fix: update pnpm to 11.0.0-rc.5

The existing version tests only check output format via regex, which is
why the PATH-shadowing bug (#230) slipped through — the bootstrap pnpm's
version string matched the regex just as well as the requested version.

- test_version_respects_request: runs the action with `version: 9.15.5`
  and `version: 10.33.0` (both differ from the bootstrap) and asserts
  that `pnpm --version` matches exactly. Regression test for #225/#230.

- test_package_manager_field: writes a `packageManager: pnpm@<v>` entry
  into package.json, runs the action with no `version:` input, and
  asserts exact match. Reproduces #227; currently expected to fail
  since `packageManager` extraction was intentionally not added.

.github/workflows/test.yaml

@@ -129,6 +129,82 @@ jobs:
           pnpm add is-odd
         shell: bash
 
+  test_version_respects_request:
+    name: 'Test version input is actually installed (${{ matrix.version }}, ${{ matrix.os }})'
+    # Regression test for #225 / #230: the bootstrap pnpm on PATH was shadowing the self-updated binary,
+    # so a user requesting e.g. `version: 9.15.5` would silently get the bootstrap version.
+
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+        version:
+          - '9.15.5'
+          - '10.33.0'
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Run the action
+        uses: ./
+        with:
+          version: ${{ matrix.version }}
+
+      - name: 'Test: exact version installed'
+        run: |
+          required='${{ matrix.version }}'
+          actual="$(pnpm --version)"
+          echo "pnpm version: ${actual}"
+          if [ "${actual}" != "${required}" ]; then
+            echo "Expected pnpm version ${required}, but got ${actual}"
+            exit 1
+          fi
+        shell: bash
+
+  test_package_manager_field:
+    name: 'Test packageManager field is respected (${{ matrix.version }}, ${{ matrix.os }})'
+    # Reproduces #227: when `packageManager` is set in package.json and no `version:` input is given,
+    # the action should install the version specified there.
+
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+        version:
+          - '9.15.5'
+          - '10.33.0'
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Set up package.json with packageManager field
+        run: echo '{"packageManager":"pnpm@${{ matrix.version }}"}' > package.json
+        shell: bash
+
+      - name: Run the action
+        uses: ./
+
+      - name: 'Test: exact version installed'
+        run: |
+          required='${{ matrix.version }}'
+          actual="$(pnpm --version)"
+          echo "pnpm version: ${actual}"
+          if [ "${actual}" != "${required}" ]; then
+            echo "Expected pnpm version ${required}, but got ${actual}"
+            exit 1
+          fi
+        shell: bash
+
   test_dev_engines:
     name: Test with devEngines.packageManager
 

.gitignore

@@ -9,3 +9,4 @@ temp
 tmp.*
 temp.*
 .pnpm-store
+.claude

README.md

@@ -14,7 +14,7 @@ Version of pnpm to install.
 
 **Optional** when there is a [`packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
 
-otherwise, this field is **required** It supports npm versioning scheme, it could be an exact version (such as `6.24.1`), or a version range (such as `6`, `6.x.x`, `6.24.x`, `^6.24.1`, `*`, etc.), or `latest`.
+otherwise, this field is **required** It supports npm versioning scheme, it could be an exact version (such as `10.9.8`), or a version range (such as `10`, `10.x.x`, `10.9.x`, `^10.9.8`, `*`, etc.), or `latest`.
 
 ### `dest`
 
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
           version: 10
 ```
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
 ```
 
 ### Install pnpm and a few npm packages
@@ -120,9 +120,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
           version: 10
           run_install: |
@@ -144,9 +144,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           version: 10

package.json

@@ -3,7 +3,8 @@
   "scripts": {
     "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --minify --outfile=dist/index.js --loader:.json=json",
     "build": "pnpm run build:bundle",
-    "start": "pnpm run build && sh ./run.sh"
+    "start": "pnpm run build && sh ./run.sh",
+    "update-bootstrap": "node scripts/update-bootstrap.mjs"
   },
   "dependencies": {
     "@actions/cache": "^4.1.0",

scripts/update-bootstrap.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+// Usage: node scripts/update-bootstrap.mjs [version]
+// If version is omitted, fetches the latest next-11 tag from npm.
+// Regenerates the bootstrap lockfiles used by action-setup to install pnpm via npm.
+
+import { execSync } from 'child_process'
+import { mkdtempSync, rmSync, readFileSync, writeFileSync } from 'fs'
+import { join } from 'path'
+import { tmpdir } from 'os'
+
+const BOOTSTRAP_DIR = new URL('../src/install-pnpm/bootstrap/', import.meta.url).pathname
+
+const version = process.argv[2] || resolveLatestVersion()
+
+console.log(`Updating bootstrap lockfiles to pnpm@${version} ...`)
+
+generateLock('pnpm-lock.json', { pnpm: version }, 'bootstrap-pnpm')
+generateLock('exe-lock.json', { '@pnpm/exe': version }, 'bootstrap-exe')
+
+console.log('Done!')
+
+function resolveLatestVersion() {
+  const json = execSync('npm view @pnpm/exe dist-tags --json', { encoding: 'utf8' })
+  const tags = JSON.parse(json)
+  const version = tags['next-11'] || tags['latest']
+  if (!version) {
+    console.error('Could not determine latest pnpm version from npm dist-tags')
+    process.exit(1)
+  }
+  return version
+}
+
+function generateLock(filename, dependencies, name) {
+  const tmp = mkdtempSync(join(tmpdir(), 'pnpm-bootstrap-'))
+  try {
+    writeFileSync(join(tmp, 'package.json'), JSON.stringify({ private: true, dependencies }))
+    execSync('npm install --package-lock-only --ignore-scripts', { cwd: tmp, stdio: 'pipe' })
+    const lock = readFileSync(join(tmp, 'package-lock.json'), 'utf8')
+    const parsed = JSON.parse(lock)
+    parsed.name = name
+    writeFileSync(join(BOOTSTRAP_DIR, filename), JSON.stringify(parsed, null, 2) + '\n')
+    console.log(`  ${filename} -> ${Object.values(dependencies)[0]}@${version}`)
+  } finally {
+    rmSync(tmp, { recursive: true, force: true })
+  }
+}

src/install-pnpm/bootstrap/exe-lock.json

@@ -5,17 +5,18 @@
   "packages": {
     "": {
       "dependencies": {
-        "@pnpm/exe": "11.0.0-beta.3"
+        "@pnpm/exe": "11.0.0-rc.5"
       }
     },
     "node_modules/@pnpm/exe": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.0.0-rc.5.tgz",
-      "integrity": "sha512-yWNlHHdYmvf4c0MCkCzAa4csJDPdA+7yJCbXBUDXMbUu/0Zv/AxtO77q24MwlnBUC0dWeA+0F/pPmdkR9aTV2A==",
+      "integrity": "sha512-HT1HxzeFc6RVIMhngQZ7bQgTNzF0IckeFpOvnwCJKfsjfsD/po3LvUVsidCvpALxCWOft1TuBZUkdHq03pEolA==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@reflink/reflink": "0.1.19"
+        "@reflink/reflink": "0.1.19",
+        "detect-libc": "^2.0.3"
       },
       "bin": {
         "pn": "pn",
@@ -27,18 +28,20 @@
         "url": "https://opencollective.com/pnpm"
       },
       "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.0.0-beta.3",
+        "@pnpm/linux-arm64": "11.0.0-rc.5",
-        "@pnpm/linux-x64": "11.0.0-beta.3",
+        "@pnpm/linux-x64": "11.0.0-rc.5",
-        "@pnpm/macos-arm64": "11.0.0-beta.3",
+        "@pnpm/linuxstatic-arm64": "11.0.0-rc.5",
-        "@pnpm/macos-x64": "11.0.0-beta.3",
+        "@pnpm/linuxstatic-x64": "11.0.0-rc.5",
-        "@pnpm/win-arm64": "11.0.0-beta.3",
+        "@pnpm/macos-arm64": "11.0.0-rc.5",
-        "@pnpm/win-x64": "11.0.0-beta.3"
+        "@pnpm/macos-x64": "11.0.0-rc.5",
+        "@pnpm/win-arm64": "11.0.0-rc.5",
+        "@pnpm/win-x64": "11.0.0-rc.5"
       }
     },
     "node_modules/@pnpm/linux-arm64": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.0.0-rc.5.tgz",
-      "integrity": "sha512-TF2fyuCY9GggR4kfhjo1hMmgn+rIohenwNoH0tLPM7JlBK7/UAIFt1LI+o999tRwTCEw7gnxHFwtI2vyQuDfNw==",
+      "integrity": "sha512-AreNJJI0r5oEsv5+i+FMVK8AeYs0MpWTGWc2GQwf7qi/w8uA8UxVlIDwhgwY+R6YgdrYVrEjgbU4WcqIqYfgog==",
       "cpu": [
         "arm64"
       ],
@@ -52,9 +55,41 @@
       }
     },
     "node_modules/@pnpm/linux-x64": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.0.0-rc.5.tgz",
-      "integrity": "sha512-7GrLsnSuDH62y486GUTwJdohGIC1ugz9ZJkbKOHgxIAkNGcSTJ1IkkdARtv7/WMmOEwwESDmtpOQ6LmjnpDMSA==",
+      "integrity": "sha512-NzZPWeIVxCEfQs84wR/O3IND2HSDOClPB2L8vvkWb8KQ4pczOG2x3aNkltXDwYVKxvw4URmwct5u57JGTEvtfg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/linuxstatic-arm64": {
+      "version": "11.0.0-rc.5",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.0.0-rc.5.tgz",
+      "integrity": "sha512-xK+U/fJDkvzs4ktswrCZ03cTSEAeFTfgUG88r2J+6JEDGuY/foNOMnnSNOiSplpaufY+Ie+uL+PEDlTyIy46Xg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/pnpm"
+      }
+    },
+    "node_modules/@pnpm/linuxstatic-x64": {
+      "version": "11.0.0-rc.5",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.0.0-rc.5.tgz",
+      "integrity": "sha512-Z1kSilngaM2URfPhBjam/xhMDAn5jl8V0L5CjG/Gg5unmKkipyF93OYMpfnny7A9p1KWi6sNql/KufzUmRP4Eg==",
       "cpu": [
         "x64"
       ],
@@ -68,9 +103,9 @@
       }
     },
     "node_modules/@pnpm/macos-arm64": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.0.0-rc.5.tgz",
-      "integrity": "sha512-NQKgI1DURrEiOUzpxL0Mc+yn7DV4tpShqGnjaJLbz8ZCXsX/qhmybebvCG3r+IfSk3P5KID66lcgC/Osiaz0Dg==",
+      "integrity": "sha512-98p3ilSzkyusC2bxk7Ya34CWt9MeJy/+kpXfwn9YgnOD7GDqCjYY9dlPB9yrkdtKUUMeOIvOuacAQTWnCg2GOQ==",
       "cpu": [
         "arm64"
       ],
@@ -84,9 +119,9 @@
       }
     },
     "node_modules/@pnpm/macos-x64": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-x64/-/macos-x64-11.0.0-rc.5.tgz",
-      "integrity": "sha512-Ky22KFYHXx8+8WU4KJT9NXVgzFioL2w9pHTQjsqTK70AbxiErscPYhrFIehlCNbXjgs+tGVIy13QNKkiwvmS8w==",
+      "integrity": "sha512-WZ9UqjTbZN+dMZcy4qaPDsEo4sxTIrw5H+fDvdxT1GUavsf8SBDpvzZMHrGDQ/k22H8oKvPtJ+RGd/Ie5dvbuA==",
       "cpu": [
         "x64"
       ],
@@ -100,9 +135,9 @@
       }
     },
     "node_modules/@pnpm/win-arm64": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.0.0-rc.5.tgz",
-      "integrity": "sha512-7L8TFNDm25m+XYSyhcola3YFd/li6BZzzl56SsyGnZabsvUslMwnDiJad48wOz8IuN7zsrTSGh+X/x6F+GdrFQ==",
+      "integrity": "sha512-hxgDmF4xpSVvUPvH+HdMllvHcV2zuYUn/uK182gzFvZ9DE0xEGVj09XaSn5VMbpa32i25oIqaT89QfMcOw/TJg==",
       "cpu": [
         "arm64"
       ],
@@ -116,9 +151,9 @@
       }
     },
     "node_modules/@pnpm/win-x64": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.0.0-rc.5.tgz",
-      "integrity": "sha512-Z/6OpMUaIpggXjCtWEhp6kWjiT/2EImhkJAu8AodOORqeNcWouGEq3sO4XU0em6d+pAHmdV0hWMQ2xCUmPVuiA==",
+      "integrity": "sha512-B1H/6jhzW/6VLr8Bc3zOhMd2P3srANWytuBq0uppR5c7OJwUlqXqJtB6Q4nOEjWYZ2sA5m2xuFiaMeioZiiqgA==",
       "cpu": [
         "x64"
       ],
@@ -277,6 +312,15 @@
       "engines": {
         "node": ">= 10"
       }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
     }
   }
 }

src/install-pnpm/bootstrap/pnpm-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "pnpm": "11.0.0-beta.3"
+        "pnpm": "11.0.0-rc.5"
       }
     },
     "node_modules/pnpm": {
-      "version": "11.0.0-beta.3",
+      "version": "11.0.0-rc.5",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-beta.3.tgz",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.0.0-rc.5.tgz",
-      "integrity": "sha512-6PrfRjycZV4vRX6ttG9oR6pOgbI2/OcF2QLOzHm35UcRuvtqP4zf3wQfAAPwEbeu1uAbpSg/Q5cL8h32tumy6Q==",
+      "integrity": "sha512-xGn7aqE6meV67JNc17hv9CJwH0YC7KwiMdPcIJEFhuv7a1CntFXQd47CKuVpEtjY6I6fngoDwIdaakF4OpShvQ==",
       "license": "MIT",
       "bin": {
         "pn": "bin/pnpm.mjs",

src/install-pnpm/run.ts

@@ -40,11 +40,13 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
   const pnpmHome = standalone && process.platform === 'win32'
     ? path.join(dest, 'node_modules', '@pnpm', 'exe')
     : path.join(dest, 'node_modules', '.bin')
-  // pnpm expects PNPM_HOME/bin in PATH for global binaries (e.g. node
+  // PNPM_HOME/bin is where `pnpm self-update` places the target version
-  // installed via `pnpm runtime`). Add it first so the next addPath
+  // binary. It must have higher PATH precedence than pnpmHome (which
-  // (pnpmHome itself, which contains pnpm.exe) has higher precedence.
+  // contains the bootstrap binary) so the self-updated version is found
-  addPath(path.join(pnpmHome, 'bin'))
+  // first. The bootstrap pnpm is invoked via absolute path, not PATH,
+  // so this ordering does not affect the bootstrap step.
   addPath(pnpmHome)
+  addPath(path.join(pnpmHome, 'bin'))
   exportVariable('PNPM_HOME', pnpmHome)
 
   // Ensure pnpm bin link exists — npm ci sometimes doesn't create it