fix: drop patchPnpmEnv so standalone+self-update works on Windows

`patchPnpmEnv` prepended `dest/node_modules/.bin` to PATH before spawning `pnpm install` / `pnpm store prune`. On Windows in standalone mode, `.bin/pnpm.cmd` is an npm-created shim that always points at the BOOTSTRAP pnpm (currently 11.0.4) — the binary npm linked when it installed `@pnpm/exe` into `node_modules`. The self-updated pnpm written by `pnpm self-update` lives at `$PNPM_HOME/bin`, which is separately added to PATH via `addPath()` in install-pnpm. When the user requested a pnpm version different from the bootstrap under `standalone: true` on Windows, patchPnpmEnv's `.bin` entry shadowed the self-updated `$PNPM_HOME/bin` and the action's internal `pnpm install` ran on the bootstrap. On a pnpm 11.0.x bootstrap this broke any 11.1+ install flag (e.g. `--no-runtime`), reporting: ERROR Unknown option: 'runtime' POSIX standalone got lucky because `.bin` and `$PNPM_HOME` resolve to the same directory there. Non-standalone never tripped on this since the `.bin/pnpm` symlink for a regular `pnpm` package keeps working across self-updates. Removed `patchPnpmEnv` and the now-empty `src/utils/` module. `spawnSync` now inherits `process.env`, whose PATH is already correctly fronted by `$PNPM_HOME/bin` and `$PNPM_HOME` via the `addPath` calls in install-pnpm. Added `standalone_windows_self_update` to test.yaml as a regression guard: standalone on Windows + target 11.1.0 + `run_install` with `--no-runtime`. With the previous code, the install would have run under the bootstrap (11.0.4) and errored on the unknown flag. Originally found while building pnpm/setup (the new combined pnpm + runtime action).
2026-08-28 21:23:45 +08:00 · 2026-05-11 21:19:59 +02:00
11 changed files with 218 additions and 464 deletions
--- a/.github/workflows/pr-check.yaml
+++ b/.github/workflows/pr-check.yaml
@@ -19,7 +19,7 @@ jobs:
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
        with:
          run_install: true
-          version: 11
+          version: 9

      - name: Update dist/index.js
        run: pnpm run build
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -329,51 +329,3 @@ jobs:
            exit 1
          fi
        shell: bash
-
-  cache_lockfile_verification:
-    # The action caches pnpm's lockfile verification log, which lives in
-    # `cacheDir` — a directory pnpm resolves per platform and does not print.
-    # Guard the action's copy of that default against pnpm's own.
-    name: 'Lockfile verification cache (${{ matrix.os }})'
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up a project with a supply-chain policy
-        # A one-minute floor activates the verification without holding back
-        # any version the install resolves.
-        run: |
-          echo '{"dependencies":{"is-odd":"3.0.1"}}' > package.json
-          printf 'packages:\n  - .\nminimumReleaseAge: 1\n' > pnpm-workspace.yaml
-        shell: bash
-
-      - uses: ./
-        with:
-          version: '12.0.0-rc.4'
-          cache: true
-          run_install: |
-            - args: [--no-frozen-lockfile]
-
-      - name: 'Test: pnpm wrote the verification log where the action looks for it'
-        run: |
-          set -e
-          case "$RUNNER_OS" in
-            Linux) cacheDir="${XDG_CACHE_HOME:-$HOME/.cache}/pnpm" ;;
-            macOS) cacheDir="$HOME/Library/Caches/pnpm" ;;
-            Windows) cacheDir="$(cygpath -u "$LOCALAPPDATA")/pnpm-cache" ;;
-            *) echo "Unexpected RUNNER_OS: $RUNNER_OS"; exit 1 ;;
-          esac
-          echo "Expecting the verification log in ${cacheDir}"
-          if [ ! -f "${cacheDir}/lockfile-verified.jsonl" ]; then
-            echo "No lockfile-verified.jsonl there; the action would cache nothing"
-            ls -la "${cacheDir}" || true
-            exit 1
-          fi
-        shell: bash
--- a/README.md
+++ b/README.md
@@ -1,60 +1,10 @@
-> [!IMPORTANT]
-> **This action has a successor: [`pnpm/setup`](https://github.com/pnpm/setup).**
->
-> For pnpm v11 and newer, use [`pnpm/setup`](https://github.com/pnpm/setup) instead. It downloads pnpm's self-contained release binary (no Node.js or npm required) and can install a JavaScript runtime (Node.js, Bun, or Deno) in the same step, replacing `actions/setup-node`.
->
-> `pnpm/action-setup` remains the action to use for installing pnpm v10 and older. See [Migrating to pnpm/setup](#migrating-to-pnpmsetup) below.
-
-# Setup pnpm
-
-Install pnpm package manager.
-
 > ## :warning: Upgrade from v2!
 >
 > The v2 version of this action [has stopped working](https://github.com/pnpm/action-setup/issues/135) with newer Node.js versions. Please, upgrade to the latest version to fix any issues.

-## Migrating to pnpm/setup
+# Setup pnpm

-[`pnpm/setup`](https://github.com/pnpm/setup) installs pnpm v11+ as a native standalone executable and can install Node.js, Bun, or Deno in the same step, so a typical workflow no longer needs `actions/setup-node` or an explicit `pnpm install` step:
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-
-  # Before:
-  # - uses: pnpm/action-setup@v6
-  #   with:
-  #     version: 10
-  #     cache: true
-  # - uses: actions/setup-node@v4
-  #   with:
-  #     node-version: 22
-  # - run: pnpm install
-
-  # After:
-  - uses: pnpm/setup@v1
-    with:
-      version: 11
-      runtime: node@22
-      cache: true
-```
-
-The `version` input can be omitted only when `packageManager` (or `devEngines.packageManager`) in `package.json` declares pnpm v11 or newer; otherwise keep it explicit, since `pnpm/setup` requires pnpm v11+.
-
-Input and output changes:
-
-| `pnpm/action-setup` | `pnpm/setup` | Notes |
-| ------------------- | ------------ | ----- |
-| `version` | `version` | Must resolve to pnpm v11 or newer. As before, it can be omitted when `packageManager` (or `devEngines.packageManager`) is set in `package.json`. |
-| `dest` | `dest` | Unchanged. |
-| `run_install` | `install` | `pnpm/setup` runs `pnpm install` automatically when a `package.json` is present (`install: true` by default); set `install: false` to skip it. The object/array form (`recursive`, `cwd`, `args`) is not supported — run those commands in separate steps. |
-| `cache` | `cache` | Unchanged. |
-| `cache_dependency_path` | `cache-dependency-path` | Renamed to kebab-case. |
-| `package_json_file` | `package-json-file` | Renamed to kebab-case. |
-| `standalone` | removed | `pnpm/setup` always installs the standalone native executable. |
-| n/a | `runtime` | New: installs Node.js, Bun, or Deno (e.g. `node@22`, `bun@latest`, `deno@2`), or reads `devEngines.runtime` from `package.json`. |
-| n/a | `token` | New: GitHub token for release lookup; defaults to `${{ github.token }}` and rarely needs to be set. |
-| `bin_dest` (output) | `bin-dest` (output) | Renamed to kebab-case. New outputs `runtime-name` and `runtime-version` describe the installed runtime. |
+Install pnpm package manager.

 ## Inputs

@@ -62,7 +12,7 @@ Input and output changes:

 Version of pnpm to install.

-**Optional** when there is a [`packageManager` or `devEngines.packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
+**Optional** when there is a [`packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).

 otherwise, this field is **required** It supports npm versioning scheme, it could be an exact version (such as `10.9.8`), or a version range (such as `10`, `10.x.x`, `10.9.x`, `^10.9.8`, `*`, etc.), or `latest`.

@@ -94,15 +44,15 @@ If `run_install` is a YAML string representation of either an object or an array

 ### `cache`

-**Optional** (_type:_ `boolean`, _default:_ `false`) Whether to cache the pnpm store directory and, on pnpm v11 and newer, the results of pnpm's lockfile verification against the configured supply-chain policies. Both are keyed on the lockfile's content hash.
+**Optional** (_type:_ `boolean`, _default:_ `false`) Whether to cache the pnpm store directory.

 ### `cache_dependency_path`

-**Optional** (_type:_ `string`, _default:_ `pnpm-lock.yaml`) File path to the pnpm lockfile, whose contents hash will be used as a cache key. Accepts multiple paths delimited by newlines.
+**Optional** (_type:_ `string|string[]`, _default:_ `pnpm-lock.yaml`) File path to the pnpm lockfile, which contents hash will be used as a cache key.

 ### `package_json_file`

-**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json`/[`package.yaml`](https://github.com/pnpm/pnpm/pull/1799) to read `packageManager` or `devEngines.packageManager` configuration.
+**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json`/[`package.yaml`](https://github.com/pnpm/pnpm/pull/1799) to read "packageManager" configuration.

 ### `standalone`

@@ -124,7 +74,7 @@ Location of `pnpm` and `pnpx` command.

 ### Install only pnpm without `packageManager`

-This works when the repo either doesn't have a `package.json` or has a `package.json` but it doesn't specify `packageManager` or `devEngines.packageManager`.
+This works when the repo either doesn't have a `package.json` or has a `package.json` but it doesn't specify `packageManager`.

 ```yaml
 on:
@@ -143,7 +93,7 @@ jobs:

 ###  Install only pnpm with `packageManager`

-Omit `version` input to use the version in the [`packageManager` or `devEngines.packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
+Omit `version` input to use the version in the [`packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).

 ```yaml
 on:
@@ -208,38 +158,9 @@ jobs:

 **Note:** You don't need to run `pnpm store prune` at the end; post-action has already taken care of that.

-Besides the store, this also caches pnpm's lockfile verification results (pnpm v11 and newer). Repositories that configure supply-chain policies such as `minimumReleaseAge` or `trustPolicy` make pnpm check every lockfile entry against the registry on each install; that check depends only on the lockfile and the policies, so its result is cached and reused until the lockfile changes.
-
-### Cache dependencies from multiple lockfiles
-
-```yaml
-on:
-  - push
-  - pull_request
-
-jobs:
-  cache-and-install-multiple:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v6
-        with:
-          version: 10
-          cache: true
-          cache_dependency_path: |
-            one/pnpm-lock.yaml
-            two/pnpm-lock.yaml
-          run_install: |
-            - cwd: one
-            - cwd: two
-```
-
 ## Notes

-This action does not set up Node.js. Use [actions/setup-node](https://github.com/actions/setup-node) yourself. If you are on pnpm v11 or newer, [`pnpm/setup`](https://github.com/pnpm/setup) can install pnpm and Node.js in a single step.
+This action does not setup Node.js for you, use [actions/setup-node](https://github.com/actions/setup-node) yourself.

 ## License

--- a/action.yml
+++ b/action.yml
@@ -16,14 +16,11 @@ inputs:
    required: false
    default: 'null'
  cache:
-    description: |
-      Whether to cache the pnpm store directory and, on pnpm v11 and newer,
-      the results of pnpm's lockfile verification against the configured
-      supply-chain policies. Both are keyed on the lockfile's content hash.
+    description: Whether to cache the pnpm store directory
    required: false
    default: 'false'
  cache_dependency_path:
-    description: File path to the pnpm lockfile, whose contents hash will be used as a cache key. Accepts multiple paths delimited by newlines.
+    description: File path to the pnpm lockfile, which contents hash will be used as a cache key
    required: false
    default: 'pnpm-lock.yaml'
  package_json_file:
--- a/dist/index.js
+++ b/dist/index.js
--- a/src/cache-restore/run.ts
+++ b/src/cache-restore/run.ts
@@ -4,38 +4,23 @@ import { getExecOutput } from '@actions/exec'
 import { hashFiles } from '@actions/glob'
 import os from 'os'
 import { Inputs } from '../inputs'
-import { restoreVerificationCache } from '../lockfile-verification-cache'

 export async function runRestoreCache(inputs: Inputs) {
+  const cachePath = await getCacheDirectory()
+  saveState('cache_path', cachePath)
+
  const fileHash = await hashFiles(inputs.cacheDependencyPath)
  if (!fileHash) {
    throw new Error('Some specified paths were not resolved, unable to cache dependencies.')
  }

-  await runRestoreStoreCache(fileHash)
-  await restoreVerificationCache(fileHash)
-}
-
-async function runRestoreStoreCache(fileHash: string) {
-  const cachePath = await getCacheDirectory()
-  saveState('cache_path', cachePath)
-
  const primaryKey = `pnpm-cache-${process.env.RUNNER_OS}-${os.arch()}-${fileHash}`
  debug(`Primary key is ${primaryKey}`)
  saveState('cache_primary_key', primaryKey)

-  // We don't need to download everything again if only one dependency changed
-  // We can still re-use previous store to cache the rest of the unchanged dependencies
-  const restoreKeys = [
-    `pnpm-cache-${process.env.RUNNER_OS}-${os.arch()}-`
-  ];
+  let cacheKey = await restoreCache([cachePath], primaryKey)

-  let cacheKey = await restoreCache([cachePath], primaryKey, restoreKeys)
-
-  // A restore-key (prefix) match still restores an older store, but "cache-hit"
-  // must only report an exact primary-key match, so dependency installation
-  // is not skipped when the lockfile has changed.
-  setOutput('cache-hit', cacheKey === primaryKey)
+  setOutput('cache-hit', Boolean(cacheKey))

  if (!cacheKey) {
    info(`Cache is not found`)
--- a/src/index.ts
+++ b/src/index.ts
@@ -3,7 +3,6 @@ import restoreCache from './cache-restore'
 import saveCache from './cache-save'
 import getInputs, { Inputs } from './inputs'
 import installPnpm from './install-pnpm'
-import { saveVerificationCache } from './lockfile-verification-cache'
 import setOutputs from './outputs'
 import pnpmInstall from './pnpm-install'
 import pruneStore from './pnpm-store-prune'
@@ -33,9 +32,6 @@ async function runMain() {

 async function runPost() {
  const inputs = JSON.parse(getState('inputs')) as Inputs
-  // Saved ahead of the prune because `pnpm store prune` drops the
-  // verification log along with the rest of the store's derived state.
-  await saveVerificationCache()
  pruneStore(inputs)
  await saveCache(inputs)
 }
--- a/src/install-pnpm/bootstrap/exe-lock.json
+++ b/src/install-pnpm/bootstrap/exe-lock.json
@@ -5,18 +5,18 @@
  "packages": {
    "": {
      "dependencies": {
-        "@pnpm/exe": "11.19.0"
+        "@pnpm/exe": "11.0.4"
      }
    },
    "node_modules/@pnpm/exe": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.19.0.tgz",
-      "integrity": "sha512-P1mw8BZaNkEpttlyzKsxTj7PVs94bMB4cQ8pJhgbrCTSBP7xCzKS3VlOwIInS7aS5by6KAbfO5Vs9yK/ekugrg==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.4.tgz",
+      "integrity": "sha512-3OwYqbbj1KtuUqoMo5OEkY8nU/WutZ7L5ADFl0bbW9oyqU55U37aDqA3NJNSk28CyszNARfrjerAF2DW2TsV7w==",
      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
        "@reflink/reflink": "0.1.19",
-        "detect-libc": "^2.1.2"
+        "detect-libc": "^2.0.3"
      },
      "bin": {
        "pn": "pn",
@@ -28,19 +28,20 @@
        "url": "https://opencollective.com/pnpm"
      },
      "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.19.0",
-        "@pnpm/linux-x64": "11.19.0",
-        "@pnpm/linuxstatic-arm64": "11.19.0",
-        "@pnpm/linuxstatic-x64": "11.19.0",
-        "@pnpm/macos-arm64": "11.19.0",
-        "@pnpm/win-arm64": "11.19.0",
-        "@pnpm/win-x64": "11.19.0"
+        "@pnpm/linux-arm64": "11.0.4",
+        "@pnpm/linux-x64": "11.0.4",
+        "@pnpm/linuxstatic-arm64": "11.0.4",
+        "@pnpm/linuxstatic-x64": "11.0.4",
+        "@pnpm/macos-arm64": "11.0.4",
+        "@pnpm/macos-x64": "11.0.4",
+        "@pnpm/win-arm64": "11.0.4",
+        "@pnpm/win-x64": "11.0.4"
      }
    },
    "node_modules/@pnpm/linux-arm64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.19.0.tgz",
-      "integrity": "sha512-c5AJqnsj0BMqMCOtctOzsCqyfY+afFe1kdM9F2FrNhYwtnQRMHoJy+51qfee4yuTPOVRyk3Yh1dwvyAadiznvA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.4.tgz",
+      "integrity": "sha512-Bz7V2sFypoGHX/t5w/w7jnCw5DCK3C8s5q8whHJJ3iS5kRznX3Q1F4LwSjjy+lsi777fHyNIvD7qtNmdt9IKoA==",
      "cpu": [
        "arm64"
      ],
@@ -54,9 +55,9 @@
      }
    },
    "node_modules/@pnpm/linux-x64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.19.0.tgz",
-      "integrity": "sha512-KOKpA9o75SvmRQgWO+EqEpQzJg1b9uHk5y61PAx90sSpdYtKDPua2eBXBglzv8YK1xM3DsYXFEf7Scs+3HeDsA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.4.tgz",
+      "integrity": "sha512-u0Yn1gytR1vKdPk6fYF500H8ZWQlj0cTuIQPp+5GYVPkMmA5bSw41RNIDPBfjDlE8ERmQWaQcrgmTcmTZ+n22A==",
      "cpu": [
        "x64"
      ],
@@ -70,9 +71,9 @@
      }
    },
    "node_modules/@pnpm/linuxstatic-arm64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.19.0.tgz",
-      "integrity": "sha512-Ci9WxgCInZc3F43R6BfaHevi+dYqaI5CLi6421egFsK649eHvYPytvu+zABhTNlYGNJbD8j9w+AUYInz/TPsyQ==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.0.4.tgz",
+      "integrity": "sha512-0aitEcfhWNXNZhfJGt/kJaRvfcdtJzXZpV+toJN94kfawSJnhuawfnUSXMi/3m0G97HkJc7BH8rOz3sojUKt0g==",
      "cpu": [
        "arm64"
      ],
@@ -89,9 +90,9 @@
      }
    },
    "node_modules/@pnpm/linuxstatic-x64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.19.0.tgz",
-      "integrity": "sha512-GNMk96vNJ4uEWigekarjHofXNDFsTYRL0Mw2YlDkv/W+u0cn/UAVPHfd5aAfsf6Arel2ZQfxPUTXlpunFujWnA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.0.4.tgz",
+      "integrity": "sha512-xDJdeJ7D2YvDBy2/IH9lEqMKiSuZiV8190XKWOgQgxUGGeuW4z3j6Ewpl0S5bXsWuNjAgC+uCKp7Qp3P7cXAvw==",
      "cpu": [
        "x64"
      ],
@@ -108,9 +109,9 @@
      }
    },
    "node_modules/@pnpm/macos-arm64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.19.0.tgz",
-      "integrity": "sha512-I3Ee/GQlPxEOeBSzqxBNwcTHxVebjMiN2xLdTBS6OK2TAPzbWMIExjU5brxhr8rAk73p7mbv/a/2tFC/3gl6FA==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.4.tgz",
+      "integrity": "sha512-dNR69jUARtGFuyyLE9VuyxhRUKC8MO/7/xIyAdeIMZAD5ej0Y/Ct0DYCa/FLbgFL1nXaXmp4+gRMfJBkkrKfQQ==",
      "cpu": [
        "arm64"
      ],
@@ -123,10 +124,26 @@
        "url": "https://opencollective.com/pnpm"
      }
    },
+    "node_modules/@pnpm/macos-x64": {
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.4.tgz",
+      "integrity": "sha512-RfyrxSBajeEU16dZsgFjbdagDV9F4HNCJfbBgm8IbGjL0+J95naM/VmCDLd6S3+1tISeI2MxtcyCxqjKJsD/BA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
    "node_modules/@pnpm/win-arm64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.19.0.tgz",
-      "integrity": "sha512-rOiWuJ9wjaFY9ZDVPGVjpvjIQHZNB72rioxvuyzDKJ7dqKQ97VF27a4rmOtjhMB5u83cdDGEJ+OY+H1+TP+frw==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.4.tgz",
+      "integrity": "sha512-fOQEv8b9KxZlUAxPPXSQQUUIrt2nY24Qwd4RzCPpatacBnsE4JIadlr/B4V5z2zFxmV7FdHr7nYUhv2RqTlY/w==",
      "cpu": [
        "arm64"
      ],
@@ -140,9 +157,9 @@
      }
    },
    "node_modules/@pnpm/win-x64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.19.0.tgz",
-      "integrity": "sha512-l26XeTxoGxfU+mVcZ5jFdP9hNe5yrOlLPSkAlwwpXPI1iyyU4JUSxm6Jdyxu1UAU1FerD/BvLK2vrlR6d9ogag==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.4.tgz",
+      "integrity": "sha512-pErHAV8m3NZuPSeCmH3senTSHX0nwkH5lLzQSpiFuyt08hq8sqL3jDymT4ri9N7ixPN9RFZghZIiT3h+Croaew==",
      "cpu": [
        "x64"
      ],
--- a/src/install-pnpm/bootstrap/pnpm-lock.json
+++ b/src/install-pnpm/bootstrap/pnpm-lock.json
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "pnpm": "11.19.0"
+        "pnpm": "11.0.4"
      }
    },
    "node_modules/pnpm": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.19.0.tgz",
-      "integrity": "sha512-eIHz7VkNRyxKlV4riLISF5ERYGbcyIy8o4SeybYPG7qm0syyIfqR2k4cZb7yvL43k2Wup6xTnHv4be3DobItzg==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.4.tgz",
+      "integrity": "sha512-CjlxZQB6AU7VKRmmHl9GxIubyohATDA+yuzGP2Le9WOJjTxril1epYEes5jP4DqwXaGlzpY/Em1erUwC+TuDww==",
      "license": "MIT",
      "bin": {
        "pn": "bin/pnpm.mjs",
--- a/src/lockfile-verification-cache/index.ts
+++ b/src/lockfile-verification-cache/index.ts
@@ -1,95 +0,0 @@
-import { restoreCache, saveCache } from '@actions/cache'
-import { debug, getState, info, saveState, warning } from '@actions/core'
-import { getExecOutput } from '@actions/exec'
-import { existsSync } from 'fs'
-import os from 'os'
-import path from 'path'
-import { removeWindowsExtendedPathPrefix } from '../windows-path'
-
-/**
- * pnpm v11+ verifies every lockfile entry against the configured
- * supply-chain policies (`minimumReleaseAge`, `trustPolicy`, …) and memoizes
- * the verdict in this file, so the next install with the same lockfile and
- * the same policies skips the registry round-trips entirely. Without it a CI
- * job re-verifies the whole lockfile on every run, which on a large
- * repository costs more than the install itself.
- */
-const VERIFICATION_CACHE_FILE = 'lockfile-verified.jsonl'
-
-const PATH_STATE = 'lockfile_verification_cache_path'
-const KEY_STATE = 'lockfile_verification_cache_key'
-const RESTORED_STATE = 'lockfile_verification_cache_restored'
-
-/**
- * The verdict is only valid for the exact lockfile content it was recorded
- * for, so this cache is keyed on the same lockfile hash as the store cache
- * but restored without prefix fallback: an older entry could never be used.
- */
-export async function restoreVerificationCache(lockfileHash: string): Promise<void> {
-  try {
-    const cacheFilePath = path.join(await getPnpmCacheDirectory(), VERIFICATION_CACHE_FILE)
-    const key = `pnpm-lockfile-verified-${process.env.RUNNER_OS}-${os.arch()}-${lockfileHash}`
-    saveState(PATH_STATE, cacheFilePath)
-    saveState(KEY_STATE, key)
-    debug(`Lockfile verification cache path is ${cacheFilePath}, key is ${key}`)
-
-    const restoredKey = await restoreCache([cacheFilePath], key)
-    if (!restoredKey) {
-      info('Lockfile verification cache is not found')
-      return
-    }
-
-    saveState(RESTORED_STATE, 'true')
-    info(`Lockfile verification cache restored from key: ${restoredKey}`)
-  } catch (error) {
-    // The gate only costs time, never correctness — a job that cannot reuse
-    // a past verdict re-verifies and moves on.
-    warning(`Failed to restore the lockfile verification cache: ${(error as Error).message}`)
-  }
-}
-
-export async function saveVerificationCache(): Promise<void> {
-  if (getState(RESTORED_STATE) === 'true') return
-
-  const cacheFilePath = getState(PATH_STATE)
-  const key = getState(KEY_STATE)
-  if (!cacheFilePath || !key || !existsSync(cacheFilePath)) return
-
-  try {
-    const cacheId = await saveCache([cacheFilePath], key)
-    if (cacheId === -1) return
-    info(`Lockfile verification cache saved with the key: ${key}`)
-  } catch (error) {
-    warning(`Failed to save the lockfile verification cache: ${(error as Error).message}`)
-  }
-}
-
-async function getPnpmCacheDirectory(): Promise<string> {
-  const { stdout } = await getExecOutput('pnpm config get cacheDir', undefined, {
-    silent: true,
-    ignoreReturnCode: true,
-  })
-  const configured = stdout.trim()
-  // `pnpm config get` reports settings, not defaults: an unset `cacheDir`
-  // prints `undefined` and the default has to be derived here.
-  if (configured && configured !== 'undefined') {
-    return removeWindowsExtendedPathPrefix(configured)
-  }
-  return defaultPnpmCacheDirectory()
-}
-
-/** Mirrors pnpm's own `cacheDir` default. */
-function defaultPnpmCacheDirectory(): string {
-  const { XDG_CACHE_HOME, LOCALAPPDATA } = process.env
-  if (XDG_CACHE_HOME) return path.join(XDG_CACHE_HOME, 'pnpm')
-
-  const homeDir = os.homedir()
-  switch (process.platform) {
-  case 'darwin':
-    return path.join(homeDir, 'Library', 'Caches', 'pnpm')
-  case 'win32':
-    return LOCALAPPDATA ? path.join(LOCALAPPDATA, 'pnpm-cache') : path.join(homeDir, '.pnpm-cache')
-  default:
-    return path.join(homeDir, '.cache', 'pnpm')
-  }
-}
--- a/src/windows-path/index.ts
+++ b/src/windows-path/index.ts
@@ -1,19 +0,0 @@
-/**
- * pnpm may report an extended-length path on Windows. The `?` in that prefix
- * is interpreted as a wildcard by `@actions/cache`, which rejects it as a glob
- * in the root segment. Cache APIs do not need the extended-length form, so
- * convert it back to a regular drive or UNC path.
- */
-export function removeWindowsExtendedPathPrefix(cachePath: string): string {
-  const extendedPathPrefix = '\\\\?\\'
-  if (!cachePath.startsWith(extendedPathPrefix)) return cachePath
-
-  const pathWithoutPrefix = cachePath.slice(extendedPathPrefix.length)
-  const uncPrefix = 'UNC\\'
-  if (pathWithoutPrefix.toUpperCase().startsWith(uncPrefix)) {
-    return `\\\\${pathWithoutPrefix.slice(uncPrefix.length)}`
-  }
-  return pathWithoutPrefix
-}
-
-export default removeWindowsExtendedPathPrefix