pnpm version in the action configuration.`)
   }
 
-  if (typeof packageManager !== 'string') {
   throw new Error(`No pnpm version is specified.
 Please specify it by one of the following ways:
   - in the GitHub Action config with the key "version"
   - in the package.json with the key "packageManager"`)
-  }
+}
 
-  if (!packageManager.startsWith('pnpm@')) {
-    throw new Error('Invalid packageManager field in package.json')
-  }
-
-  if (standalone) {
-    return packageManager.replace('pnpm@', '@pnpm/exe@')
-  }
-
-  return packageManager
+function runCommand(cmd: string, args: string[], opts: { cwd: string }): Promise<number> {
+  return new Promise<number>((resolve, reject) => {
+    const cp = spawn(cmd, args, {
+      cwd: opts.cwd,
+      stdio: ['pipe', 'inherit', 'inherit'],
+      shell: process.platform === 'win32',
+    })
+    cp.on('error', reject)
+    cp.on('close', resolve)
+  })
 }
 
 export default runSelfInstaller

src/utils/index.ts

@@ -6,5 +6,5 @@ export const getBinDest = (inputs: Inputs): string => path.join(inputs.dest, 'no
 
 export const patchPnpmEnv = (inputs: Inputs): NodeJS.ProcessEnv => ({
   ...process.env,
-  PATH: getBinDest(inputs) + path.delimiter + process.env.PATH,
+  PATH: path.join(getBinDest(inputs), 'bin') + path.delimiter + getBinDest(inputs) + path.delimiter + process.env.PATH,
 })

tsconfig.json

@@ -1,26 +1,19 @@
-
 {
   "compilerOptions": {
     "target": "ES2022",
-    "module": "Node16",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "lib": [
       "ES2023"
     ],
-    "outDir": "./dist/tsc",
-    "preserveConstEnums": true,
-    "incremental": false,
-    "declaration": true,
-    "sourceMap": true,
-    "importHelpers": false,
+    "noEmit": true,
     "strict": true,
     "pretty": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noImplicitReturns": true,
     "noFallthroughCasesInSwitch": true,
-    "esModuleInterop": true,
-    "experimentalDecorators": true,
-    "emitDecoratorMetadata": true
+    "esModuleInterop": true
   }
 }