feat: support pnpm v12 (#288)

* feat: support pnpm v12

Approve the pinned @pnpm/exe install script for npm 12, add pnpm 12 coverage across supported runner platforms, and clarify that action-setup remains supported alongside pnpm/setup.

* refactor: use pnpm 12 native bootstrap

Install the plain pnpm v12 package as the single native bootstrap, remove the legacy @pnpm/exe lockfile and runtime path, and retain the standalone input as a no-op for workflow compatibility.

* fix: keep bootstrap updates on pnpm 12

Handle npm's array-shaped view output and resolve only pnpm 12 distribution tags.

* fix: use native bootstrap only for pnpm 12

Route pnpm 12-only versions and ranges through the plain pnpm native package while preserving the existing Node and @pnpm/exe bootstrap paths for older releases.

* style: remove updater narrative comments

src/install-pnpm/run.ts

@@ -6,11 +6,28 @@ import path from 'path'
 import util from 'util'
 import { Inputs } from '../inputs'
 import { parse as parseYaml } from 'yaml'
+import { satisfies, subset, validRange } from 'semver'
 import pnpmLock from './bootstrap/pnpm-lock.json'
 import exeLock from './bootstrap/exe-lock.json'
+import nativeLock from './bootstrap/native-lock.json'
 
-const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
-const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })
+const bootstrapPnpmVersion = pnpmLock.packages['node_modules/pnpm'].version
+const bootstrapExeVersion = exeLock.packages['node_modules/@pnpm/exe'].version
+const bootstrapNativeVersion = nativeLock.packages['node_modules/pnpm'].version
+const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({
+  private: true,
+  dependencies: { pnpm: bootstrapPnpmVersion },
+})
+const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({
+  private: true,
+  dependencies: { '@pnpm/exe': bootstrapExeVersion },
+  allowScripts: { [`@pnpm/exe@${bootstrapExeVersion}`]: true },
+})
+const BOOTSTRAP_NATIVE_PACKAGE_JSON = JSON.stringify({
+  private: true,
+  dependencies: { pnpm: bootstrapNativeVersion },
+  allowScripts: { [`pnpm@${bootstrapNativeVersion}`]: true },
+})
 
 export interface SelfInstallerResult {
   exitCode: number
@@ -19,18 +36,20 @@ export interface SelfInstallerResult {
 
 export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerResult> {
   const { version, dest, packageJsonFile } = inputs
-
-  // pnpm v11 requires Node >= 22.13; use standalone (exe) bootstrap which
-  // bundles its own Node.js when the system Node is too old
-  const systemNode = await getSystemNodeVersion()
-  const standalone = inputs.standalone || systemNode.major < 22 || (systemNode.major === 22 && systemNode.minor < 13)
+  const targetVersion = readTargetVersion({ version, packageJsonFile })
+  const native = targetsPnpm12(targetVersion)
+  let standalone = false
+  if (!native) {
+    const systemNode = await getSystemNodeVersion()
+    standalone = inputs.standalone || systemNode.major < 22 || (systemNode.major === 22 && systemNode.minor < 13)
+  }
 
   // Install bootstrap pnpm via npm (integrity verified by committed lockfile)
   await rm(dest, { recursive: true, force: true })
   await mkdir(dest, { recursive: true })
 
-  const lockfile = standalone ? exeLock : pnpmLock
-  const packageJson = standalone ? BOOTSTRAP_EXE_PACKAGE_JSON : BOOTSTRAP_PNPM_PACKAGE_JSON
+  const lockfile = native ? nativeLock : standalone ? exeLock : pnpmLock
+  const packageJson = native ? BOOTSTRAP_NATIVE_PACKAGE_JSON : standalone ? BOOTSTRAP_EXE_PACKAGE_JSON : BOOTSTRAP_PNPM_PACKAGE_JSON
   await writeFile(path.join(dest, 'package.json'), packageJson)
   await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))
 
@@ -53,9 +72,6 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
     return { exitCode: npmExitCode, binDest: path.join(dest, 'node_modules', '.bin') }
   }
 
-  // On Windows with standalone mode, npm's .bin shims can't properly
-  // execute the extensionless @pnpm/exe native binaries. Add the
-  // @pnpm/exe directory directly to PATH so pnpm.exe is found natively.
   const pnpmHome = standalone && process.platform === 'win32'
     ? path.join(dest, 'node_modules', '@pnpm', 'exe')
     : path.join(dest, 'node_modules', '.bin')
@@ -73,22 +89,28 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
     const pnpmBinLink = path.join(dest, 'node_modules', '.bin', 'pnpm')
     if (!existsSync(pnpmBinLink)) {
       await mkdir(path.join(dest, 'node_modules', '.bin'), { recursive: true })
-      const target = standalone
-        ? path.join('..', '@pnpm', 'exe', 'pnpm')
-        : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
+      const target = native
+        ? path.join('..', 'pnpm', 'pnpm')
+        : standalone
+          ? path.join('..', '@pnpm', 'exe', 'pnpm')
+          : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
       await symlink(target, pnpmBinLink)
     }
   }
 
-  const bootstrapPnpm = standalone
-    ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
-    : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
+  const bootstrapPnpm = native
+    ? path.join(dest, 'node_modules', 'pnpm', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
+    : standalone
+      ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
+      : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
+  const bootstrapVersion = native ? bootstrapNativeVersion : standalone ? bootstrapExeVersion : bootstrapPnpmVersion
 
-  // Self-update the bootstrap to the requested pnpm version. readTargetVersion
-  // either returns a value or throws, so this always runs.
-  const targetVersion = readTargetVersion({ version, packageJsonFile })
-  const cmd = standalone ? bootstrapPnpm : process.execPath
-  const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
+  if (targetVersion === bootstrapVersion || (native && satisfies(bootstrapVersion, targetVersion))) {
+    return { exitCode: 0, binDest: pnpmHome }
+  }
+
+  const cmd = native || standalone ? bootstrapPnpm : process.execPath
+  const args = native || standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
   const exitCode = await runCommand(cmd, args, { cwd: dest })
   if (exitCode !== 0) {
     return { exitCode, binDest: pnpmHome }
@@ -179,6 +201,12 @@ Please specify it by one of the following ways:
   - in the package.json with the key "devEngines.packageManager"`)
 }
 
+function targetsPnpm12(version: string): boolean {
+  if (version === 'latest-12' || version === 'next-12') return true
+  const range = validRange(version)
+  return range !== null && subset(range, '>=12.0.0 <13.0.0')
+}
+
 function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
   return new Promise((resolve) => {
     const cp = spawn('node', ['--version'], { stdio: ['pipe', 'pipe', 'pipe'], shell: process.platform === 'win32' })