chore: rebuild bundle after reverting bootstrap pnpm to 11.0.4

test: assert env var directly instead of relying on pnpm runtime behavior
The previous version of this test self-updated to pnpm 10.33.0 and expected pnpm --version to fail under devEngines.onFail=error. But pnpm v10 only reads the packageManager field, not devEngines, so the check never fired and the test failed. Switch the assertion to the contract the af8e203 scope fix actually enforces: when an explicit version: is supplied, pnpm_config_pm_on_fail must not be exported by the action. That's deterministic and pnpm-version-agnostic.
2026-09-05 11:35:20 +02:00 · 2026-05-11 01:49:47 +02:00 · 2026-05-11 01:49:23 +02:00 · 2026-05-11 01:49:23 +02:00 · 2026-05-11 01:49:22 +02:00 · 2026-05-11 01:49:22 +02:00
18 changed files with 319 additions and 716 deletions
@@ -1 +0,0 @@
-* @zkochan
@@ -19,7 +19,7 @@ jobs:
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
        with:
          run_install: true
-          version: 11
+          version: 9

      - name: Update dist/index.js
        run: pnpm run build
@@ -27,12 +27,6 @@ jobs:
          - name: 'ubuntu / v10.33.0'
            os: ubuntu-latest
            version: '10.33.0'
-          - name: 'ubuntu / v11.25.0'
-            os: ubuntu-latest
-            version: '11.25.0'
-          - name: 'ubuntu / v12.3.4'
-            os: ubuntu-latest
-            version: '12.3.4'
          - name: 'ubuntu / v9.15.5 / custom-dest'
            os: ubuntu-latest
            version: '9.15.5'
@@ -40,15 +34,9 @@ jobs:
          - name: 'macos / v9.15.5'
            os: macos-latest
            version: '9.15.5'
-          - name: 'macos / v12.3.4'
-            os: macos-latest
-            version: '12.3.4'
          - name: 'windows / v9.15.5'
            os: windows-latest
            version: '9.15.5'
-          - name: 'windows / v12.3.4'
-            os: windows-latest
-            version: '12.3.4'

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -178,42 +166,26 @@ jobs:
        shell: bash

  standalone:
-    name: 'Native pnpm bootstrap (npm 12)'
+    name: Standalone mode

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-        with:
-          persist-credentials: false

-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: 26
-
-      - name: Use npm 12
-        run: |
-          npm install --global npm@12.0.2
-          test "$(npm --version)" = "12.0.2"
-
-      - id: pnpm
-        name: Run the action
+      - name: Run the action
        uses: ./
        with:
-          version: 12
+          version: 9.15.0
          standalone: true

      - name: 'Test: pnpm works'
-        env:
-          PNPM_DEST: ${{ steps.pnpm.outputs.dest }}
        run: |
          set -e
-          test -x "$PNPM_DEST/node_modules/pnpm/pnpm"
-          test ! -d "$PNPM_DEST/node_modules/@pnpm/exe"
          which pnpm
          actual="$(pnpm --version)"
-          if [ "${actual}" != "12.3.4" ]; then
-            echo "Expected 12.3.4, got ${actual}"
+          if [ "${actual}" != "9.15.0" ]; then
+            echo "Expected 9.15.0, got ${actual}"
            exit 1
          fi
          mkdir /tmp/test-standalone
@@ -222,102 +194,6 @@ jobs:
          pnpm add is-odd
        shell: bash

-  standalone_windows_self_update:
-    # Regression guard for the patchPnpmEnv PATH-shadow bug. When
-    # standalone: true on Windows AND the requested pnpm differs from the
-    # bootstrap, the previous patchPnpmEnv prepended node_modules/.bin to
-    # PATH; that directory contains an npm-created pnpm.cmd shim pointing
-    # at the BOOTSTRAP pnpm, which shadowed the self-updated pnpm at
-    # $PNPM_HOME/bin and caused `pnpm install` inside the action to run
-    # under the bootstrap version. Exercising a newer-pnpm-only flag
-    # (`--no-runtime`, added in 11.1.0) makes the regression assertable:
-    # if the bootstrap (11.0.4) handles the install, it errors with
-    # "Unknown option: 'runtime'".
-    name: 'Standalone Windows self-update (PATH regression)'
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up package.json with a minimal manifest
-        # run_install needs a manifest to install against. Removing the
-        # repo's existing pnpm-lock.yaml avoids frozen-lockfile mismatch.
-        run: |
-          rm -f pnpm-lock.yaml
-          echo '{"name":"sw","private":true,"packageManager":"pnpm@11.1.0"}' > package.json
-        shell: bash
-
-      - name: Run the action
-        uses: ./
-        with:
-          version: 11.1.0
-          standalone: true
-          run_install: |
-            args: ['--no-runtime']
-
-      - name: 'Test: pnpm install completed under the self-updated pnpm'
-        # If the bug recurs, the previous step's run_install will have failed
-        # the job with "Unknown option: 'runtime'", so reaching this step
-        # implies success. Still verify the version on PATH matches request.
-        env:
-          REQUIRED: '11.1.0'
-        run: |
-          set -e
-          actual="$(pnpm --version)"
-          echo "pnpm --version: ${actual}"
-          if [ "${actual}" != "${REQUIRED}" ]; then
-            echo "Expected pnpm ${REQUIRED}, got ${actual}"
-            exit 1
-          fi
-        shell: bash
-
-  cache_store_path:
-    # Regression guard for #233. When package.json pins a pnpm major that
-    # differs from the bootstrap pnpm's major, the bootstrap reports its
-    # own STORE_VERSION from `pnpm store path` (the `store` command skips
-    # pnpm's auto-switch). The user's actual `pnpm install` runs under the
-    # pinned version and writes to a different STORE_VERSION, so the post
-    # step's saveCache then fails with "Path Validation Error". The fix is
-    # to self-update the bootstrap to the pinned version up front.
-    name: 'Cache store path matches install (#233): ${{ matrix.label }}'
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - label: 'packageManager pnpm@10.33.0'
-            manifest: '{"packageManager":"pnpm@10.33.0","dependencies":{"is-odd":"3.0.1"}}'
-          - label: 'devEngines exact pnpm@10.33.0'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"10.33.0"}},"dependencies":{"is-odd":"3.0.1"}}'
-          - label: 'devEngines range >=10 <11'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=10 <11"}},"dependencies":{"is-odd":"3.0.1"}}'
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up package.json
-        run: echo '${{ matrix.manifest }}' > package.json
-        shell: bash
-
-      - id: pnpm
-        uses: ./
-        with:
-          cache: true
-          run_install: |
-            - args: [--no-frozen-lockfile]
-
-      - name: 'Test: store path computed by the action exists on disk'
-        run: |
-          set -e
-          actual="$(pnpm store path --silent)"
-          echo "pnpm store path: ${actual}"
-          if [ ! -d "${actual}" ]; then
-            echo "Expected store path to exist on disk; cache save would fail"
-            exit 1
-          fi
-        shell: bash
-
  run_install:
    name: 'run_install (${{ matrix.run_install.name }})'

@@ -1,62 +1,10 @@
-> [!IMPORTANT]
-> **This action supports pnpm v12 and earlier.**
->
-> For pnpm v11 and newer, [`pnpm/setup`](https://github.com/pnpm/setup) is also available. It downloads pnpm's self-contained release binary (no Node.js or npm required) and can install a JavaScript runtime (Node.js, Bun, or Deno) in the same step, replacing `actions/setup-node` when its feature set fits your workflow.
->
-> You can continue using `pnpm/action-setup` with `actions/setup-node`, including for pnpm v11 and v12. See [Using pnpm/setup instead](#using-pnpmsetup-instead) below if you want a single action to install pnpm and a JavaScript runtime.
->
-> `pnpm/setup` cannot install pnpm v11 on Intel macOS (`darwin-x64`), where no standalone pnpm v11 binary is published. On that platform, run `actions/setup-node` with Node.js 22.13 or newer before `pnpm/action-setup`, or upgrade to pnpm v12.
-
-# Setup pnpm
-
-Install pnpm package manager.
-
 > ## :warning: Upgrade from v2!
 >
 > The v2 version of this action [has stopped working](https://github.com/pnpm/action-setup/issues/135) with newer Node.js versions. Please, upgrade to the latest version to fix any issues.

-## Using pnpm/setup instead
+# Setup pnpm

-[`pnpm/setup`](https://github.com/pnpm/setup) installs pnpm v11+ as a native standalone executable and can install Node.js, Bun, or Deno in the same step, so a typical workflow no longer needs `actions/setup-node` or an explicit `pnpm install` step:
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-
-  # Before:
-  # - uses: pnpm/action-setup@v6
-  #   with:
-  #     version: 10
-  #     cache: true
-  # - uses: actions/setup-node@v4
-  #   with:
-  #     node-version: 22
-  # - run: pnpm install
-
-  # After:
-  - uses: pnpm/setup@v1
-    with:
-      version: 11
-      runtime: node@22
-      cache: true
-```
-
-The `version` input can be omitted only when `packageManager` (or `devEngines.packageManager`) in `package.json` declares pnpm v11 or newer; otherwise keep it explicit, since `pnpm/setup` requires pnpm v11+.
-
-Input and output changes:
-
-| `pnpm/action-setup` | `pnpm/setup` | Notes |
-| ------------------- | ------------ | ----- |
-| `version` | `version` | Must resolve to pnpm v11 or newer. As before, it can be omitted when `packageManager` (or `devEngines.packageManager`) is set in `package.json`. |
-| `dest` | `dest` | Unchanged. |
-| `run_install` | `install` | `pnpm/setup` runs `pnpm install` automatically when a `package.json` is present (`install: true` by default); set `install: false` to skip it. The object/array form (`recursive`, `cwd`, `args`) is not supported — run those commands in separate steps. |
-| `cache` | `cache` | Unchanged. |
-| `cache_dependency_path` | `cache-dependency-path` | Renamed to kebab-case. |
-| `package_json_file` | `package-json-file` | Renamed to kebab-case. |
-| `standalone` | removed | `pnpm/setup` always installs the standalone native executable. |
-| n/a | `runtime` | New: installs Node.js, Bun, or Deno (e.g. `node@22`, `bun@latest`, `deno@2`), or reads `devEngines.runtime` from `package.json`. |
-| n/a | `token` | New: GitHub token for release lookup; defaults to `${{ github.token }}` and rarely needs to be set. |
-| `bin_dest` (output) | `bin-dest` (output) | Renamed to kebab-case. New outputs `runtime-name` and `runtime-version` describe the installed runtime. |
+Install pnpm package manager.

 ## Inputs

@@ -64,7 +12,7 @@ Input and output changes:

 Version of pnpm to install.

-**Optional** when there is a [`packageManager` or `devEngines.packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
+**Optional** when there is a [`packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).

 otherwise, this field is **required** It supports npm versioning scheme, it could be an exact version (such as `10.9.8`), or a version range (such as `10`, `10.x.x`, `10.9.x`, `^10.9.8`, `*`, etc.), or `latest`.

@@ -100,17 +48,17 @@ If `run_install` is a YAML string representation of either an object or an array

 ### `cache_dependency_path`

-**Optional** (_type:_ `string`, _default:_ `pnpm-lock.yaml`) File path to the pnpm lockfile, whose contents hash will be used as a cache key. Accepts multiple paths delimited by newlines.
+**Optional** (_type:_ `string|string[]`, _default:_ `pnpm-lock.yaml`) File path to the pnpm lockfile, which contents hash will be used as a cache key.

 ### `package_json_file`

-**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json`/[`package.yaml`](https://github.com/pnpm/pnpm/pull/1799) to read `packageManager` or `devEngines.packageManager` configuration.
+**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json`/[`package.yaml`](https://github.com/pnpm/pnpm/pull/1799) to read "packageManager" configuration.

 ### `standalone`

-**Optional** (_type:_ `boolean`, _default:_ `false`) For pnpm v11 and earlier, install [@pnpm/exe](https://www.npmjs.com/package/@pnpm/exe), enabling pnpm to run without Node.js.
+**Optional** (_type:_ `boolean`, _default:_ `false`) When set to true, [@pnpm/exe](https://www.npmjs.com/package/@pnpm/exe), which is a Node.js bundled package, will be installed, enabling using `pnpm` without Node.js.

-For pnpm v12, this input has no effect because the plain `pnpm` package already installs a standalone native executable.
+This is useful when you want to use a incompatible pair of Node.js and pnpm.

 ## Outputs

@@ -126,7 +74,7 @@ Location of `pnpm` and `pnpx` command.

 ### Install only pnpm without `packageManager`

-This works when the repo either doesn't have a `package.json` or has a `package.json` but it doesn't specify `packageManager` or `devEngines.packageManager`.
+This works when the repo either doesn't have a `package.json` or has a `package.json` but it doesn't specify `packageManager`.

 ```yaml
 on:
@@ -145,7 +93,7 @@ jobs:

 ###  Install only pnpm with `packageManager`

-Omit `version` input to use the version in the [`packageManager` or `devEngines.packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
+Omit `version` input to use the version in the [`packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).

 ```yaml
 on:
@@ -210,36 +158,9 @@ jobs:

 **Note:** You don't need to run `pnpm store prune` at the end; post-action has already taken care of that.

-### Cache dependencies from multiple lockfiles
-
-```yaml
-on:
-  - push
-  - pull_request
-
-jobs:
-  cache-and-install-multiple:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v6
-        with:
-          version: 10
-          cache: true
-          cache_dependency_path: |
-            one/pnpm-lock.yaml
-            two/pnpm-lock.yaml
-          run_install: |
-            - cwd: one
-            - cwd: two
-```
-
 ## Notes

-This action does not set up Node.js. Use [actions/setup-node](https://github.com/actions/setup-node) yourself. As an alternative for pnpm v11 or newer, [`pnpm/setup`](https://github.com/pnpm/setup) can install pnpm and Node.js in a single step.
+This action does not setup Node.js for you, use [actions/setup-node](https://github.com/actions/setup-node) yourself.

 ## License

@@ -20,7 +20,7 @@ inputs:
    required: false
    default: 'false'
  cache_dependency_path:
-    description: File path to the pnpm lockfile, whose contents hash will be used as a cache key. Accepts multiple paths delimited by newlines.
+    description: File path to the pnpm lockfile, which contents hash will be used as a cache key
    required: false
    default: 'pnpm-lock.yaml'
  package_json_file:
@@ -28,7 +28,7 @@ inputs:
    required: false
    default: 'package.json'
  standalone:
-    description: When set to true for pnpm v11 and earlier, install @pnpm/exe to use pnpm without Node.js. pnpm v12 uses the plain pnpm package's native executable.
+    description: When set to true, @pnpm/exe, which is a Node.js bundled package, will be installed, enabling using pnpm without Node.js.
    required: false
    default: 'false'
 outputs:
@@ -14,12 +14,10 @@
    "@types/expand-tilde": "^2.0.2",
    "@types/node": "^22.0.0",
    "expand-tilde": "^2.0.2",
-    "semver": "^7.8.5",
    "yaml": "^2.3.4",
    "zod": "^3.22.4"
  },
  "devDependencies": {
-    "@types/semver": "^7.8.0",
    "esbuild": "^0.27.4",
    "typescript": "^5.3.3"
  }
@@ -29,9 +29,6 @@ importers:
      expand-tilde:
        specifier: ^2.0.2
        version: 2.0.2
-      semver:
-        specifier: ^7.8.5
-        version: 7.8.5
      yaml:
        specifier: ^2.3.4
        version: 2.7.0
@@ -39,9 +36,6 @@ importers:
        specifier: ^3.22.4
        version: 3.24.1
    devDependencies:
-      '@types/semver':
-        specifier: ^7.8.0
-        version: 7.8.0
      esbuild:
        specifier: ^0.27.4
        version: 0.27.4
@@ -299,9 +293,6 @@ packages:
  '@types/node@22.19.11':
    resolution: {integrity: sha512-BH7YwL6rA93ReqeQS1c4bsPpcfOmJasG+Fkr6Y59q83f9M1WcBRHR2vM+P9eOisYRcN3ujQoiZY8uk5W+1WL8w==}

-  '@types/semver@7.8.0':
-    resolution: {integrity: sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==}
-
  '@typespec/ts-http-runtime@0.3.0':
    resolution: {integrity: sha512-sOx1PKSuFwnIl7z4RN0Ls7N9AQawmR9r66eI5rFCzLDIs8HTIYrIpH9QjYWoX0lkgGrkLxXhi4QnK7MizPRrIg==}
    engines: {node: '>=20.0.0'}
@@ -472,11 +463,6 @@ packages:
    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
    hasBin: true

-  semver@7.8.5:
-    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
-    engines: {node: '>=10'}
-    hasBin: true
-
  strnum@2.1.1:
    resolution: {integrity: sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw==}

@@ -784,8 +770,6 @@ snapshots:
    dependencies:
      undici-types: 6.21.0

-  '@types/semver@7.8.0': {}
-
  '@typespec/ts-http-runtime@0.3.0':
    dependencies:
      http-proxy-agent: 7.0.2
@@ -973,8 +957,6 @@ snapshots:

  semver@6.3.1: {}

-  semver@7.8.5: {}
-
  strnum@2.1.1: {}

  tr46@0.0.3: {}
@@ -1,5 +1,9 @@
 #!/usr/bin/env node

+// Usage: node scripts/update-bootstrap.mjs [version]
+// If version is omitted, fetches the latest next-11 tag from npm.
+// Regenerates the bootstrap lockfiles used by action-setup to install pnpm via npm.
+
 import { execSync } from 'child_process'
 import { mkdtempSync, rmSync, readFileSync, writeFileSync } from 'fs'
 import { join } from 'path'
@@ -7,24 +11,21 @@ import { tmpdir } from 'os'

 const BOOTSTRAP_DIR = new URL('../src/install-pnpm/bootstrap/', import.meta.url).pathname

-const legacyVersion = process.argv[2] || resolveLatestVersion(11)
-const nativeVersion = process.argv[3] || resolveLatestVersion(12)
+const version = process.argv[2] || resolveLatestVersion()

-console.log(`Updating bootstrap lockfiles to pnpm@${legacyVersion} and pnpm@${nativeVersion} ...`)
+console.log(`Updating bootstrap lockfiles to pnpm@${version} ...`)

-generateLock('pnpm-lock.json', { pnpm: legacyVersion }, 'bootstrap-pnpm')
-generateLock('exe-lock.json', { '@pnpm/exe': legacyVersion }, 'bootstrap-exe')
-generateLock('native-lock.json', { pnpm: nativeVersion }, 'bootstrap-native-pnpm')
+generateLock('pnpm-lock.json', { pnpm: version }, 'bootstrap-pnpm')
+generateLock('exe-lock.json', { '@pnpm/exe': version }, 'bootstrap-exe')

 console.log('Done!')

-function resolveLatestVersion(major) {
-  const json = execSync('npm view pnpm dist-tags --json', { encoding: 'utf8' })
-  const parsed = JSON.parse(json)
-  const tags = Array.isArray(parsed) ? parsed[0] : parsed
-  const version = tags[`next-${major}`] || tags[`latest-${major}`]
+function resolveLatestVersion() {
+  const json = execSync('npm view @pnpm/exe dist-tags --json', { encoding: 'utf8' })
+  const tags = JSON.parse(json)
+  const version = tags['next-11'] || tags['latest']
  if (!version) {
-    console.error(`Could not determine latest pnpm v${major} version from npm dist-tags`)
+    console.error('Could not determine latest pnpm version from npm dist-tags')
    process.exit(1)
  }
  return version
@@ -39,8 +40,7 @@ function generateLock(filename, dependencies, name) {
    const parsed = JSON.parse(lock)
    parsed.name = name
    writeFileSync(join(BOOTSTRAP_DIR, filename), JSON.stringify(parsed, null, 2) + '\n')
-    const [packageName, packageVersion] = Object.entries(dependencies)[0]
-    console.log(`  ${filename} -> ${packageName}@${packageVersion}`)
+    console.log(`  ${filename} -> ${Object.values(dependencies)[0]}@${version}`)
  } finally {
    rmSync(tmp, { recursive: true, force: true })
  }
@@ -18,18 +18,9 @@ export async function runRestoreCache(inputs: Inputs) {
  debug(`Primary key is ${primaryKey}`)
  saveState('cache_primary_key', primaryKey)

-  // We don't need to download everything again if only one dependency changed
-  // We can still re-use previous store to cache the rest of the unchanged dependencies
-  const restoreKeys = [
-    `pnpm-cache-${process.env.RUNNER_OS}-${os.arch()}-`
-  ];
+  let cacheKey = await restoreCache([cachePath], primaryKey)

-  let cacheKey = await restoreCache([cachePath], primaryKey, restoreKeys)
-
-  // A restore-key (prefix) match still restores an older store, but "cache-hit"
-  // must only report an exact primary-key match, so dependency installation
-  // is not skipped when the lockfile has changed.
-  setOutput('cache-hit', cacheKey === primaryKey)
+  setOutput('cache-hit', Boolean(cacheKey))

  if (!cacheKey) {
    info(`Cache is not found`)
@@ -8,16 +8,16 @@ import pnpmInstall from './pnpm-install'
 import pruneStore from './pnpm-store-prune'

 async function main() {
+  const inputs = getInputs()
+
  if (getState('is_post') === 'true') {
-    await runPost()
+    await runPost(inputs)
  } else {
-    await runMain()
+    await runMain(inputs)
  }
 }

-async function runMain() {
-  const inputs = getInputs()
-  saveState('inputs', inputs)
+async function runMain(inputs: Inputs) {
  saveState('is_post', 'true')

  const binDest = await installPnpm(inputs)
@@ -30,8 +30,7 @@ async function runMain() {
  pnpmInstall(inputs)
 }

-async function runPost() {
-  const inputs = JSON.parse(getState('inputs')) as Inputs
+async function runPost(inputs: Inputs) {
  pruneStore(inputs)
  await saveCache(inputs)
 }
@@ -5,18 +5,18 @@
  "packages": {
    "": {
      "dependencies": {
-        "@pnpm/exe": "11.25.0"
+        "@pnpm/exe": "11.0.4"
      }
    },
    "node_modules/@pnpm/exe": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.25.0.tgz",
-      "integrity": "sha512-X19R2uC+VAJ4UJQE9c/PCdOXbDaWnZtad7WUrTHBFQuMVaK9MAHbyO/WgahQCuRtTmJkLbxcWKKCk+JeTYFm/g==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.4.tgz",
+      "integrity": "sha512-3OwYqbbj1KtuUqoMo5OEkY8nU/WutZ7L5ADFl0bbW9oyqU55U37aDqA3NJNSk28CyszNARfrjerAF2DW2TsV7w==",
      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
        "@reflink/reflink": "0.1.19",
-        "detect-libc": "^2.1.2"
+        "detect-libc": "^2.0.3"
      },
      "bin": {
        "pn": "pn",
@@ -28,19 +28,20 @@
        "url": "https://opencollective.com/pnpm"
      },
      "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.25.0",
-        "@pnpm/linux-x64": "11.25.0",
-        "@pnpm/linuxstatic-arm64": "11.25.0",
-        "@pnpm/linuxstatic-x64": "11.25.0",
-        "@pnpm/macos-arm64": "11.25.0",
-        "@pnpm/win-arm64": "11.25.0",
-        "@pnpm/win-x64": "11.25.0"
+        "@pnpm/linux-arm64": "11.0.4",
+        "@pnpm/linux-x64": "11.0.4",
+        "@pnpm/linuxstatic-arm64": "11.0.4",
+        "@pnpm/linuxstatic-x64": "11.0.4",
+        "@pnpm/macos-arm64": "11.0.4",
+        "@pnpm/macos-x64": "11.0.4",
+        "@pnpm/win-arm64": "11.0.4",
+        "@pnpm/win-x64": "11.0.4"
      }
    },
    "node_modules/@pnpm/linux-arm64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.25.0.tgz",
-      "integrity": "sha512-ra8akqhzsbcOhKSJ9fFV8H+Oc9uGQAcp/XmIBEdT+8hPPoZCit3+RNCHmg8bLoNvpSLtRvZE0WFCMj7WyzxeBA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.4.tgz",
+      "integrity": "sha512-Bz7V2sFypoGHX/t5w/w7jnCw5DCK3C8s5q8whHJJ3iS5kRznX3Q1F4LwSjjy+lsi777fHyNIvD7qtNmdt9IKoA==",
      "cpu": [
        "arm64"
      ],
@@ -54,9 +55,9 @@
      }
    },
    "node_modules/@pnpm/linux-x64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.25.0.tgz",
-      "integrity": "sha512-pQl/L10diKQCbF73viRrtVU8qVWMTudUCSG1uZ+EWBNKtU9Sbxe6Q378diXDb1uTwSgUVMQoypxlC1MTzh7qvQ==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.4.tgz",
+      "integrity": "sha512-u0Yn1gytR1vKdPk6fYF500H8ZWQlj0cTuIQPp+5GYVPkMmA5bSw41RNIDPBfjDlE8ERmQWaQcrgmTcmTZ+n22A==",
      "cpu": [
        "x64"
      ],
@@ -70,9 +71,9 @@
      }
    },
    "node_modules/@pnpm/linuxstatic-arm64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.25.0.tgz",
-      "integrity": "sha512-cYcrbB/xN1N6/5VUlFuHblb1gNyJgZv1CF5Pk1T0sHJxQMY4DFJV3OqHVAgahxyUfSTaQcVLvH1H2JFvd/+sgw==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.0.4.tgz",
+      "integrity": "sha512-0aitEcfhWNXNZhfJGt/kJaRvfcdtJzXZpV+toJN94kfawSJnhuawfnUSXMi/3m0G97HkJc7BH8rOz3sojUKt0g==",
      "cpu": [
        "arm64"
      ],
@@ -89,9 +90,9 @@
      }
    },
    "node_modules/@pnpm/linuxstatic-x64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.25.0.tgz",
-      "integrity": "sha512-HXDtaeQod16DDMUUcVLIMxvEc1jKn7IYsNPwbwAPs/Je/d3umRPJi3Ejjdn6e9qpXN6Oon+yvSsJr7B9oDt6KA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.0.4.tgz",
+      "integrity": "sha512-xDJdeJ7D2YvDBy2/IH9lEqMKiSuZiV8190XKWOgQgxUGGeuW4z3j6Ewpl0S5bXsWuNjAgC+uCKp7Qp3P7cXAvw==",
      "cpu": [
        "x64"
      ],
@@ -108,9 +109,9 @@
      }
    },
    "node_modules/@pnpm/macos-arm64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.25.0.tgz",
-      "integrity": "sha512-m/eAgEqKhiSexGxWPHNXNnSRI0hudymg6K7LbrU2EoDs9IgJ28OKEz9mGxMzhkYBweEquR4k5teMNes/aToy9w==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.4.tgz",
+      "integrity": "sha512-dNR69jUARtGFuyyLE9VuyxhRUKC8MO/7/xIyAdeIMZAD5ej0Y/Ct0DYCa/FLbgFL1nXaXmp4+gRMfJBkkrKfQQ==",
      "cpu": [
        "arm64"
      ],
@@ -123,10 +124,26 @@
        "url": "https://opencollective.com/pnpm"
      }
    },
+    "node_modules/@pnpm/macos-x64": {
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.4.tgz",
+      "integrity": "sha512-RfyrxSBajeEU16dZsgFjbdagDV9F4HNCJfbBgm8IbGjL0+J95naM/VmCDLd6S3+1tISeI2MxtcyCxqjKJsD/BA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
    "node_modules/@pnpm/win-arm64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.25.0.tgz",
-      "integrity": "sha512-oAeECbtZ+eJziaBmPUkwJM8Dx7KVQ5FO367AXTjD2HGfB5ob1Bcu5hoUF5RBTgDBiP9fRQ1u13uAEpqar/6NLA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.4.tgz",
+      "integrity": "sha512-fOQEv8b9KxZlUAxPPXSQQUUIrt2nY24Qwd4RzCPpatacBnsE4JIadlr/B4V5z2zFxmV7FdHr7nYUhv2RqTlY/w==",
      "cpu": [
        "arm64"
      ],
@@ -140,9 +157,9 @@
      }
    },
    "node_modules/@pnpm/win-x64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.25.0.tgz",
-      "integrity": "sha512-8/n+wCc0a8TRYTMFqti93Vh0cscdJ25xfMyYSDdXrLUh2ccxSFuS+SE7cNPjd/nOXoFAJvdW0kwfbyRPLa16/w==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.4.tgz",
+      "integrity": "sha512-pErHAV8m3NZuPSeCmH3senTSHX0nwkH5lLzQSpiFuyt08hq8sqL3jDymT4ri9N7ixPN9RFZghZIiT3h+Croaew==",
      "cpu": [
        "x64"
      ],
@@ -1,154 +0,0 @@
-{
-  "name": "bootstrap-native-pnpm",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "pnpm": "12.3.4"
-      }
-    },
-    "node_modules/@pnpm/exe.darwin-arm64": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.darwin-arm64/-/exe.darwin-arm64-12.3.4.tgz",
-      "integrity": "sha512-PAyUol8T1+/+ViOiXAt51ECA+QnfXCqz6foL4bW+LsoX0NcVd5XVEM2mRQu+LV4oc7uRz9zf9U0P+XFfuQeDAw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@pnpm/exe.darwin-x64": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.darwin-x64/-/exe.darwin-x64-12.3.4.tgz",
-      "integrity": "sha512-fxP9JCk0Cdye+ePuj+GJJLMUMTqHGWRdb1dtv4How876uQ2ehxvenpgiYAir/ceO9PsYUZkFTtyZdx+rRu5QOA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@pnpm/exe.linux-arm64": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-arm64/-/exe.linux-arm64-12.3.4.tgz",
-      "integrity": "sha512-t71AVA7LRqiKTyZ5xMYaZc2n5DfdpMbfokZuiIOXHBOM03ECnF0t4iYwaBDqJgVjlKYUOwaF/bRQajGNA4cJ4w==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "glibc"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@pnpm/exe.linux-arm64-musl": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-arm64-musl/-/exe.linux-arm64-musl-12.3.4.tgz",
-      "integrity": "sha512-FBOt0/7ye6O6q4AllVV5QMviB6qE6fqkeczV/+MDWQsmo+QJrlfsh6X7CpH/tClVpBZEyIbjpUoT8bNhCYBxEg==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@pnpm/exe.linux-x64": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-x64/-/exe.linux-x64-12.3.4.tgz",
-      "integrity": "sha512-2ZqOlSPkfwX1h5cR+FPiWf8+F+2hZT/3TvhUK5sigHqwaQCIiq8R7CGxhndKs63JtcLi2a1Qpo+wX/EoyfjyJQ==",
-      "cpu": [
-        "x64"
-      ],
-      "libc": [
-        "glibc"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@pnpm/exe.linux-x64-musl": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-x64-musl/-/exe.linux-x64-musl-12.3.4.tgz",
-      "integrity": "sha512-RPmk7Jb/aYaFvL2iyDN/AtMY+hUEsue732WmXpcuQ9tBpMnGyA5py7Z3+e+qmQaJ0zY/4ni9jJiyPBQHujmv6w==",
-      "cpu": [
-        "x64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@pnpm/exe.win32-arm64": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.win32-arm64/-/exe.win32-arm64-12.3.4.tgz",
-      "integrity": "sha512-ANyrHqyqco6SXBysUTRF74itDyyraea7IbFsKFdNXTjcFnfycTDx37EwuhdpPYFNSIh2JhUG4fByclsRfiHX7w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@pnpm/exe.win32-x64": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.win32-x64/-/exe.win32-x64-12.3.4.tgz",
-      "integrity": "sha512-WH/KqBPY/hq2Tb7SgQltEZytimcjgKRaCRL/aM9CI0c67iKc5TVmHUhIiL3Ux9FB4bWn36i6XewUcScQI+zG8w==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/pnpm": {
-      "version": "12.3.4",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-12.3.4.tgz",
-      "integrity": "sha512-lhqkH7B32joEpEHZ+OFevAyW2o73ELLrZ7+e58sGEOq9SPH9hfUc/+c4RnhfoPh8VqOocqHYk/hEZ0G1zORUVw==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "pn": "pn",
-        "pnpm": "pnpm",
-        "pnpx": "pnpx",
-        "pnx": "pnx"
-      },
-      "engines": {
-        "node": ">=18.*"
-      },
-      "optionalDependencies": {
-        "@pnpm/exe.darwin-arm64": "12.3.4",
-        "@pnpm/exe.darwin-x64": "12.3.4",
-        "@pnpm/exe.linux-arm64": "12.3.4",
-        "@pnpm/exe.linux-arm64-musl": "12.3.4",
-        "@pnpm/exe.linux-x64": "12.3.4",
-        "@pnpm/exe.linux-x64-musl": "12.3.4",
-        "@pnpm/exe.win32-arm64": "12.3.4",
-        "@pnpm/exe.win32-x64": "12.3.4"
-      }
-    }
-  }
-}
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "pnpm": "11.25.0"
+        "pnpm": "11.0.4"
      }
    },
    "node_modules/pnpm": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.25.0.tgz",
-      "integrity": "sha512-XN6SW08HX3Jetx+64YpC/+eEUkeJ8ZthxzHLhyHsKKruFg4BqNWvT+2ypCzb8wDv4j2zVrDUoXtNY+EfirfJVg==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.4.tgz",
+      "integrity": "sha512-CjlxZQB6AU7VKRmmHl9GxIubyohATDA+yuzGP2Le9WOJjTxril1epYEes5jP4DqwXaGlzpY/Em1erUwC+TuDww==",
      "license": "MIT",
      "bin": {
        "pn": "bin/pnpm.mjs",
@@ -6,28 +6,11 @@ import path from 'path'
 import util from 'util'
 import { Inputs } from '../inputs'
 import { parse as parseYaml } from 'yaml'
-import { satisfies, subset, validRange } from 'semver'
 import pnpmLock from './bootstrap/pnpm-lock.json'
 import exeLock from './bootstrap/exe-lock.json'
-import nativeLock from './bootstrap/native-lock.json'

-const bootstrapPnpmVersion = pnpmLock.packages['node_modules/pnpm'].version
-const bootstrapExeVersion = exeLock.packages['node_modules/@pnpm/exe'].version
-const bootstrapNativeVersion = nativeLock.packages['node_modules/pnpm'].version
-const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({
-  private: true,
-  dependencies: { pnpm: bootstrapPnpmVersion },
-})
-const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({
-  private: true,
-  dependencies: { '@pnpm/exe': bootstrapExeVersion },
-  allowScripts: { [`@pnpm/exe@${bootstrapExeVersion}`]: true },
-})
-const BOOTSTRAP_NATIVE_PACKAGE_JSON = JSON.stringify({
-  private: true,
-  dependencies: { pnpm: bootstrapNativeVersion },
-  allowScripts: { [`pnpm@${bootstrapNativeVersion}`]: true },
-})
+const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
+const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })

 export interface SelfInstallerResult {
  exitCode: number
@@ -36,20 +19,18 @@ export interface SelfInstallerResult {

 export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerResult> {
  const { version, dest, packageJsonFile } = inputs
-  const targetVersion = readTargetVersion({ version, packageJsonFile })
-  const native = targetsPnpm12(targetVersion)
-  let standalone = false
-  if (!native) {
-    const systemNode = await getSystemNodeVersion()
-    standalone = inputs.standalone || systemNode.major < 22 || (systemNode.major === 22 && systemNode.minor < 13)
-  }
+
+  // pnpm v11 requires Node >= 22.13; use standalone (exe) bootstrap which
+  // bundles its own Node.js when the system Node is too old
+  const systemNode = await getSystemNodeVersion()
+  const standalone = inputs.standalone || systemNode.major < 22 || (systemNode.major === 22 && systemNode.minor < 13)

  // Install bootstrap pnpm via npm (integrity verified by committed lockfile)
  await rm(dest, { recursive: true, force: true })
  await mkdir(dest, { recursive: true })

-  const lockfile = native ? nativeLock : standalone ? exeLock : pnpmLock
-  const packageJson = native ? BOOTSTRAP_NATIVE_PACKAGE_JSON : standalone ? BOOTSTRAP_EXE_PACKAGE_JSON : BOOTSTRAP_PNPM_PACKAGE_JSON
+  const lockfile = standalone ? exeLock : pnpmLock
+  const packageJson = standalone ? BOOTSTRAP_EXE_PACKAGE_JSON : BOOTSTRAP_PNPM_PACKAGE_JSON
  await writeFile(path.join(dest, 'package.json'), packageJson)
  await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))

@@ -72,6 +53,9 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
    return { exitCode: npmExitCode, binDest: path.join(dest, 'node_modules', '.bin') }
  }

+  // On Windows with standalone mode, npm's .bin shims can't properly
+  // execute the extensionless @pnpm/exe native binaries. Add the
+  // @pnpm/exe directory directly to PATH so pnpm.exe is found natively.
  const pnpmHome = standalone && process.platform === 'win32'
    ? path.join(dest, 'node_modules', '@pnpm', 'exe')
    : path.join(dest, 'node_modules', '.bin')
@@ -89,48 +73,48 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
    const pnpmBinLink = path.join(dest, 'node_modules', '.bin', 'pnpm')
    if (!existsSync(pnpmBinLink)) {
      await mkdir(path.join(dest, 'node_modules', '.bin'), { recursive: true })
-      const target = native
-        ? path.join('..', 'pnpm', 'pnpm')
-        : standalone
-          ? path.join('..', '@pnpm', 'exe', 'pnpm')
-          : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
+      const target = standalone
+        ? path.join('..', '@pnpm', 'exe', 'pnpm')
+        : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
      await symlink(target, pnpmBinLink)
    }
  }

-  const bootstrapPnpm = native
-    ? path.join(dest, 'node_modules', 'pnpm', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
-    : standalone
-      ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
-      : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
-  const bootstrapVersion = native ? bootstrapNativeVersion : standalone ? bootstrapExeVersion : bootstrapPnpmVersion
+  const bootstrapPnpm = standalone
+    ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
+    : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')

-  if (targetVersion === bootstrapVersion || (native && satisfies(bootstrapVersion, targetVersion))) {
-    return { exitCode: 0, binDest: pnpmHome }
+  // Determine the target version
+  const targetVersion = readTargetVersion({ version, packageJsonFile })
+
+  if (targetVersion) {
+    const cmd = standalone ? bootstrapPnpm : process.execPath
+    const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
+    const exitCode = await runCommand(cmd, args, { cwd: dest })
+    if (exitCode !== 0) {
+      return { exitCode, binDest: pnpmHome }
+    }
+    // self-update writes the target pnpm/pnpx into PNPM_HOME/bin, leaving
+    // the bootstrap symlinks in pnpmHome pointing at the old version. Use
+    // PNPM_HOME/bin so consumers of the bin_dest output (e.g.
+    // `${steps.pnpm.outputs.bin_dest}/pnpm`) invoke the requested version.
+    return { exitCode: 0, binDest: path.join(pnpmHome, 'bin') }
  }

-  const cmd = native || standalone ? bootstrapPnpm : process.execPath
-  const args = native || standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
-  const exitCode = await runCommand(cmd, args, { cwd: dest })
-  if (exitCode !== 0) {
-    return { exitCode, binDest: pnpmHome }
-  }
-  // self-update writes the target pnpm/pnpx into PNPM_HOME/bin, leaving
-  // the bootstrap symlinks in pnpmHome pointing at the old version. Use
-  // PNPM_HOME/bin so consumers of the bin_dest output (e.g.
-  // `${steps.pnpm.outputs.bin_dest}/pnpm`) invoke the requested version.
-  //
-  // When the requested version resolves to the bootstrap version, self-update
-  // is a no-op and PNPM_HOME/bin is not created — fall back to pnpmHome,
-  // whose symlinks already point at the right version.
-  const updatedBinDir = path.join(pnpmHome, 'bin')
-  return { exitCode: 0, binDest: existsSync(updatedBinDir) ? updatedBinDir : pnpmHome }
+  // No explicit target version: rely on the bootstrap pnpm to switch to
+  // the version declared in packageManager/devEngines at runtime. Force
+  // `pmOnFail=download` so a project that pins
+  // `devEngines.packageManager.onFail = "error"` doesn't trip BAD_PM_VERSION
+  // before the switch can happen (issue #252). Scoped to this branch so users
+  // who pass an explicit `version:` input keep strict onFail behavior.
+  exportVariable('pnpm_config_pm_on_fail', 'download')
+  return { exitCode: 0, binDest: pnpmHome }
 }

 function readTargetVersion(opts: {
  readonly version?: string | undefined
  readonly packageJsonFile: string
-}): string {
+}): string | undefined {
  const { version, packageJsonFile } = opts
  const { GITHUB_WORKSPACE } = process.env

@@ -151,15 +135,12 @@ function readTargetVersion(opts: {
    }
  }

-  // packageManager is always exact `pnpm@<version>[+<integrity>]` per spec.
-  // Strip the integrity hash for self-update.
-  const packageManagerVersion =
-    typeof packageManager === 'string' && packageManager.startsWith('pnpm@')
-      ? packageManager.slice('pnpm@'.length).split('+')[0]
-      : undefined
-
  if (version) {
-    if (packageManagerVersion && packageManagerVersion !== version) {
+    if (
+      typeof packageManager === 'string' &&
+      packageManager.startsWith('pnpm@') &&
+      packageManager.replace('pnpm@', '') !== version
+    ) {
      throw new Error(`Multiple versions of pnpm specified:
  - version ${version} in the GitHub Action config with the key "version"
  - version ${packageManager} in the package.json with the key "packageManager"
@@ -169,22 +150,13 @@ Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_
    return version
  }

-  // Self-update the bootstrap pnpm to the version pinned in package.json so
-  // PATH-resolved `pnpm` (and the bin_dest output) reflect the target
-  // version. Without this, `pnpm store path` runs as the bootstrap and
-  // reports a different STORE_VERSION than the one the user's actual
-  // install writes to — breaking cache: true and actions/setup-node's
-  // `cache: pnpm` on cold caches (issue #233).
-  //
-  // devEngines.packageManager takes priority over packageManager, matching
-  // pnpm's getWantedPackageManager logic. `pnpm self-update` accepts both
-  // exact versions and semver ranges, so we pass either through directly.
-  if (devEngines?.packageManager?.name === 'pnpm' && devEngines.packageManager.version) {
-    return devEngines.packageManager.version
+  // pnpm will automatically download and switch to the right version
+  if (typeof packageManager === 'string' && packageManager.startsWith('pnpm@')) {
+    return undefined
  }

-  if (packageManagerVersion) {
-    return packageManagerVersion
+  if (devEngines?.packageManager?.name === 'pnpm' && devEngines.packageManager.version) {
+    return undefined
  }

  if (!GITHUB_WORKSPACE) {
@@ -201,12 +173,6 @@ Please specify it by one of the following ways:
  - in the package.json with the key "devEngines.packageManager"`)
 }

-function targetsPnpm12(version: string): boolean {
-  if (version === 'latest-12' || version === 'next-12') return true
-  const range = validRange(version)
-  return range !== null && subset(range, '>=12.0.0 <13.0.0')
-}
-
 function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
  return new Promise((resolve) => {
    const cp = spawn('node', ['--version'], { stdio: ['pipe', 'pipe', 'pipe'], shell: process.platform === 'win32' })
@@ -1,8 +1,11 @@
 import { setFailed, startGroup, endGroup } from '@actions/core'
 import { spawnSync } from 'child_process'
 import { Inputs } from '../inputs'
+import { patchPnpmEnv } from '../utils'

 export function runPnpmInstall(inputs: Inputs) {
+  const env = patchPnpmEnv(inputs)
+
  for (const options of inputs.runInstall) {
    const args = ['install']
    if (options.recursive) args.unshift('recursive')
@@ -11,16 +14,11 @@ export function runPnpmInstall(inputs: Inputs) {
    const cmdStr = ['pnpm', ...args].join(' ')
    startGroup(`Running ${cmdStr}...`)

-    // spawnSync inherits process.env, which already has $PNPM_HOME/bin and
-    // $PNPM_HOME prepended via addPath() in install-pnpm. Do NOT pass a
-    // hand-patched env that adds node_modules/.bin to the front — on
-    // Windows standalone, .bin/pnpm.cmd is an npm shim pointing at the
-    // BOOTSTRAP pnpm, which would shadow the self-updated one and break
-    // newer-pnpm-only behavior.
    const { error, status } = spawnSync('pnpm', args, {
      stdio: 'inherit',
      cwd: options.cwd,
      shell: true,
+      env,
    })

    endGroup()
@@ -1,6 +1,7 @@
 import { warning, startGroup, endGroup } from '@actions/core'
 import { spawnSync } from 'child_process'
 import { Inputs } from '../inputs'
+import { patchPnpmEnv } from '../utils'

 export function pruneStore(inputs: Inputs) {
  if (inputs.runInstall.length === 0) {
@@ -9,11 +10,10 @@ export function pruneStore(inputs: Inputs) {
  }

  startGroup('Running pnpm store prune...')
-  // spawnSync inherits process.env (which has the right PATH from addPath
-  // in install-pnpm). See pnpm-install/index.ts for the rationale.
  const { error, status } = spawnSync('pnpm', ['store', 'prune'], {
    stdio: 'inherit',
    shell: true,
+    env: patchPnpmEnv(inputs),
  })
  endGroup()

@@ -0,0 +1,10 @@
+import path from 'path'
+import process from 'process'
+import { Inputs } from '../inputs'
+
+export const getBinDest = (inputs: Inputs): string => path.join(inputs.dest, 'node_modules', '.bin')
+
+export const patchPnpmEnv = (inputs: Inputs): NodeJS.ProcessEnv => ({
+  ...process.env,
+  PATH: path.join(getBinDest(inputs), 'bin') + path.delimiter + getBinDest(inputs) + path.delimiter + process.env.PATH,
+})
Author	SHA1	Message	Date
Zoltan Kochan	b635341b3e	chore: rebuild bundle after reverting bootstrap pnpm to 11.0.4	2026-05-11 01:49:47 +02:00
Zoltan Kochan	025de3876f	test: assert env var directly instead of relying on pnpm runtime behavior The previous version of this test self-updated to pnpm 10.33.0 and expected pnpm --version to fail under devEngines.onFail=error. But pnpm v10 only reads the packageManager field, not devEngines, so the check never fired and the test failed. Switch the assertion to the contract the af8e203 scope fix actually enforces: when an explicit version: is supplied, pnpm_config_pm_on_fail must not be exported by the action. That's deterministic and pnpm-version-agnostic.	2026-05-11 01:49:23 +02:00
Zoltan Kochan	5c388c2b3b	test: assert onFail=error stays strict when explicit version is supplied Adds a manifest_pin matrix entry combining `version: 10.33.0` with `devEngines.packageManager` pinned to 9.15.5/onFail=error. The action self-updates to 10.33.0, then `pnpm --version` must fail with BAD_PM_VERSION — confirming pnpm_config_pm_on_fail=download is scoped to the no-target-version branch and does not silently override the user's strict policy.	2026-05-11 01:49:23 +02:00
Zoltan Kochan	84fa52c3d7	ci: consolidate test matrix and stop double-firing on PRs - Limit push trigger to master so PRs run jobs once instead of twice. - Fold test_default_inputs / test_dest / test_version_respects_request / test_bin_dest_output into one cross-OS `smoke` job (5 matrix entries: ubuntu × 2 versions + ubuntu custom-dest + macos + windows). - Fold test_package_manager_field / test_dev_engines / test_dev_engines_on_fail_error into one ubuntu-only `manifest_pin` job (6 matrix entries) — manifest handling is OS-independent. - Keep standalone and run_install but ubuntu-only. Total runs per PR push: ~88 → 14.	2026-05-11 01:49:22 +02:00
Zoltan Kochan	07ad39cba4	refactor: scope pm_on_fail override to the no-target-version branch Only export `pnpm_config_pm_on_fail=download` when the action is relying on bootstrap pnpm's runtime switch. When the user passes an explicit `version:` input, self-update aligns the binary and we should not silently override their `devEngines.packageManager.onFail = "error"` policy.	2026-05-11 01:49:22 +02:00
Zoltan Kochan	052c4ffb7d	fix: honor devEngines.packageManager.onFail=error (#252 ) Export pnpm_config_pm_on_fail=download so the bootstrap pnpm switches to the version pinned in devEngines.packageManager instead of throwing BAD_PM_VERSION on the user's first invocation.	2026-05-11 01:49:22 +02:00