feat: skip self-update for devEngines.packageManager and add CI tests

pnpm auto-switches to the right version when devEngines.packageManager
is set, so self-update is unnecessary. This also enables range support
(e.g. ">=9.15.0") which self-update doesn't handle.

.github/CODEOWNERS

@@ -1 +0,0 @@
-* @zkochan

.github/workflows/pr-check.yaml

@@ -19,7 +19,7 @@ jobs:
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           run_install: true
-          version: 11
+          version: 9
 
       - name: Update dist/index.js
         run: pnpm run build

.github/workflows/test.yaml

@@ -1,76 +1,39 @@
 name: Test Action
 
 on:
-  pull_request:
+  - push
-  push:
+  - pull_request
-    branches:
+  - workflow_dispatch
-      - master
-  workflow_dispatch:
 
 jobs:
-  smoke:
+  test_default_inputs:
-    # Cross-OS coverage. Exercises the bootstrap install + PATH on each platform,
+    name: Test with default inputs
-    # the version-respects-request regression (#225 / #230 — Windows PATH shadow),
-    # and the bin_dest output regression (#247). Multi-version coverage on Linux
-    # so we don't pay 3x for major-version differences.
-    name: 'Smoke (${{ matrix.name }})'
 
     runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
-        include:
+        pnpm:
-          - name: 'ubuntu / v9.15.5'
+          - 9.15.5
-            os: ubuntu-latest
+        os:
-            version: '9.15.5'
+          - ubuntu-latest
-          - name: 'ubuntu / v10.33.0'
+          - macos-latest
-            os: ubuntu-latest
+          - windows-latest
-            version: '10.33.0'
-          - name: 'ubuntu / v9.15.5 / custom-dest'
-            os: ubuntu-latest
-            version: '9.15.5'
-            dest: '~/test/pnpm'
-          - name: 'macos / v9.15.5'
-            os: macos-latest
-            version: '9.15.5'
-          - name: 'windows / v9.15.5'
-            os: windows-latest
-            version: '9.15.5'
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - id: pnpm
+      - name: Run the action
-        name: Run the action
         uses: ./
         with:
-          version: ${{ matrix.version }}
+          version: 9.15.5
-          dest: ${{ matrix.dest || '~/setup-pnpm' }}
 
-      - name: 'Test: pnpm/pnpx on PATH report the requested version (incl. via bin_dest)'
+      - name: 'Test: which'
-        # Pass paths via env, not template interpolation, so Windows
+        run: which pnpm; which pnpx
-        # backslashes in `bin_dest` aren't eaten by bash's escape handling.
+
-        env:
+      - name: 'Test: version'
-          BIN_DEST: ${{ steps.pnpm.outputs.bin_dest }}
+        run: pnpm --version
-          REQUIRED: ${{ matrix.version }}
-        run: |
-          set -e
-          which pnpm
-          which pnpx
-          actual="$(pnpm --version)"
-          echo "pnpm --version: ${actual}"
-          if [ "${actual}" != "${REQUIRED}" ]; then
-            echo "Expected pnpm version ${REQUIRED}, but got ${actual}"
-            exit 1
-          fi
-          bin_dest_version="$("$BIN_DEST/pnpm" --version)"
-          echo "bin_dest pnpm --version: ${bin_dest_version}"
-          if [ "${bin_dest_version}" != "${REQUIRED}" ]; then
-            echo "Expected ${REQUIRED} via bin_dest, but got ${bin_dest_version}"
-            exit 1
-          fi
-        shell: bash
 
       - name: 'Test: install in a fresh project'
         run: |
@@ -80,95 +43,47 @@ jobs:
           pnpm add is-odd
         shell: bash
 
-  manifest_pin:
+  test_dest:
-    # Folds the old test_package_manager_field, test_dev_engines, and
+    name: Test with dest
-    # test_dev_engines_on_fail_error jobs. The action's manifest handling is
-    # OS-independent, so ubuntu-only is sufficient.
-    name: 'Manifest pin: ${{ matrix.label }}'
 
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
-        include:
+        pnpm:
-          - label: 'packageManager pnpm@9.15.5 (#227)'
+          - 9.15.5
-            manifest: '{"packageManager":"pnpm@9.15.5"}'
+        os:
-            version: '9.15.5'
+          - ubuntu-latest
-          - label: 'packageManager pnpm@10.33.0'
+          - macos-latest
-            manifest: '{"packageManager":"pnpm@10.33.0"}'
+          - windows-latest
-            version: '10.33.0'
-          - label: 'devEngines onFail=download, exact'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"9.15.5","onFail":"download"}}}'
-            version: '9.15.5'
-          - label: 'devEngines onFail=download, range'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=9.15.0","onFail":"download"}}}'
-            version: '>=9.15.0'
-          - label: 'devEngines onFail=error, exact (#252)'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"9.15.5","onFail":"error"}}}'
-            version: '9.15.5'
-          - label: 'devEngines onFail=error, range (#252)'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=9.15.0","onFail":"error"}}}'
-            version: '>=9.15.0'
-          - label: 'explicit version: pnpm_config_pm_on_fail not exported'
-            # Regression guard for the af8e203 scope fix: when the user passes an
-            # explicit `version:` input, the action must NOT export
-            # pnpm_config_pm_on_fail=download, so the user's strict onFail policy
-            # is preserved. Asserted directly on the env var rather than pnpm
-            # runtime behavior — different pnpm majors read devEngines
-            # differently (v10 ignores it, v11+ honors it).
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"9.15.5","onFail":"error"}}}'
-            explicit_version: '10.33.0'
-            expect_pm_on_fail_unset: true
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - name: Set up package.json
-        run: echo '${{ matrix.manifest }}' > package.json
-        shell: bash
-
       - name: Run the action
         uses: ./
         with:
-          version: ${{ matrix.explicit_version }}
+          version: 9.15.5
+          dest: ~/test/pnpm
 
-      - name: 'Test: pnpm reports the pinned version'
+      - name: 'Test: which'
-        if: ${{ !matrix.expect_pm_on_fail_unset }}
+        run: which pnpm && which pnpx
-        env:
-          REQUIRED: ${{ matrix.version }}
-        run: |
-          set -e
-          actual="$(pnpm --version)"
-          echo "pnpm version: ${actual}"
-          if [ "${REQUIRED}" = ">=9.15.0" ]; then
-            min="9.15.0"
-            if [ "$(printf '%s\n' "${min}" "${actual}" | sort -V | head -n1)" != "${min}" ]; then
-              echo "Expected pnpm version >= ${min}, but got ${actual}"
-              exit 1
-            fi
-          else
-            if [ "${actual}" != "${REQUIRED}" ]; then
-              echo "Expected pnpm version ${REQUIRED}, but got ${actual}"
-              exit 1
-            fi
-          fi
-        shell: bash
 
-      - name: 'Test: pnpm_config_pm_on_fail not exported (explicit version preserves strict policy)'
+      - name: 'Test: version'
-        if: ${{ matrix.expect_pm_on_fail_unset }}
+        run: pnpm --version
-        run: |
-          if [ -n "${pnpm_config_pm_on_fail:-}" ]; then
-            echo "Expected pnpm_config_pm_on_fail to be unset, but got: '${pnpm_config_pm_on_fail}'"
-            exit 1
-          fi
-          echo "pnpm_config_pm_on_fail is unset, as expected"
-        shell: bash
 
-  standalone:
+  test_standalone:
-    name: Standalone mode
+    name: Test with standalone
 
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -179,125 +94,84 @@ jobs:
           version: 9.15.0
           standalone: true
 
-      - name: 'Test: pnpm works'
+      - name: 'Test: which'
+        run: which pnpm
+
+      - name: 'Test: version'
+        run: pnpm --version
+
+      - name: 'Test: install in a fresh project'
         run: |
-          set -e
-          which pnpm
-          actual="$(pnpm --version)"
-          if [ "${actual}" != "9.15.0" ]; then
-            echo "Expected 9.15.0, got ${actual}"
-            exit 1
-          fi
           mkdir /tmp/test-standalone
           cd /tmp/test-standalone
           pnpm init
           pnpm add is-odd
         shell: bash
 
-  standalone_windows_self_update:
+  test_dev_engines:
-    # Regression guard for the patchPnpmEnv PATH-shadow bug. When
+    name: Test with devEngines.packageManager
-    # standalone: true on Windows AND the requested pnpm differs from the
+
-    # bootstrap, the previous patchPnpmEnv prepended node_modules/.bin to
+    runs-on: ${{ matrix.os }}
-    # PATH; that directory contains an npm-created pnpm.cmd shim pointing
+
-    # at the BOOTSTRAP pnpm, which shadowed the self-updated pnpm at
+    strategy:
-    # $PNPM_HOME/bin and caused `pnpm install` inside the action to run
+      fail-fast: false
-    # under the bootstrap version. Exercising a newer-pnpm-only flag
+      matrix:
-    # (`--no-runtime`, added in 11.1.0) makes the regression assertable:
+        os:
-    # if the bootstrap (11.0.4) handles the install, it errors with
+          - ubuntu-latest
-    # "Unknown option: 'runtime'".
+          - macos-latest
-    name: 'Standalone Windows self-update (PATH regression)'
+          - windows-latest
-    runs-on: windows-latest
+        version:
+          - '9.15.5'
+          - '>=9.15.0'
+
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - name: Set up package.json with a minimal manifest
+      - name: Set up package.json with devEngines.packageManager
-        # run_install needs a manifest to install against. Removing the
+        run: echo '{"devEngines":{"packageManager":{"name":"pnpm","version":"${{ matrix.version }}","onFail":"download"}}}' > package.json
-        # repo's existing pnpm-lock.yaml avoids frozen-lockfile mismatch.
-        run: |
-          rm -f pnpm-lock.yaml
-          echo '{"name":"sw","private":true,"packageManager":"pnpm@11.1.0"}' > package.json
         shell: bash
 
       - name: Run the action
         uses: ./
-        with:
-          version: 11.1.0
-          standalone: true
-          run_install: |
-            args: ['--no-runtime']
 
-      - name: 'Test: pnpm install completed under the self-updated pnpm'
+      - name: 'Test: which'
-        # If the bug recurs, the previous step's run_install will have failed
+        run: which pnpm; which pnpx
-        # the job with "Unknown option: 'runtime'", so reaching this step
+
-        # implies success. Still verify the version on PATH matches request.
+      - name: 'Test: version'
-        env:
-          REQUIRED: '11.1.0'
         run: |
           set -e
+          required='${{ matrix.version }}'
           actual="$(pnpm --version)"
-          echo "pnpm --version: ${actual}"
+          echo "pnpm version: ${actual}"
-          if [ "${actual}" != "${REQUIRED}" ]; then
+
-            echo "Expected pnpm ${REQUIRED}, got ${actual}"
+          if [ "${required}" = ">=9.15.0" ]; then
-            exit 1
+            min="9.15.0"
+            if [ "$(printf '%s\n' "${min}" "${actual}" | sort -V | head -n1)" != "${min}" ]; then
+              echo "Expected pnpm version >= ${min}, but got ${actual}"
+              exit 1
+            fi
+          else
+            if [ "${actual}" != "${required}" ]; then
+              echo "Expected pnpm version ${required}, but got ${actual}"
+              exit 1
+            fi
           fi
         shell: bash
 
-  cache_store_path:
+  test_run_install:
-    # Regression guard for #233. When package.json pins a pnpm major that
+    name: 'Test with run_install (${{ matrix.run_install.name }}, ${{ matrix.os }})'
-    # differs from the bootstrap pnpm's major, the bootstrap reports its
-    # own STORE_VERSION from `pnpm store path` (the `store` command skips
-    # pnpm's auto-switch). The user's actual `pnpm install` runs under the
-    # pinned version and writes to a different STORE_VERSION, so the post
-    # step's saveCache then fails with "Path Validation Error". The fix is
-    # to self-update the bootstrap to the pinned version up front.
-    name: 'Cache store path matches install (#233): ${{ matrix.label }}'
 
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - label: 'packageManager pnpm@10.33.0'
-            manifest: '{"packageManager":"pnpm@10.33.0","dependencies":{"is-odd":"3.0.1"}}'
-          - label: 'devEngines exact pnpm@10.33.0'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"10.33.0"}},"dependencies":{"is-odd":"3.0.1"}}'
-          - label: 'devEngines range >=10 <11'
-            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=10 <11"}},"dependencies":{"is-odd":"3.0.1"}}'
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up package.json
-        run: echo '${{ matrix.manifest }}' > package.json
-        shell: bash
-
-      - id: pnpm
-        uses: ./
-        with:
-          cache: true
-          run_install: |
-            - args: [--no-frozen-lockfile]
-
-      - name: 'Test: store path computed by the action exists on disk'
-        run: |
-          set -e
-          actual="$(pnpm store path --silent)"
-          echo "pnpm store path: ${actual}"
-          if [ ! -d "${actual}" ]; then
-            echo "Expected store path to exist on disk; cache save would fail"
-            exit 1
-          fi
-        shell: bash
-
-  run_install:
-    name: 'run_install (${{ matrix.run_install.name }})'
-
-    runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
       matrix:
+        pnpm:
+          - 9.15.5
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
         run_install:
           - name: 'null'
             value: 'null'
@@ -318,72 +192,8 @@ jobs:
           version: 9.15.5
           run_install: ${{ matrix.run_install.value }}
 
-      - name: 'Test: pnpm works'
+      - name: 'Test: which'
-        run: |
+        run: which pnpm; which pnpx
-          set -e
-          which pnpm
-          which pnpx
-          actual="$(pnpm --version)"
-          if [ "${actual}" != "9.15.5" ]; then
-            echo "Expected 9.15.5, got ${actual}"
-            exit 1
-          fi
-        shell: bash
 
-  cache_lockfile_verification:
+      - name: 'Test: version'
-    # The action caches pnpm's lockfile verification log, which lives in
+        run: pnpm --version
-    # `cacheDir` — a directory pnpm resolves per platform and does not print.
-    # Guard the action's copy of that default against pnpm's own.
-    name: 'Lockfile verification cache (${{ matrix.os }}, cache=${{ matrix.cache }})'
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # The log is cached independently of the store, so the store-less
-          # configuration has to reach it too.
-          - os: ubuntu-latest
-            cache: false
-          - os: ubuntu-latest
-            cache: true
-          - os: macos-latest
-            cache: true
-          - os: windows-latest
-            cache: true
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up a project with a supply-chain policy
-        # A one-minute floor activates the verification without holding back
-        # any version the install resolves.
-        run: |
-          echo '{"dependencies":{"is-odd":"3.0.1"}}' > package.json
-          printf 'packages:\n  - .\nminimumReleaseAge: 1\n' > pnpm-workspace.yaml
-        shell: bash
-
-      - uses: ./
-        with:
-          version: '12.0.0-rc.4'
-          cache: ${{ matrix.cache }}
-          run_install: |
-            - args: [--no-frozen-lockfile]
-
-      - name: 'Test: pnpm wrote the verification log where the action looks for it'
-        run: |
-          set -e
-          case "$RUNNER_OS" in
-            Linux) cacheDir="${XDG_CACHE_HOME:-$HOME/.cache}/pnpm" ;;
-            macOS) cacheDir="$HOME/Library/Caches/pnpm" ;;
-            Windows) cacheDir="$(cygpath -u "$LOCALAPPDATA")/pnpm-cache" ;;
-            *) echo "Unexpected RUNNER_OS: $RUNNER_OS"; exit 1 ;;
-          esac
-          echo "Expecting the verification log in ${cacheDir}"
-          if [ ! -f "${cacheDir}/lockfile-verified.jsonl" ]; then
-            echo "No lockfile-verified.jsonl there; the action would cache nothing"
-            ls -la "${cacheDir}" || true
-            exit 1
-          fi
-        shell: bash

.gitignore

@@ -9,4 +9,3 @@ temp
 tmp.*
 temp.*
 .pnpm-store
-.claude

README.md

@@ -1,60 +1,10 @@
-> [!IMPORTANT]
-> **This action has a successor: [`pnpm/setup`](https://github.com/pnpm/setup).**
->
-> For pnpm v11 and newer, use [`pnpm/setup`](https://github.com/pnpm/setup) instead. It downloads pnpm's self-contained release binary (no Node.js or npm required) and can install a JavaScript runtime (Node.js, Bun, or Deno) in the same step, replacing `actions/setup-node`.
->
-> `pnpm/action-setup` remains the action to use for installing pnpm v10 and older. See [Migrating to pnpm/setup](#migrating-to-pnpmsetup) below.
-
-# Setup pnpm
-
-Install pnpm package manager.
-
 > ## :warning: Upgrade from v2!
 >
 > The v2 version of this action [has stopped working](https://github.com/pnpm/action-setup/issues/135) with newer Node.js versions. Please, upgrade to the latest version to fix any issues.
 
-## Migrating to pnpm/setup
+# Setup pnpm
 
-[`pnpm/setup`](https://github.com/pnpm/setup) installs pnpm v11+ as a native standalone executable and can install Node.js, Bun, or Deno in the same step, so a typical workflow no longer needs `actions/setup-node` or an explicit `pnpm install` step:
+Install pnpm package manager.
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-
-  # Before:
-  # - uses: pnpm/action-setup@v6
-  #   with:
-  #     version: 10
-  #     cache: true
-  # - uses: actions/setup-node@v4
-  #   with:
-  #     node-version: 22
-  # - run: pnpm install
-
-  # After:
-  - uses: pnpm/setup@v1
-    with:
-      version: 11
-      runtime: node@22
-      cache: true
-```
-
-The `version` input can be omitted only when `packageManager` (or `devEngines.packageManager`) in `package.json` declares pnpm v11 or newer; otherwise keep it explicit, since `pnpm/setup` requires pnpm v11+.
-
-Input and output changes:
-
-| `pnpm/action-setup` | `pnpm/setup` | Notes |
-| ------------------- | ------------ | ----- |
-| `version` | `version` | Must resolve to pnpm v11 or newer. As before, it can be omitted when `packageManager` (or `devEngines.packageManager`) is set in `package.json`. |
-| `dest` | `dest` | Unchanged. |
-| `run_install` | `install` | `pnpm/setup` runs `pnpm install` automatically when a `package.json` is present (`install: true` by default); set `install: false` to skip it. The object/array form (`recursive`, `cwd`, `args`) is not supported — run those commands in separate steps. |
-| `cache` | `cache` | Unchanged. |
-| `cache_dependency_path` | `cache-dependency-path` | Renamed to kebab-case. |
-| `package_json_file` | `package-json-file` | Renamed to kebab-case. |
-| `standalone` | removed | `pnpm/setup` always installs the standalone native executable. |
-| n/a | `runtime` | New: installs Node.js, Bun, or Deno (e.g. `node@22`, `bun@latest`, `deno@2`), or reads `devEngines.runtime` from `package.json`. |
-| n/a | `token` | New: GitHub token for release lookup; defaults to `${{ github.token }}` and rarely needs to be set. |
-| `bin_dest` (output) | `bin-dest` (output) | Renamed to kebab-case. New outputs `runtime-name` and `runtime-version` describe the installed runtime. |
 
 ## Inputs
 
@@ -62,9 +12,9 @@ Input and output changes:
 
 Version of pnpm to install.
 
-**Optional** when there is a [`packageManager` or `devEngines.packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
+**Optional** when there is a [`packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
 
-otherwise, this field is **required** It supports npm versioning scheme, it could be an exact version (such as `10.9.8`), or a version range (such as `10`, `10.x.x`, `10.9.x`, `^10.9.8`, `*`, etc.), or `latest`.
+otherwise, this field is **required** It supports npm versioning scheme, it could be an exact version (such as `6.24.1`), or a version range (such as `6`, `6.x.x`, `6.24.x`, `^6.24.1`, `*`, etc.), or `latest`.
 
 ### `dest`
 
@@ -94,15 +44,15 @@ If `run_install` is a YAML string representation of either an object or an array
 
 ### `cache`
 
-**Optional** (_type:_ `boolean`, _default:_ `false`) Whether to cache the pnpm store directory, keyed on the lockfile's content hash. On pnpm v11 and newer, the results of pnpm's lockfile verification are cached regardless of this input — see [Lockfile verification cache](#lockfile-verification-cache).
+**Optional** (_type:_ `boolean`, _default:_ `false`) Whether to cache the pnpm store directory.
 
 ### `cache_dependency_path`
 
-**Optional** (_type:_ `string`, _default:_ `pnpm-lock.yaml`) File path to the pnpm lockfile, whose contents hash will be used as a cache key. Accepts multiple paths delimited by newlines.
+**Optional** (_type:_ `string|string[]`, _default:_ `pnpm-lock.yaml`) File path to the pnpm lockfile, which contents hash will be used as a cache key.
 
 ### `package_json_file`
 
-**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json`/[`package.yaml`](https://github.com/pnpm/pnpm/pull/1799) to read `packageManager` or `devEngines.packageManager` configuration.
+**Optional** (_type:_ `string`, _default:_ `package.json`) File path to the `package.json`/[`package.yaml`](https://github.com/pnpm/pnpm/pull/1799) to read "packageManager" configuration.
 
 ### `standalone`
 
@@ -124,7 +74,7 @@ Location of `pnpm` and `pnpx` command.
 
 ### Install only pnpm without `packageManager`
 
-This works when the repo either doesn't have a `package.json` or has a `package.json` but it doesn't specify `packageManager` or `devEngines.packageManager`.
+This works when the repo either doesn't have a `package.json` or has a `package.json` but it doesn't specify `packageManager`.
 
 ```yaml
 on:
@@ -136,14 +86,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
         with:
           version: 10
 ```
 
 ###  Install only pnpm with `packageManager`
 
-Omit `version` input to use the version in the [`packageManager` or `devEngines.packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
+Omit `version` input to use the version in the [`packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
 
 ```yaml
 on:
@@ -155,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
 ```
 
 ### Install pnpm and a few npm packages
@@ -170,9 +120,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
         with:
           version: 10
           run_install: |
@@ -194,9 +144,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v5
         name: Install pnpm
         with:
           version: 10
@@ -208,55 +158,9 @@ jobs:
 
 **Note:** You don't need to run `pnpm store prune` at the end; post-action has already taken care of that.
 
-### Lockfile verification cache
-
-pnpm v11 and newer check every lockfile entry before installing it — that each entry pins an integrity hash, that a pinned tarball URL matches the registry's own metadata, and, where configured, your `minimumReleaseAge` and `trustPolicy` policies. The verdict is memoized in a sub-kilobyte file, so an unchanged lockfile is not re-checked against the registry.
-
-The action restores and saves that file on every run, independently of the `cache` input, because a job that starts without it pays for the check every time. On a repository with ~2000 lockfile entries and a warm store:
-
-| | without the log | with it |
-| --- | --- | --- |
-| `minimumReleaseAge` + `trustPolicy` | 13.5s | 1.5s |
-| no policies configured | 6.7s | 1.6s |
-
-Reusing a verdict is not a weaker check: pnpm re-verifies whenever the lockfile content changes, and whenever the recorded policy is looser than the one now configured.
-
-The log is uploaded as soon as the install that produced it finishes, not at the end of the job, so nothing the job runs afterwards — its tests, its build, any later step — can alter what other jobs restore. Dependency lifecycle scripts are the exception, since they run inside the install itself, ahead of the upload: pnpm refuses to run them unless the repository allow-lists the package through `allowBuilds`, and a package on that list can already run code in the job.
-
-Before uploading, the action checks that the log grew the way an install grows it: every record that predated the install still there, and no more new records than installs it ran. A dependency's script that slips an extra record in is caught by that, and the log is not cached — the next job re-verifies, which costs seconds and nothing else.
-
-A job that installs in a step of its own rather than through this action is saved at the end of the job instead, since that is the first moment the log is known to be complete. The record count cannot be bounded there, so only the "nothing disappeared" half of the check applies.
-
-### Cache dependencies from multiple lockfiles
-
-```yaml
-on:
-  - push
-  - pull_request
-
-jobs:
-  cache-and-install-multiple:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v6
-        with:
-          version: 10
-          cache: true
-          cache_dependency_path: |
-            one/pnpm-lock.yaml
-            two/pnpm-lock.yaml
-          run_install: |
-            - cwd: one
-            - cwd: two
-```
-
 ## Notes
 
-This action does not set up Node.js. Use [actions/setup-node](https://github.com/actions/setup-node) yourself. If you are on pnpm v11 or newer, [`pnpm/setup`](https://github.com/pnpm/setup) can install pnpm and Node.js in a single step.
+This action does not setup Node.js for you, use [actions/setup-node](https://github.com/actions/setup-node) yourself.
 
 ## License
 

action.yml

@@ -16,14 +16,11 @@ inputs:
     required: false
     default: 'null'
   cache:
-    description: |
+    description: Whether to cache the pnpm store directory
-      Whether to cache the pnpm store directory, keyed on the lockfile's
-      content hash. On pnpm v11 and newer, the results of pnpm's lockfile
-      verification are cached either way — see the README.
     required: false
     default: 'false'
   cache_dependency_path:
-    description: File path to the pnpm lockfile, whose contents hash will be used as a cache key. Accepts multiple paths delimited by newlines.
+    description: File path to the pnpm lockfile, which contents hash will be used as a cache key
     required: false
     default: 'pnpm-lock.yaml'
   package_json_file:

package.json

@@ -3,8 +3,7 @@
   "scripts": {
     "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --minify --outfile=dist/index.js --loader:.json=json",
     "build": "pnpm run build:bundle",
-    "start": "pnpm run build && sh ./run.sh",
+    "start": "pnpm run build && sh ./run.sh"
-    "update-bootstrap": "node scripts/update-bootstrap.mjs"
   },
   "dependencies": {
     "@actions/cache": "^4.1.0",

scripts/update-bootstrap.mjs

@@ -1,47 +0,0 @@
-#!/usr/bin/env node
-
-// Usage: node scripts/update-bootstrap.mjs [version]
-// If version is omitted, fetches the latest next-11 tag from npm.
-// Regenerates the bootstrap lockfiles used by action-setup to install pnpm via npm.
-
-import { execSync } from 'child_process'
-import { mkdtempSync, rmSync, readFileSync, writeFileSync } from 'fs'
-import { join } from 'path'
-import { tmpdir } from 'os'
-
-const BOOTSTRAP_DIR = new URL('../src/install-pnpm/bootstrap/', import.meta.url).pathname
-
-const version = process.argv[2] || resolveLatestVersion()
-
-console.log(`Updating bootstrap lockfiles to pnpm@${version} ...`)
-
-generateLock('pnpm-lock.json', { pnpm: version }, 'bootstrap-pnpm')
-generateLock('exe-lock.json', { '@pnpm/exe': version }, 'bootstrap-exe')
-
-console.log('Done!')
-
-function resolveLatestVersion() {
-  const json = execSync('npm view @pnpm/exe dist-tags --json', { encoding: 'utf8' })
-  const tags = JSON.parse(json)
-  const version = tags['next-11'] || tags['latest']
-  if (!version) {
-    console.error('Could not determine latest pnpm version from npm dist-tags')
-    process.exit(1)
-  }
-  return version
-}
-
-function generateLock(filename, dependencies, name) {
-  const tmp = mkdtempSync(join(tmpdir(), 'pnpm-bootstrap-'))
-  try {
-    writeFileSync(join(tmp, 'package.json'), JSON.stringify({ private: true, dependencies }))
-    execSync('npm install --package-lock-only --ignore-scripts', { cwd: tmp, stdio: 'pipe' })
-    const lock = readFileSync(join(tmp, 'package-lock.json'), 'utf8')
-    const parsed = JSON.parse(lock)
-    parsed.name = name
-    writeFileSync(join(BOOTSTRAP_DIR, filename), JSON.stringify(parsed, null, 2) + '\n')
-    console.log(`  ${filename} -> ${Object.values(dependencies)[0]}@${version}`)
-  } finally {
-    rmSync(tmp, { recursive: true, force: true })
-  }
-}

src/cache-restore/index.ts

@@ -4,10 +4,10 @@ import { Inputs } from '../inputs'
 import { runRestoreCache } from './run'
 
 export async function restoreCache(inputs: Inputs) {
+  if (!inputs.cache) return
+
   if (!isFeatureAvailable()) {
-    if (inputs.cache) {
+    warning('Cache is not available, skipping cache restoration')
-      warning('Cache is not available, skipping cache restoration')
-    }
     return
   }
 

src/cache-restore/run.ts

@@ -4,51 +4,23 @@ import { getExecOutput } from '@actions/exec'
 import { hashFiles } from '@actions/glob'
 import os from 'os'
 import { Inputs } from '../inputs'
-import { restoreVerificationCache } from '../lockfile-verification-cache'
-import { removeWindowsExtendedPathPrefix } from '../windows-path'
 
 export async function runRestoreCache(inputs: Inputs) {
-  const fileHash = await hashFiles(inputs.cacheDependencyPath)
-  if (!fileHash) {
-    // Both caches are keyed on the lockfile, so neither can be restored
-    // without one. Only the store cache was asked for by name.
-    if (inputs.cache) {
-      throw new Error('Some specified paths were not resolved, unable to cache dependencies.')
-    }
-    return
-  }
-
-  // Restored whether or not the store is cached: the log is a fraction of a
-  // kilobyte, and without it pnpm re-checks every lockfile entry against the
-  // registry on each run — seconds even on a repository that configures no
-  // supply-chain policies.
-  await restoreVerificationCache(fileHash)
-
-  if (inputs.cache) {
-    await runRestoreStoreCache(fileHash)
-  }
-}
-
-async function runRestoreStoreCache(fileHash: string) {
   const cachePath = await getCacheDirectory()
   saveState('cache_path', cachePath)
 
+  const fileHash = await hashFiles(inputs.cacheDependencyPath)
+  if (!fileHash) {
+    throw new Error('Some specified paths were not resolved, unable to cache dependencies.')
+  }
+
   const primaryKey = `pnpm-cache-${process.env.RUNNER_OS}-${os.arch()}-${fileHash}`
   debug(`Primary key is ${primaryKey}`)
   saveState('cache_primary_key', primaryKey)
 
-  // We don't need to download everything again if only one dependency changed
+  let cacheKey = await restoreCache([cachePath], primaryKey)
-  // We can still re-use previous store to cache the rest of the unchanged dependencies
-  const restoreKeys = [
-    `pnpm-cache-${process.env.RUNNER_OS}-${os.arch()}-`
-  ];
 
-  let cacheKey = await restoreCache([cachePath], primaryKey, restoreKeys)
+  setOutput('cache-hit', Boolean(cacheKey))
-
-  // A restore-key (prefix) match still restores an older store, but "cache-hit"
-  // must only report an exact primary-key match, so dependency installation
-  // is not skipped when the lockfile has changed.
-  setOutput('cache-hit', cacheKey === primaryKey)
 
   if (!cacheKey) {
     info(`Cache is not found`)
@@ -61,7 +33,7 @@ async function runRestoreStoreCache(fileHash: string) {
 
 async function getCacheDirectory() {
   const { stdout } = await getExecOutput('pnpm store path --silent')
-  const cacheFolderPath = removeWindowsExtendedPathPrefix(stdout.trim())
+  const cacheFolderPath = stdout.trim()
   debug(`Cache folder is set to "${cacheFolderPath}"`)
   return cacheFolderPath
 }

src/index.ts

@@ -3,41 +3,33 @@ import restoreCache from './cache-restore'
 import saveCache from './cache-save'
 import getInputs, { Inputs } from './inputs'
 import installPnpm from './install-pnpm'
-import { saveVerificationCache } from './lockfile-verification-cache'
 import setOutputs from './outputs'
 import pnpmInstall from './pnpm-install'
 import pruneStore from './pnpm-store-prune'
 
 async function main() {
+  const inputs = getInputs()
+
   if (getState('is_post') === 'true') {
-    await runPost()
+    await runPost(inputs)
   } else {
-    await runMain()
+    await runMain(inputs)
   }
 }
 
-async function runMain() {
+async function runMain(inputs: Inputs) {
-  const inputs = getInputs()
-  saveState('inputs', inputs)
   saveState('is_post', 'true')
 
-  const binDest = await installPnpm(inputs)
+  await installPnpm(inputs)
-  if (binDest === undefined) return
   console.log('Installation Completed!')
-  setOutputs(inputs, binDest)
+  setOutputs(inputs)
 
   await restoreCache(inputs)
 
   pnpmInstall(inputs)
-  await saveVerificationCache(inputs.runInstall.length)
 }
 
-async function runPost() {
+async function runPost(inputs: Inputs) {
-  const inputs = JSON.parse(getState('inputs')) as Inputs
-  // Covers a job that installs in a later step of its own; when this action
-  // installed, the log was already saved then. Runs before the prune because
-  // pnpm versions before pnpm/pnpm#13893 delete the log during one.
-  await saveVerificationCache()
   pruneStore(inputs)
   await saveCache(inputs)
 }

src/install-pnpm/bootstrap/exe-lock.json

@@ -5,18 +5,17 @@
   "packages": {
     "": {
       "dependencies": {
-        "@pnpm/exe": "11.19.0"
+        "@pnpm/exe": "11.0.0-beta.3"
       }
     },
     "node_modules/@pnpm/exe": {
-      "version": "11.19.0",
+      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.19.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-beta.3.tgz",
-      "integrity": "sha512-P1mw8BZaNkEpttlyzKsxTj7PVs94bMB4cQ8pJhgbrCTSBP7xCzKS3VlOwIInS7aS5by6KAbfO5Vs9yK/ekugrg==",
+      "integrity": "sha512-yWNlHHdYmvf4c0MCkCzAa4csJDPdA+7yJCbXBUDXMbUu/0Zv/AxtO77q24MwlnBUC0dWeA+0F/pPmdkR9aTV2A==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@reflink/reflink": "0.1.19",
+        "@reflink/reflink": "0.1.19"
-        "detect-libc": "^2.1.2"
       },
       "bin": {
         "pn": "pn",
@@ -28,19 +27,18 @@
         "url": "https://opencollective.com/pnpm"
       },
       "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.19.0",
+        "@pnpm/linux-arm64": "11.0.0-beta.3",
-        "@pnpm/linux-x64": "11.19.0",
+        "@pnpm/linux-x64": "11.0.0-beta.3",
-        "@pnpm/linuxstatic-arm64": "11.19.0",
+        "@pnpm/macos-arm64": "11.0.0-beta.3",
-        "@pnpm/linuxstatic-x64": "11.19.0",
+        "@pnpm/macos-x64": "11.0.0-beta.3",
-        "@pnpm/macos-arm64": "11.19.0",
+        "@pnpm/win-arm64": "11.0.0-beta.3",
-        "@pnpm/win-arm64": "11.19.0",
+        "@pnpm/win-x64": "11.0.0-beta.3"
-        "@pnpm/win-x64": "11.19.0"
       }
     },
     "node_modules/@pnpm/linux-arm64": {
-      "version": "11.19.0",
+      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.19.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-c5AJqnsj0BMqMCOtctOzsCqyfY+afFe1kdM9F2FrNhYwtnQRMHoJy+51qfee4yuTPOVRyk3Yh1dwvyAadiznvA==",
+      "integrity": "sha512-TF2fyuCY9GggR4kfhjo1hMmgn+rIohenwNoH0tLPM7JlBK7/UAIFt1LI+o999tRwTCEw7gnxHFwtI2vyQuDfNw==",
       "cpu": [
         "arm64"
       ],
@@ -54,9 +52,9 @@
       }
     },
     "node_modules/@pnpm/linux-x64": {
-      "version": "11.19.0",
+      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.19.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-KOKpA9o75SvmRQgWO+EqEpQzJg1b9uHk5y61PAx90sSpdYtKDPua2eBXBglzv8YK1xM3DsYXFEf7Scs+3HeDsA==",
+      "integrity": "sha512-7GrLsnSuDH62y486GUTwJdohGIC1ugz9ZJkbKOHgxIAkNGcSTJ1IkkdARtv7/WMmOEwwESDmtpOQ6LmjnpDMSA==",
       "cpu": [
         "x64"
       ],
@@ -69,48 +67,10 @@
         "url": "https://opencollective.com/pnpm"
       }
     },
-    "node_modules/@pnpm/linuxstatic-arm64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.19.0.tgz",
-      "integrity": "sha512-Ci9WxgCInZc3F43R6BfaHevi+dYqaI5CLi6421egFsK649eHvYPytvu+zABhTNlYGNJbD8j9w+AUYInz/TPsyQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
-    "node_modules/@pnpm/linuxstatic-x64": {
-      "version": "11.19.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.19.0.tgz",
-      "integrity": "sha512-GNMk96vNJ4uEWigekarjHofXNDFsTYRL0Mw2YlDkv/W+u0cn/UAVPHfd5aAfsf6Arel2ZQfxPUTXlpunFujWnA==",
-      "cpu": [
-        "x64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
     "node_modules/@pnpm/macos-arm64": {
-      "version": "11.19.0",
+      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.19.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-I3Ee/GQlPxEOeBSzqxBNwcTHxVebjMiN2xLdTBS6OK2TAPzbWMIExjU5brxhr8rAk73p7mbv/a/2tFC/3gl6FA==",
+      "integrity": "sha512-NQKgI1DURrEiOUzpxL0Mc+yn7DV4tpShqGnjaJLbz8ZCXsX/qhmybebvCG3r+IfSk3P5KID66lcgC/Osiaz0Dg==",
       "cpu": [
         "arm64"
       ],
@@ -123,10 +83,26 @@
         "url": "https://opencollective.com/pnpm"
       }
     },
+    "node_modules/@pnpm/macos-x64": {
+      "version": "11.0.0-beta.3",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-beta.3.tgz",
+      "integrity": "sha512-Ky22KFYHXx8+8WU4KJT9NXVgzFioL2w9pHTQjsqTK70AbxiErscPYhrFIehlCNbXjgs+tGVIy13QNKkiwvmS8w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
     "node_modules/@pnpm/win-arm64": {
-      "version": "11.19.0",
+      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.19.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-rOiWuJ9wjaFY9ZDVPGVjpvjIQHZNB72rioxvuyzDKJ7dqKQ97VF27a4rmOtjhMB5u83cdDGEJ+OY+H1+TP+frw==",
+      "integrity": "sha512-7L8TFNDm25m+XYSyhcola3YFd/li6BZzzl56SsyGnZabsvUslMwnDiJad48wOz8IuN7zsrTSGh+X/x6F+GdrFQ==",
       "cpu": [
         "arm64"
       ],
@@ -140,9 +116,9 @@
       }
     },
     "node_modules/@pnpm/win-x64": {
-      "version": "11.19.0",
+      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.19.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-beta.3.tgz",
-      "integrity": "sha512-l26XeTxoGxfU+mVcZ5jFdP9hNe5yrOlLPSkAlwwpXPI1iyyU4JUSxm6Jdyxu1UAU1FerD/BvLK2vrlR6d9ogag==",
+      "integrity": "sha512-Z/6OpMUaIpggXjCtWEhp6kWjiT/2EImhkJAu8AodOORqeNcWouGEq3sO4XU0em6d+pAHmdV0hWMQ2xCUmPVuiA==",
       "cpu": [
         "x64"
       ],
@@ -213,9 +189,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -232,9 +205,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -251,9 +221,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -270,9 +237,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -313,15 +277,6 @@
       "engines": {
         "node": ">= 10"
       }
-    },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8"
-      }
     }
   }
 }

src/install-pnpm/bootstrap/pnpm-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "pnpm": "11.19.0"
+        "pnpm": "11.0.0-beta.3"
       }
     },
     "node_modules/pnpm": {
-      "version": "11.19.0",
+      "version": "11.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.19.0.tgz",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-beta.3.tgz",
-      "integrity": "sha512-eIHz7VkNRyxKlV4riLISF5ERYGbcyIy8o4SeybYPG7qm0syyIfqR2k4cZb7yvL43k2Wup6xTnHv4be3DobItzg==",
+      "integrity": "sha512-6PrfRjycZV4vRX6ttG9oR6pOgbI2/OcF2QLOzHm35UcRuvtqP4zf3wQfAAPwEbeu1uAbpSg/Q5cL8h32tumy6Q==",
       "license": "MIT",
       "bin": {
         "pn": "bin/pnpm.mjs",

src/install-pnpm/index.ts

@@ -4,15 +4,13 @@ import runSelfInstaller from './run'
 
 export { runSelfInstaller }
 
-export async function install(inputs: Inputs): Promise<string | undefined> {
+export async function install(inputs: Inputs) {
   startGroup('Running self-installer...')
-  const { exitCode, binDest } = await runSelfInstaller(inputs)
+  const status = await runSelfInstaller(inputs)
   endGroup()
-  if (exitCode) {
+  if (status) {
-    setFailed(`Something went wrong, self-installer exits with code ${exitCode}`)
+    return setFailed(`Something went wrong, self-installer exits with code ${status}`)
-    return undefined
   }
-  return binDest
 }
 
 export default install

src/install-pnpm/run.ts

@@ -12,12 +12,7 @@ import exeLock from './bootstrap/exe-lock.json'
 const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
 const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })
 
-export interface SelfInstallerResult {
+export async function runSelfInstaller(inputs: Inputs): Promise<number> {
-  exitCode: number
-  binDest: string
-}
-
-export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerResult> {
   const { version, dest, packageJsonFile } = inputs
 
   // pnpm v11 requires Node >= 22.13; use standalone (exe) bootstrap which
@@ -34,81 +29,49 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
   await writeFile(path.join(dest, 'package.json'), packageJson)
   await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))
 
-  // Append the action's node directory to PATH so npm's
+  const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest })
-  // `#!/usr/bin/env node` shebang resolves on runners (e.g. GHE
-  // self-hosted) where node isn't already on PATH. Append (not
-  // prepend) so a user-installed toolchain on PATH — e.g. from a
-  // prior `setup-node` step — keeps precedence; otherwise the
-  // runner-bundled node would shadow it and pair the user's npm
-  // with a mismatched node version. npm itself is resolved via
-  // PATH — on the GitHub Actions runner it is not co-located with
-  // `process.execPath`.
-  const nodeDir = path.dirname(process.execPath)
-  // On Windows, the PATH key casing varies; search case-insensitively.
-  const pathKey = Object.keys(process.env).find(k => k.toUpperCase() === 'PATH') ?? 'PATH'
-  const currentPath = process.env[pathKey]
-  const npmEnv = { ...process.env, [pathKey]: currentPath ? currentPath + path.delimiter + nodeDir : nodeDir }
-  const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest, env: npmEnv })
   if (npmExitCode !== 0) {
-    return { exitCode: npmExitCode, binDest: path.join(dest, 'node_modules', '.bin') }
+    return npmExitCode
   }
 
-  // On Windows with standalone mode, npm's .bin shims can't properly
+  const pnpmHome = path.join(dest, 'node_modules', '.bin')
-  // execute the extensionless @pnpm/exe native binaries. Add the
-  // @pnpm/exe directory directly to PATH so pnpm.exe is found natively.
-  const pnpmHome = standalone && process.platform === 'win32'
-    ? path.join(dest, 'node_modules', '@pnpm', 'exe')
-    : path.join(dest, 'node_modules', '.bin')
-  // PNPM_HOME/bin is where `pnpm self-update` places the target version
-  // binary. It must have higher PATH precedence than pnpmHome (which
-  // contains the bootstrap binary) so the self-updated version is found
-  // first. The bootstrap pnpm is invoked via absolute path, not PATH,
-  // so this ordering does not affect the bootstrap step.
   addPath(pnpmHome)
   addPath(path.join(pnpmHome, 'bin'))
   exportVariable('PNPM_HOME', pnpmHome)
 
   // Ensure pnpm bin link exists — npm ci sometimes doesn't create it
-  if (process.platform !== 'win32') {
+  const pnpmBinLink = path.join(pnpmHome, 'pnpm')
-    const pnpmBinLink = path.join(dest, 'node_modules', '.bin', 'pnpm')
+  if (!existsSync(pnpmBinLink)) {
-    if (!existsSync(pnpmBinLink)) {
+    await mkdir(pnpmHome, { recursive: true })
-      await mkdir(path.join(dest, 'node_modules', '.bin'), { recursive: true })
+    const target = standalone
-      const target = standalone
+      ? path.join('..', '@pnpm', 'exe', 'pnpm')
-        ? path.join('..', '@pnpm', 'exe', 'pnpm')
+      : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
-        : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
+    await symlink(target, pnpmBinLink)
-      await symlink(target, pnpmBinLink)
-    }
   }
 
   const bootstrapPnpm = standalone
-    ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
+    ? path.join(dest, 'node_modules', '@pnpm', 'exe', 'pnpm')
     : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
 
-  // Self-update the bootstrap to the requested pnpm version. readTargetVersion
+  // Determine the target version
-  // either returns a value or throws, so this always runs.
   const targetVersion = readTargetVersion({ version, packageJsonFile })
-  const cmd = standalone ? bootstrapPnpm : process.execPath
+
-  const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
+  if (targetVersion) {
-  const exitCode = await runCommand(cmd, args, { cwd: dest })
+    const cmd = standalone ? bootstrapPnpm : process.execPath
-  if (exitCode !== 0) {
+    const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
-    return { exitCode, binDest: pnpmHome }
+    const exitCode = await runCommand(cmd, args, { cwd: dest })
+    if (exitCode !== 0) {
+      return exitCode
+    }
   }
-  // self-update writes the target pnpm/pnpx into PNPM_HOME/bin, leaving
+
-  // the bootstrap symlinks in pnpmHome pointing at the old version. Use
+  return 0
-  // PNPM_HOME/bin so consumers of the bin_dest output (e.g.
-  // `${steps.pnpm.outputs.bin_dest}/pnpm`) invoke the requested version.
-  //
-  // When the requested version resolves to the bootstrap version, self-update
-  // is a no-op and PNPM_HOME/bin is not created — fall back to pnpmHome,
-  // whose symlinks already point at the right version.
-  const updatedBinDir = path.join(pnpmHome, 'bin')
-  return { exitCode: 0, binDest: existsSync(updatedBinDir) ? updatedBinDir : pnpmHome }
 }
 
 function readTargetVersion(opts: {
   readonly version?: string | undefined
   readonly packageJsonFile: string
-}): string {
+}): string | undefined {
   const { version, packageJsonFile } = opts
   const { GITHUB_WORKSPACE } = process.env
 
@@ -129,15 +92,12 @@ function readTargetVersion(opts: {
     }
   }
 
-  // packageManager is always exact `pnpm@<version>[+<integrity>]` per spec.
-  // Strip the integrity hash for self-update.
-  const packageManagerVersion =
-    typeof packageManager === 'string' && packageManager.startsWith('pnpm@')
-      ? packageManager.slice('pnpm@'.length).split('+')[0]
-      : undefined
-
   if (version) {
-    if (packageManagerVersion && packageManagerVersion !== version) {
+    if (
+      typeof packageManager === 'string' &&
+      packageManager.startsWith('pnpm@') &&
+      packageManager.replace('pnpm@', '') !== version
+    ) {
       throw new Error(`Multiple versions of pnpm specified:
   - version ${version} in the GitHub Action config with the key "version"
   - version ${packageManager} in the package.json with the key "packageManager"
@@ -147,22 +107,13 @@ Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_
     return version
   }
 
-  // Self-update the bootstrap pnpm to the version pinned in package.json so
+  // pnpm will automatically download and switch to the right version
-  // PATH-resolved `pnpm` (and the bin_dest output) reflect the target
+  if (typeof packageManager === 'string' && packageManager.startsWith('pnpm@')) {
-  // version. Without this, `pnpm store path` runs as the bootstrap and
+    return undefined
-  // reports a different STORE_VERSION than the one the user's actual
-  // install writes to — breaking cache: true and actions/setup-node's
-  // `cache: pnpm` on cold caches (issue #233).
-  //
-  // devEngines.packageManager takes priority over packageManager, matching
-  // pnpm's getWantedPackageManager logic. `pnpm self-update` accepts both
-  // exact versions and semver ranges, so we pass either through directly.
-  if (devEngines?.packageManager?.name === 'pnpm' && devEngines.packageManager.version) {
-    return devEngines.packageManager.version
   }
 
-  if (packageManagerVersion) {
+  if (devEngines?.packageManager?.name === 'pnpm' && devEngines.packageManager.version) {
-    return packageManagerVersion
+    return undefined
   }
 
   if (!GITHUB_WORKSPACE) {
@@ -192,11 +143,10 @@ function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
   })
 }
 
-function runCommand(cmd: string, args: string[], opts: { cwd: string; env?: Record<string, string | undefined> }): Promise<number> {
+function runCommand(cmd: string, args: string[], opts: { cwd: string }): Promise<number> {
   return new Promise<number>((resolve, reject) => {
     const cp = spawn(cmd, args, {
       cwd: opts.cwd,
-      env: opts.env,
       stdio: ['pipe', 'inherit', 'inherit'],
       shell: process.platform === 'win32',
     })

src/lockfile-verification-cache/index.ts

@@ -1,164 +0,0 @@
-import { restoreCache, saveCache } from '@actions/cache'
-import { debug, getState, info, saveState, warning } from '@actions/core'
-import { getExecOutput } from '@actions/exec'
-import { existsSync, readFileSync } from 'fs'
-import os from 'os'
-import path from 'path'
-import { removeWindowsExtendedPathPrefix } from '../windows-path'
-
-/**
- * Where pnpm v11+ memoizes which lockfile passed which supply-chain policies.
- * A job without it re-checks every lockfile entry against the registry, which
- * on a large repository costs more than the install.
- */
-const VERIFICATION_CACHE_FILE = 'lockfile-verified.jsonl'
-
-const PATH_STATE = 'lockfile_verification_cache_path'
-const KEY_STATE = 'lockfile_verification_cache_key'
-const STORED_STATE = 'lockfile_verification_cache_stored'
-
-/**
- * Where the log lives and under which key it belongs in the cache. Held in
- * memory as well as in the action's state because the main and post steps run
- * as separate processes, and state written by one is only readable by the
- * other.
- */
-let target: { cacheFilePath: string, key: string } | undefined
-
-/** Whether this process already restored or saved the log. */
-let stored = false
-
-/** The log's records as they stood before the install ran. */
-let recordsBeforeInstall: string[] | undefined
-
-/**
- * The verdict is only valid for the exact lockfile content it was recorded
- * for, so this cache is keyed on the same lockfile hash as the store cache
- * but restored without prefix fallback: an older entry could never be used.
- */
-export async function restoreVerificationCache(lockfileHash: string): Promise<void> {
-  try {
-    const cacheFilePath = path.join(await getPnpmCacheDirectory(), VERIFICATION_CACHE_FILE)
-    const key = `pnpm-lockfile-verified-${process.env.RUNNER_OS}-${os.arch()}-${lockfileHash}`
-    target = { cacheFilePath, key }
-    saveState(PATH_STATE, cacheFilePath)
-    saveState(KEY_STATE, key)
-    debug(`Lockfile verification cache path is ${cacheFilePath}, key is ${key}`)
-
-    const restoredKey = await restoreCache([cacheFilePath], key)
-    recordsBeforeInstall = readRecords(cacheFilePath)
-    if (!restoredKey) {
-      info('Lockfile verification cache is not found')
-      return
-    }
-
-    stored = true
-    saveState(STORED_STATE, 'true')
-    info(`Lockfile verification cache restored from key: ${restoredKey}`)
-  } catch (error) {
-    // The gate only costs time, never correctness — a job that cannot reuse
-    // a past verdict re-verifies and moves on.
-    warning(`Failed to restore the lockfile verification cache: ${(error as Error).message}`)
-  }
-}
-
-/**
- * Uploaded as soon as the install that produced the log finishes, rather than
- * at the end of the job: whatever a job runs after installing can rewrite the
- * log on disk, and the job's own cache write would then publish that for later
- * jobs to trust. Lifecycle scripts of the installed packages stay inside the
- * window — they run during the install — but pnpm only runs those the
- * repository has allow-listed, and `expectedNewRecords` catches what they
- * append.
- *
- * Safe to call more than once; the second call is a no-op.
- */
-export async function saveVerificationCache(expectedNewRecords = Infinity): Promise<void> {
-  if (stored || getState(STORED_STATE) === 'true') return
-
-  const cacheFilePath = target?.cacheFilePath ?? getState(PATH_STATE)
-  const key = target?.key ?? getState(KEY_STATE)
-  if (!cacheFilePath || !key || !existsSync(cacheFilePath)) return
-
-  if (!onlyGrewAsExpected(cacheFilePath, expectedNewRecords)) return
-
-  try {
-    const cacheId = await saveCache([cacheFilePath], key)
-    if (cacheId === -1) return
-    stored = true
-    saveState(STORED_STATE, 'true')
-    info(`Lockfile verification cache saved with the key: ${key}`)
-  } catch (error) {
-    warning(`Failed to save the lockfile verification cache: ${(error as Error).message}`)
-  }
-}
-
-/**
- * An install appends its own verdict and leaves every earlier record in place.
- * Anything else — a record the install did not write, or an earlier one gone —
- * means something other than pnpm's verification wrote to the log, and
- * uploading it would hand that to every later job. pnpm compacting the log
- * (past a thousand records) lands here too, at the cost of one re-verification.
- */
-function onlyGrewAsExpected(cacheFilePath: string, expectedNewRecords: number): boolean {
-  const before = recordsBeforeInstall
-  if (before === undefined) return true
-
-  const after = readRecords(cacheFilePath)
-  if (after === undefined) return false
-
-  if (!before.every((record, index) => after[index] === record)) {
-    warning(
-      'Records that predate the install are missing from the lockfile verification log; not caching it.'
-    )
-    return false
-  }
-
-  const added = after.length - before.length
-  if (added > expectedNewRecords) {
-    warning(
-      `The lockfile verification log gained ${added} records during the install, expected at most ${expectedNewRecords}; not caching it.`
-    )
-    return false
-  }
-
-  return true
-}
-
-function readRecords(cacheFilePath: string): string[] | undefined {
-  try {
-    return readFileSync(cacheFilePath, 'utf8').split('\n').filter(Boolean)
-  } catch {
-    return undefined
-  }
-}
-
-async function getPnpmCacheDirectory(): Promise<string> {
-  const { stdout } = await getExecOutput('pnpm config get cacheDir', undefined, {
-    silent: true,
-    ignoreReturnCode: true,
-  })
-  const configured = stdout.trim()
-  // `pnpm config get` reports settings, not defaults: an unset `cacheDir`
-  // prints `undefined` and the default has to be derived here.
-  if (configured && configured !== 'undefined') {
-    return removeWindowsExtendedPathPrefix(configured)
-  }
-  return defaultPnpmCacheDirectory()
-}
-
-/** Mirrors pnpm's own `cacheDir` default. */
-function defaultPnpmCacheDirectory(): string {
-  const { XDG_CACHE_HOME, LOCALAPPDATA } = process.env
-  if (XDG_CACHE_HOME) return path.join(XDG_CACHE_HOME, 'pnpm')
-
-  const homeDir = os.homedir()
-  switch (process.platform) {
-  case 'darwin':
-    return path.join(homeDir, 'Library', 'Caches', 'pnpm')
-  case 'win32':
-    return LOCALAPPDATA ? path.join(LOCALAPPDATA, 'pnpm-cache') : path.join(homeDir, '.pnpm-cache')
-  default:
-    return path.join(homeDir, '.cache', 'pnpm')
-  }
-}

src/outputs/index.ts

@@ -1,9 +1,10 @@
-import { setOutput } from '@actions/core'
+import { setOutput, addPath } from '@actions/core'
 import { Inputs } from '../inputs'
+import { getBinDest } from '../utils'
 
-export function setOutputs(inputs: Inputs, binDest: string) {
+export function setOutputs(inputs: Inputs) {
-  // NOTE: addPath is already called in installPnpm — do not call it again
+  const binDest = getBinDest(inputs)
-  // here, as a second addPath would shadow the correct entry on Windows.
+  addPath(binDest)
   setOutput('dest', inputs.dest)
   setOutput('bin_dest', binDest)
 }

src/pnpm-install/index.ts

@@ -1,8 +1,11 @@
 import { setFailed, startGroup, endGroup } from '@actions/core'
 import { spawnSync } from 'child_process'
 import { Inputs } from '../inputs'
+import { patchPnpmEnv } from '../utils'
 
 export function runPnpmInstall(inputs: Inputs) {
+  const env = patchPnpmEnv(inputs)
+
   for (const options of inputs.runInstall) {
     const args = ['install']
     if (options.recursive) args.unshift('recursive')
@@ -11,16 +14,11 @@ export function runPnpmInstall(inputs: Inputs) {
     const cmdStr = ['pnpm', ...args].join(' ')
     startGroup(`Running ${cmdStr}...`)
 
-    // spawnSync inherits process.env, which already has $PNPM_HOME/bin and
-    // $PNPM_HOME prepended via addPath() in install-pnpm. Do NOT pass a
-    // hand-patched env that adds node_modules/.bin to the front — on
-    // Windows standalone, .bin/pnpm.cmd is an npm shim pointing at the
-    // BOOTSTRAP pnpm, which would shadow the self-updated one and break
-    // newer-pnpm-only behavior.
     const { error, status } = spawnSync('pnpm', args, {
       stdio: 'inherit',
       cwd: options.cwd,
       shell: true,
+      env,
     })
 
     endGroup()

src/pnpm-store-prune/index.ts

@@ -1,6 +1,7 @@
 import { warning, startGroup, endGroup } from '@actions/core'
 import { spawnSync } from 'child_process'
 import { Inputs } from '../inputs'
+import { patchPnpmEnv } from '../utils'
 
 export function pruneStore(inputs: Inputs) {
   if (inputs.runInstall.length === 0) {
@@ -9,11 +10,10 @@ export function pruneStore(inputs: Inputs) {
   }
 
   startGroup('Running pnpm store prune...')
-  // spawnSync inherits process.env (which has the right PATH from addPath
-  // in install-pnpm). See pnpm-install/index.ts for the rationale.
   const { error, status } = spawnSync('pnpm', ['store', 'prune'], {
     stdio: 'inherit',
     shell: true,
+    env: patchPnpmEnv(inputs),
   })
   endGroup()
 

src/utils/index.ts

@@ -0,0 +1,10 @@
+import path from 'path'
+import process from 'process'
+import { Inputs } from '../inputs'
+
+export const getBinDest = (inputs: Inputs): string => path.join(inputs.dest, 'node_modules', '.bin')
+
+export const patchPnpmEnv = (inputs: Inputs): NodeJS.ProcessEnv => ({
+  ...process.env,
+  PATH: path.join(getBinDest(inputs), 'bin') + path.delimiter + getBinDest(inputs) + path.delimiter + process.env.PATH,
+})

src/windows-path/index.ts

@@ -1,19 +0,0 @@
-/**
- * pnpm may report an extended-length path on Windows. The `?` in that prefix
- * is interpreted as a wildcard by `@actions/cache`, which rejects it as a glob
- * in the root segment. Cache APIs do not need the extended-length form, so
- * convert it back to a regular drive or UNC path.
- */
-export function removeWindowsExtendedPathPrefix(cachePath: string): string {
-  const extendedPathPrefix = '\\\\?\\'
-  if (!cachePath.startsWith(extendedPathPrefix)) return cachePath
-
-  const pathWithoutPrefix = cachePath.slice(extendedPathPrefix.length)
-  const uncPrefix = 'UNC\\'
-  if (pathWithoutPrefix.toUpperCase().startsWith(uncPrefix)) {
-    return `\\\\${pathWithoutPrefix.slice(uncPrefix.length)}`
-  }
-  return pathWithoutPrefix
-}
-
-export default removeWindowsExtendedPathPrefix