test: update pnpm to v9

README.md

@@ -40,11 +40,11 @@ If `run_install` is a YAML string representation of either an object or an array
 
 #### `run_install.args`
 
-**Optional** (_type:_ `string[]`) Additional arguments after `pnpm [recursive] install`, e.g. `[--ignore-scripts, --strict-peer-dependencies]`.
+**Optional** (_type:_ `string[]`) Additional arguments after `pnpm [recursive] install`, e.g. `[--frozen-lockfile, --strict-peer-dependencies]`.
 
 ### `package_json_file`
 
-**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json`/[`package.yaml`/`package.json5`](https://github.com/pnpm/pnpm/pull/1799) to read "packageManager" configuration.
+**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json` to read "packageManager" configuration.
 
 ### `standalone`
 
@@ -119,7 +119,7 @@ jobs:
           version: 10
           run_install: |
             - recursive: true
-              args: [--strict-peer-dependencies]
+              args: [--frozen-lockfile, --strict-peer-dependencies]
             - args: [--global, gulp, prettier, typescript]
 ```
 

action.yml

@@ -16,7 +16,7 @@ inputs:
     required: false
     default: 'null'
   package_json_file:
-    description: File path to the package.json to read "packageManager" configuration. This path must be relative to the repository root (GITHUB_WORKSPACE).
+    description: File path to the package.json to read "packageManager" configuration
     required: false
     default: 'package.json'
   standalone:

package.json

@@ -10,8 +10,8 @@
     "@actions/core": "^1.10.1",
     "@types/expand-tilde": "^2.0.2",
     "@types/node": "^20.11.5",
+    "@types/node-fetch": "^2.6.11",
     "expand-tilde": "^2.0.2",
-    "json5": "^2.2.3",
     "yaml": "^2.3.4",
     "zod": "^3.22.4"
   },

pnpm-lock.yaml

@@ -17,12 +17,12 @@ importers:
       '@types/node':
         specifier: ^20.11.5
         version: 20.17.17
+      '@types/node-fetch':
+        specifier: ^2.6.11
+        version: 2.6.12
       expand-tilde:
         specifier: ^2.0.2
         version: 2.0.2
-      json5:
-        specifier: ^2.2.3
-        version: 2.2.3
       yaml:
         specifier: ^2.3.4
         version: 2.7.0
@@ -57,6 +57,9 @@ packages:
   '@types/expand-tilde@2.0.2':
     resolution: {integrity: sha512-wlsMYiapmIR4Eq/Z0qysN8xaDMjSkO6AIDNFx9oxgWGeKVA1jU+NzwPRZErBNP5z6/dx6QNkNpKglBGPO9OkTA==}
 
+  '@types/node-fetch@2.6.12':
+    resolution: {integrity: sha512-8nneRWKCg3rMtF69nLQJnOYUcbafYeFSjqkw3jCRLsqkWFlHaoQrr5mXmofFGOx3DKn7UfmBMyov8ySvLRVldA==}
+
   '@types/node@20.17.17':
     resolution: {integrity: sha512-/WndGO4kIfMicEQLTi/mDANUu/iVUhT7KboZPdEqqHQ4aTS+3qT3U5gIqWDFV+XouorjfgGqvKILJeHhuQgFYg==}
 
@@ -64,18 +67,36 @@ packages:
     resolution: {integrity: sha512-rnK6hJBS6mwc+Bkab+PGPs9OiS0i/3kdTO+CkI8V0/VrW3vmz7O2Pxjw/owOlmo6PKEIxRSeZKv/kuL9itnpYA==}
     hasBin: true
 
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
   expand-tilde@2.0.2:
     resolution: {integrity: sha512-A5EmesHW6rfnZ9ysHQjPdJRni0SRar0tjtG5MNtm9n5TUvsYU8oozprtRD4AqHxcZWWlVuAmQo2nWKfN9oyjTw==}
     engines: {node: '>=0.10.0'}
 
+  form-data@4.0.1:
+    resolution: {integrity: sha512-tzN8e4TX8+kkxGPK8D5u0FNmjPUjw3lwC9lSLxxoB/+GtsJG91CO8bSWy73APlgAZzZbXEYZJuxjkHH2w+Ezhw==}
+    engines: {node: '>= 6'}
+
   homedir-polyfill@1.0.3:
     resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==}
     engines: {node: '>=0.10.0'}
 
-  json5@2.2.3:
+  mime-db@1.52.0:
-    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
-    engines: {node: '>=6'}
+    engines: {node: '>= 0.6'}
-    hasBin: true
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
 
   parse-passwd@1.0.0:
     resolution: {integrity: sha512-1Y1A//QUXEZK7YKz+rD9WydcE1+EuPr6ZBgKecAB8tmoW6UFv0NREVJe1p+jRxtThkcbbKkfwIbWJe/IeE6m2Q==}
@@ -125,21 +146,44 @@ snapshots:
 
   '@types/expand-tilde@2.0.2': {}
 
+  '@types/node-fetch@2.6.12':
+    dependencies:
+      '@types/node': 20.17.17
+      form-data: 4.0.1
+
   '@types/node@20.17.17':
     dependencies:
       undici-types: 6.19.8
 
   '@vercel/ncc@0.38.3': {}
 
+  asynckit@0.4.0: {}
+
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
+  delayed-stream@1.0.0: {}
+
   expand-tilde@2.0.2:
     dependencies:
       homedir-polyfill: 1.0.3
 
+  form-data@4.0.1:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      mime-types: 2.1.35
+
   homedir-polyfill@1.0.3:
     dependencies:
       parse-passwd: 1.0.0
 
-  json5@2.2.3: {}
+  mime-db@1.52.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
 
   parse-passwd@1.0.0: {}
 

src/install-pnpm/run.ts

@@ -1,17 +1,15 @@
 import { addPath, exportVariable } from '@actions/core'
 import { spawn } from 'child_process'
-import { rm, writeFile, mkdir, copyFile } from 'fs/promises'
+import { rm, writeFile, mkdir } from 'fs/promises'
 import { readFileSync } from 'fs'
 import path from 'path'
 import { execPath } from 'process'
 import util from 'util'
 import { Inputs } from '../inputs'
 import YAML from 'yaml'
-import JSON5 from 'json5'
 
 export async function runSelfInstaller(inputs: Inputs): Promise<number> {
   const { version, dest, packageJsonFile, standalone } = inputs
-  const { GITHUB_WORKSPACE } = process.env
 
   // prepare self install
   await rm(dest, { recursive: true, force: true })
@@ -21,16 +19,6 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
   // we have ensured the dest directory exists, we can write the file directly
   await writeFile(pkgJson, JSON.stringify({ private: true }))
 
-  // copy .npmrc if it exists to install from custom registry
-  if (GITHUB_WORKSPACE) {
-    try {
-      await copyFile(path.join(GITHUB_WORKSPACE, '.npmrc'), path.join(dest, '.npmrc'))
-    } catch (error) {
-      // Swallow error if .npmrc doesn't exist
-      if (!util.types.isNativeError(error) || !('code' in error) || error.code !== 'ENOENT') throw error
-    }
-  }
-
   // prepare target pnpm
   const target = await readTarget({ version, packageJsonFile, standalone })
   const cp = spawn(execPath, [path.join(__dirname, 'pnpm.cjs'), 'install', target, '--no-lockfile'], {
@@ -65,8 +53,6 @@ async function readTarget(opts: {
       const content = readFileSync(path.join(GITHUB_WORKSPACE, packageJsonFile), 'utf8');
       ({ packageManager } = packageJsonFile.endsWith(".yaml")
         ? YAML.parse(content, { merge: true })
-        : packageJsonFile.endsWith(".json5")
-        ? JSON5.parse(content)
         : JSON.parse(content)
       )
     } catch (error: unknown) {
@@ -78,7 +64,6 @@ async function readTarget(opts: {
   if (version) {
     if (
       typeof packageManager === 'string' &&
-      packageManager.startsWith('pnpm@') &&
       packageManager.replace('pnpm@', '') !== version
     ) {
       throw new Error(`Multiple versions of pnpm specified: