fix: preserve Windows Node shim detection

* updating readme to include devEngines.packageManager.version in selecting version

* docs: check out the manifest before inferring pnpm version

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>

.github/workflows/pr-check.yaml

@@ -13,14 +13,21 @@ jobs:
   check-dist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: true
           version: 11
 
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+
+      - name: Test
+        run: pnpm test
+
       - name: Update dist/index.js
         run: pnpm run build
 

.github/workflows/test.yaml

@@ -7,6 +7,9 @@ on:
       - master
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   smoke:
     # Cross-OS coverage. Exercises the bootstrap install + PATH on each platform,
@@ -51,7 +54,7 @@ jobs:
             version: '12.3.4'
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: pnpm
         name: Run the action
@@ -134,7 +137,7 @@ jobs:
             expect_pm_on_fail_unset: true
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up package.json
         run: echo '${{ matrix.manifest }}' > package.json
@@ -183,7 +186,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -212,8 +215,8 @@ jobs:
           test ! -d "$PNPM_DEST/node_modules/@pnpm/exe"
           which pnpm
           actual="$(pnpm --version)"
-          if [ "${actual}" != "12.3.4" ]; then
+          if [ "${actual}" != "12.17.0" ]; then
-            echo "Expected 12.3.4, got ${actual}"
+            echo "Expected 12.17.0, got ${actual}"
             exit 1
           fi
           mkdir /tmp/test-standalone
@@ -222,6 +225,68 @@ jobs:
           pnpm add is-odd
         shell: bash
 
+  shared_store:
+    name: 'Repeated install with shared store (pnpm ${{ matrix.version }})'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ['12.11.2', '12.16.1']
+    env:
+      REQUIRED: ${{ matrix.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure the shared store and project pin
+        run: |
+          config_home="$RUNNER_TEMP/pnpm-config"
+          store_dir="$RUNNER_TEMP/pnpm-store"
+          mkdir -p "$config_home/pnpm"
+          printf 'storeDir: %s\nenableGlobalVirtualStore: true\n' "$store_dir" > "$config_home/pnpm/config.yaml"
+          printf 'XDG_CONFIG_HOME=%s\nPNPM_STORE_DIR=%s\n' "$config_home" "$store_dir" >> "$GITHUB_ENV"
+          printf '{"packageManager":"pnpm@%s"}\n' "$REQUIRED" > package.json
+
+      - id: first
+        name: Install pnpm into a fresh destination
+        uses: ./
+        with:
+          dest: ${{ runner.temp }}/setup-pnpm
+          standalone: false
+
+      - name: Verify the first installation and populated store
+        working-directory: ${{ runner.temp }}
+        env:
+          BIN_DEST: ${{ steps.first.outputs.bin_dest }}
+        run: |
+          test "$("$BIN_DEST/pnpm" --version)" = "$REQUIRED"
+          store_path="$("$BIN_DEST/pnpm" store path --silent)"
+          case "$store_path/" in
+            "$PNPM_STORE_DIR/"*) ;;
+            *) echo "Unexpected store path: $store_path"; exit 1 ;;
+          esac
+          test -n "$(find "$PNPM_STORE_DIR" -type f -print -quit)"
+          touch "$PNPM_STORE_DIR/reused-by-second-install"
+
+      - id: second
+        name: Reinstall pnpm with the same destination and store
+        uses: ./
+        with:
+          dest: ${{ runner.temp }}/setup-pnpm
+          standalone: false
+
+      - name: Verify the second installation reused the store
+        working-directory: ${{ runner.temp }}
+        env:
+          BIN_DEST: ${{ steps.second.outputs.bin_dest }}
+        run: |
+          test -f "$PNPM_STORE_DIR/reused-by-second-install"
+          test "$("$BIN_DEST/pnpm" --version)" = "$REQUIRED"
+          test "$(pnpm --version)" = "$REQUIRED"
+
   standalone_windows_self_update:
     # Regression guard for the patchPnpmEnv PATH-shadow bug. When
     # standalone: true on Windows AND the requested pnpm differs from the
@@ -236,7 +301,7 @@ jobs:
     name: 'Standalone Windows self-update (PATH regression)'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up package.json with a minimal manifest
         # run_install needs a manifest to install against. Removing the
@@ -294,7 +359,7 @@ jobs:
             manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=10 <11"}},"dependencies":{"is-odd":"3.0.1"}}'
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up package.json
         run: echo '${{ matrix.manifest }}' > package.json
@@ -338,7 +403,7 @@ jobs:
                 - yarn
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run the action
         uses: ./
@@ -357,3 +422,45 @@ jobs:
             exit 1
           fi
         shell: bash
+
+  windows_dest_spaces:
+    name: 'Windows destination with spaces (${{ matrix.version }} / standalone=${{ matrix.standalone }})'
+    runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - version: '10.33.0'
+            standalone: false
+          - version: '11.25.0'
+            standalone: true
+          - version: '12.3.4'
+            standalone: false
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - id: pnpm
+        uses: ./
+        with:
+          version: ${{ matrix.version }}
+          standalone: ${{ matrix.standalone }}
+          dest: '${{ runner.temp }}/pnpm setup & tools'
+      - name: Verify PowerShell and bin_dest use the requested version
+        shell: pwsh
+        env:
+          EXPECTED_VERSION: ${{ matrix.version }}
+          BIN_DEST: ${{ steps.pnpm.outputs.bin_dest }}
+        run: |
+          $actual = pnpm --version
+          if ($LASTEXITCODE -ne 0 -or $actual -ne $env:EXPECTED_VERSION) {
+            throw "Expected $env:EXPECTED_VERSION on PATH, got $actual"
+          }
+          $command = Get-Command pnpm
+          $executable = Join-Path $env:BIN_DEST $command.Name
+          $actual = & $executable --version
+          if ($LASTEXITCODE -ne 0 -or $actual -ne $env:EXPECTED_VERSION) {
+            throw "Expected $env:EXPECTED_VERSION via bin_dest, got $actual"
+          }
+          $pnpx = Get-Command pnpx -ErrorAction Stop
+          if ((Split-Path -Parent $pnpx.Source) -ne $env:BIN_DEST) {
+            throw "pnpx resolves to $($pnpx.Source), expected under $env:BIN_DEST"
+          }

README.md

@@ -64,7 +64,7 @@ Input and output changes:
 
 Version of pnpm to install.
 
-**Optional** when there is a [`packageManager` or `devEngines.packageManager` field in the `package.json`](https://nodejs.org/api/corepack.html).
+**Optional** when `package.json` declares pnpm in `packageManager`, or sets `devEngines.packageManager.name` to `"pnpm"` and provides `devEngines.packageManager.version`.
 
 otherwise, this field is **required** It supports npm versioning scheme, it could be an exact version (such as `10.9.8`), or a version range (such as `10`, `10.x.x`, `10.9.x`, `^10.9.8`, `*`, etc.), or `latest`.
 
@@ -157,6 +157,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - uses: actions/checkout@v6
+
       - uses: pnpm/action-setup@v6
 ```
 

package.json

@@ -4,7 +4,8 @@
     "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --minify --outfile=dist/index.js --loader:.json=json",
     "build": "pnpm run build:bundle",
     "start": "pnpm run build && sh ./run.sh",
-    "update-bootstrap": "node scripts/update-bootstrap.mjs"
+    "update-bootstrap": "node scripts/update-bootstrap.mjs",
+    "test": "node --experimental-test-module-mocks --test test/*.test.mjs"
   },
   "dependencies": {
     "@actions/cache": "^4.1.0",

src/cache-save/run.ts

@@ -1,5 +1,6 @@
 import { saveCache } from '@actions/cache'
 import { getState, info } from '@actions/core'
+import { access } from 'fs/promises'
 
 export async function runSaveCache() {
   const state = getState('cache_restored_key')
@@ -11,6 +12,17 @@ export async function runSaveCache() {
     return
   }
 
+  try {
+    await access(cachePath)
+  } catch (error) {
+    if (!(error instanceof Error)) throw error
+    if (!('code' in error)) throw error
+    if (error.code !== 'ENOENT') throw error
+
+    info(`Cache path ${cachePath} does not exist, not saving cache.`)
+    return
+  }
+
   const cacheId = await saveCache([cachePath], primaryKey)
   if (cacheId == -1) return
 

src/install-pnpm/bootstrap/exe-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@pnpm/exe": "11.25.0"
+        "@pnpm/exe": "11.28.10"
       }
     },
     "node_modules/@pnpm/exe": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe/-/exe-11.28.10.tgz",
-      "integrity": "sha512-X19R2uC+VAJ4UJQE9c/PCdOXbDaWnZtad7WUrTHBFQuMVaK9MAHbyO/WgahQCuRtTmJkLbxcWKKCk+JeTYFm/g==",
+      "integrity": "sha512-prIiCu3BBaIlim+JD6x2VnqCAp4Er4CevPhrIhOnXK7TRVjhNeULBEv9F7E5ZmEtseR2G+foubhcMZmM6eEqqg==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -28,19 +28,18 @@
         "url": "https://opencollective.com/pnpm"
       },
       "optionalDependencies": {
-        "@pnpm/linux-arm64": "11.25.0",
+        "@pnpm/linux-arm64": "11.28.10",
-        "@pnpm/linux-x64": "11.25.0",
+        "@pnpm/linux-x64": "11.28.10",
-        "@pnpm/linuxstatic-arm64": "11.25.0",
+        "@pnpm/linuxstatic-x64": "11.28.10",
-        "@pnpm/linuxstatic-x64": "11.25.0",
+        "@pnpm/macos-arm64": "11.28.10",
-        "@pnpm/macos-arm64": "11.25.0",
+        "@pnpm/win-arm64": "11.28.10",
-        "@pnpm/win-arm64": "11.25.0",
+        "@pnpm/win-x64": "11.28.10"
-        "@pnpm/win-x64": "11.25.0"
       }
     },
     "node_modules/@pnpm/linux-arm64": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-arm64/-/linux-arm64-11.28.10.tgz",
-      "integrity": "sha512-ra8akqhzsbcOhKSJ9fFV8H+Oc9uGQAcp/XmIBEdT+8hPPoZCit3+RNCHmg8bLoNvpSLtRvZE0WFCMj7WyzxeBA==",
+      "integrity": "sha512-gtNgBYw2s0MLOU980IlqFqvc90iL9y7W6VIRQB8wydgbgeoIU1G0qUOWBRIKB57xDgVuFp7gnTWdwQ2lF2sU1Q==",
       "cpu": [
         "arm64"
       ],
@@ -54,9 +53,9 @@
       }
     },
     "node_modules/@pnpm/linux-x64": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/linux-x64/-/linux-x64-11.28.10.tgz",
-      "integrity": "sha512-pQl/L10diKQCbF73viRrtVU8qVWMTudUCSG1uZ+EWBNKtU9Sbxe6Q378diXDb1uTwSgUVMQoypxlC1MTzh7qvQ==",
+      "integrity": "sha512-PCJF+0FwwHBOR7oBp3ySjvk7m1LQUhTN2xfLk3e+v0h036PgY9Z2Ldtu+l4xIYZoI6eEwBSQFXGLxslWrcZ5jg==",
       "cpu": [
         "x64"
       ],
@@ -69,29 +68,10 @@
         "url": "https://opencollective.com/pnpm"
       }
     },
-    "node_modules/@pnpm/linuxstatic-arm64": {
-      "version": "11.25.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-arm64/-/linuxstatic-arm64-11.25.0.tgz",
-      "integrity": "sha512-cYcrbB/xN1N6/5VUlFuHblb1gNyJgZv1CF5Pk1T0sHJxQMY4DFJV3OqHVAgahxyUfSTaQcVLvH1H2JFvd/+sgw==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/pnpm"
-      }
-    },
     "node_modules/@pnpm/linuxstatic-x64": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/linuxstatic-x64/-/linuxstatic-x64-11.28.10.tgz",
-      "integrity": "sha512-HXDtaeQod16DDMUUcVLIMxvEc1jKn7IYsNPwbwAPs/Je/d3umRPJi3Ejjdn6e9qpXN6Oon+yvSsJr7B9oDt6KA==",
+      "integrity": "sha512-kkcKBNPEx/xyW97inm4pEs6VkuY6Cy7w6gWaCVbv8qVmyqsyF4yFXJwUG7VxqmCnwVhSb2x/122S9UZumQns4A==",
       "cpu": [
         "x64"
       ],
@@ -108,9 +88,9 @@
       }
     },
     "node_modules/@pnpm/macos-arm64": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/macos-arm64/-/macos-arm64-11.28.10.tgz",
-      "integrity": "sha512-m/eAgEqKhiSexGxWPHNXNnSRI0hudymg6K7LbrU2EoDs9IgJ28OKEz9mGxMzhkYBweEquR4k5teMNes/aToy9w==",
+      "integrity": "sha512-eT/HzSBZHjZk2xb+XmTbLIPPSMeHzK8xov4mD9oQWwfplYBTU5P21yoJp6GNFLql1IXAoSaFeTv6EZ2DwBj/Eg==",
       "cpu": [
         "arm64"
       ],
@@ -124,9 +104,9 @@
       }
     },
     "node_modules/@pnpm/win-arm64": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-arm64/-/win-arm64-11.28.10.tgz",
-      "integrity": "sha512-oAeECbtZ+eJziaBmPUkwJM8Dx7KVQ5FO367AXTjD2HGfB5ob1Bcu5hoUF5RBTgDBiP9fRQ1u13uAEpqar/6NLA==",
+      "integrity": "sha512-UFeYraIlLHNUBgMarcAX/jK3PR2iWfI4SJL8fucVWNHivdyXNQYLmUhf+8a6MPdh4Sr0/2W/h6LqzVdjnpPx6g==",
       "cpu": [
         "arm64"
       ],
@@ -140,9 +120,9 @@
       }
     },
     "node_modules/@pnpm/win-x64": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/win-x64/-/win-x64-11.28.10.tgz",
-      "integrity": "sha512-8/n+wCc0a8TRYTMFqti93Vh0cscdJ25xfMyYSDdXrLUh2ccxSFuS+SE7cNPjd/nOXoFAJvdW0kwfbyRPLa16/w==",
+      "integrity": "sha512-1Do1wLHqiLVQac53DqRtqz0h5UCetoI1oaUZJ62L2wDW4sfe/MBs427rwyaiGZzYLps8glsD1aZXT5uAv1zx8A==",
       "cpu": [
         "x64"
       ],

src/install-pnpm/bootstrap/native-lock.json

@@ -5,13 +5,39 @@
   "packages": {
     "": {
       "dependencies": {
-        "pnpm": "12.3.4"
+        "pnpm": "12.17.0"
       }
     },
+    "node_modules/@pnpm/exe.android-arm64": {
+      "version": "12.17.0",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.android-arm64/-/exe.android-arm64-12.17.0.tgz",
+      "integrity": "sha512-gwu/F5YyoJp1bIbrIBl7B8JO3rkjkGlKikwQg9s0aVa5xWaBYIqPX+ZJqQ7I4D1YfbdI/Omfze0+6vnYiWHG6A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@pnpm/exe.android-x64": {
+      "version": "12.17.0",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.android-x64/-/exe.android-x64-12.17.0.tgz",
+      "integrity": "sha512-qUNhCvWyeBrUByNWkqqQ3Koy1gIAQ8UV5HDHXxoo5NUWVTde0Ld2BxweNwWJw8CNKpqEGceCUdjZ506JYpTjJg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
     "node_modules/@pnpm/exe.darwin-arm64": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.darwin-arm64/-/exe.darwin-arm64-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.darwin-arm64/-/exe.darwin-arm64-12.17.0.tgz",
-      "integrity": "sha512-PAyUol8T1+/+ViOiXAt51ECA+QnfXCqz6foL4bW+LsoX0NcVd5XVEM2mRQu+LV4oc7uRz9zf9U0P+XFfuQeDAw==",
+      "integrity": "sha512-0nkEqRLIbrm7dWl+p2EPpmyNKyM0bbdPEovdtMhHYbhkO+Vls38S+6emkx8kSTAr75BNXYXkCl4RtGinGG4Erg==",
       "cpu": [
         "arm64"
       ],
@@ -22,9 +48,9 @@
       ]
     },
     "node_modules/@pnpm/exe.darwin-x64": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.darwin-x64/-/exe.darwin-x64-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.darwin-x64/-/exe.darwin-x64-12.17.0.tgz",
-      "integrity": "sha512-fxP9JCk0Cdye+ePuj+GJJLMUMTqHGWRdb1dtv4How876uQ2ehxvenpgiYAir/ceO9PsYUZkFTtyZdx+rRu5QOA==",
+      "integrity": "sha512-w89cboNi4KCzmt/dSKrE4ijVNKICKiZsE9TcIWf77Tz+VpoDfuhPSmWPZK+iCHBvlI/9dIN+M3HiPPVsFnAx4Q==",
       "cpu": [
         "x64"
       ],
@@ -34,10 +60,23 @@
         "darwin"
       ]
     },
+    "node_modules/@pnpm/exe.freebsd-x64": {
+      "version": "12.17.0",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.freebsd-x64/-/exe.freebsd-x64-12.17.0.tgz",
+      "integrity": "sha512-DJ0FOaUDXc71icSgiuBFEvqReqoSiS/rmnC6kltoiC3MzPyw3awcGbT/7FnnYzi/ziuoTC7v6vfBh0Vzv7VKOQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
     "node_modules/@pnpm/exe.linux-arm64": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-arm64/-/exe.linux-arm64-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-arm64/-/exe.linux-arm64-12.17.0.tgz",
-      "integrity": "sha512-t71AVA7LRqiKTyZ5xMYaZc2n5DfdpMbfokZuiIOXHBOM03ECnF0t4iYwaBDqJgVjlKYUOwaF/bRQajGNA4cJ4w==",
+      "integrity": "sha512-Cj2nIzWTVm6ZuhQHqL9SiJ11scBnEGxJyNg7tYQPzh9fVF5UVRkv+LbyfwdftnAtJerK/7HDpK/55WeQqp8OkA==",
       "cpu": [
         "arm64"
       ],
@@ -51,9 +90,9 @@
       ]
     },
     "node_modules/@pnpm/exe.linux-arm64-musl": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-arm64-musl/-/exe.linux-arm64-musl-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-arm64-musl/-/exe.linux-arm64-musl-12.17.0.tgz",
-      "integrity": "sha512-FBOt0/7ye6O6q4AllVV5QMviB6qE6fqkeczV/+MDWQsmo+QJrlfsh6X7CpH/tClVpBZEyIbjpUoT8bNhCYBxEg==",
+      "integrity": "sha512-w5ZwZ4j8S804DGhMYlLLpc+G3Kkc+5GlDO++LLvO/nDIXBTHRhdxPfQBQU08q31k0JYfp3wXCQk0Y7DnsuVF6w==",
       "cpu": [
         "arm64"
       ],
@@ -66,10 +105,58 @@
         "linux"
       ]
     },
+    "node_modules/@pnpm/exe.linux-ppc64": {
+      "version": "12.17.0",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-ppc64/-/exe.linux-ppc64-12.17.0.tgz",
+      "integrity": "sha512-Gb//Wm15fXl+qWcxjNQmwlYDjGiJOnLU/A9uRZYmtkyZie2Yx8AHI6XkUIJioQz99TwVDKQ87ywD5Jtk8zcgyg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@pnpm/exe.linux-riscv64": {
+      "version": "12.17.0",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-riscv64/-/exe.linux-riscv64-12.17.0.tgz",
+      "integrity": "sha512-+kItEcFjdVZEDzODsc7icb8cB+3AouCrEzOCezzxLITRhw86m9t3J/qyPdcFELBjeMnS+IXV8sJaSCQcpSqfgA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@pnpm/exe.linux-s390x": {
+      "version": "12.17.0",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-s390x/-/exe.linux-s390x-12.17.0.tgz",
+      "integrity": "sha512-jf5ghD2uDeknWQgK/EsCFNwlyL7BYLWfXe687g5UMVFclPLt524CREZ8Yl5hf4u7p3evCIPBN/m5I1QXUmJpHw==",
+      "cpu": [
+        "s390x"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
     "node_modules/@pnpm/exe.linux-x64": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-x64/-/exe.linux-x64-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-x64/-/exe.linux-x64-12.17.0.tgz",
-      "integrity": "sha512-2ZqOlSPkfwX1h5cR+FPiWf8+F+2hZT/3TvhUK5sigHqwaQCIiq8R7CGxhndKs63JtcLi2a1Qpo+wX/EoyfjyJQ==",
+      "integrity": "sha512-vQAusDzMofc/Ee4KOUYjE6FWeHOlMGQyvhR7W39QSamVeJWS16co/n+bhjdjwjI3UFh8IWOpamvTS+b4lvQUog==",
       "cpu": [
         "x64"
       ],
@@ -83,9 +170,9 @@
       ]
     },
     "node_modules/@pnpm/exe.linux-x64-musl": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-x64-musl/-/exe.linux-x64-musl-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.linux-x64-musl/-/exe.linux-x64-musl-12.17.0.tgz",
-      "integrity": "sha512-RPmk7Jb/aYaFvL2iyDN/AtMY+hUEsue732WmXpcuQ9tBpMnGyA5py7Z3+e+qmQaJ0zY/4ni9jJiyPBQHujmv6w==",
+      "integrity": "sha512-JGxrGSxkDkqRAUD49T9dOnKyJkQ3bWBeHnYH4o4mvj09R9eUzhWFi8oa6WPNyCO0/7/Max2gsSfgXOHj3QW7ug==",
       "cpu": [
         "x64"
       ],
@@ -99,9 +186,9 @@
       ]
     },
     "node_modules/@pnpm/exe.win32-arm64": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.win32-arm64/-/exe.win32-arm64-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.win32-arm64/-/exe.win32-arm64-12.17.0.tgz",
-      "integrity": "sha512-ANyrHqyqco6SXBysUTRF74itDyyraea7IbFsKFdNXTjcFnfycTDx37EwuhdpPYFNSIh2JhUG4fByclsRfiHX7w==",
+      "integrity": "sha512-qDQh8rmyK5sxlaCSCADcmPrvytJabMCbxtJ0nCitzRo2j3/8BhzLjlOcWF3C6iPGhR5CbIb+btNy+VCVhd06mQ==",
       "cpu": [
         "arm64"
       ],
@@ -112,9 +199,9 @@
       ]
     },
     "node_modules/@pnpm/exe.win32-x64": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/@pnpm/exe.win32-x64/-/exe.win32-x64-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@pnpm/exe.win32-x64/-/exe.win32-x64-12.17.0.tgz",
-      "integrity": "sha512-WH/KqBPY/hq2Tb7SgQltEZytimcjgKRaCRL/aM9CI0c67iKc5TVmHUhIiL3Ux9FB4bWn36i6XewUcScQI+zG8w==",
+      "integrity": "sha512-qCo1OQlE3WrFZIAUK0O5EoupLaQ1fST7zNX8Qd+Tc4ojWgCvYA/ze0uP9hox8mSFC/JPAGRSG5o8gUBSq2rRxw==",
       "cpu": [
         "x64"
       ],
@@ -125,9 +212,9 @@
       ]
     },
     "node_modules/pnpm": {
-      "version": "12.3.4",
+      "version": "12.17.0",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-12.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-12.17.0.tgz",
-      "integrity": "sha512-lhqkH7B32joEpEHZ+OFevAyW2o73ELLrZ7+e58sGEOq9SPH9hfUc/+c4RnhfoPh8VqOocqHYk/hEZ0G1zORUVw==",
+      "integrity": "sha512-uNIj6+wEtYContIG2qcdG8y2oe4dUu+pXMOw23UnFWHfjw2OLEOt05xewIAYr3qKlRCOcJD5Win4hye3pA/VPQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "bin": {
@@ -137,17 +224,23 @@
         "pnx": "pnx"
       },
       "engines": {
-        "node": ">=18.*"
+        "node": ">=18"
       },
       "optionalDependencies": {
-        "@pnpm/exe.darwin-arm64": "12.3.4",
+        "@pnpm/exe.android-arm64": "12.17.0",
-        "@pnpm/exe.darwin-x64": "12.3.4",
+        "@pnpm/exe.android-x64": "12.17.0",
-        "@pnpm/exe.linux-arm64": "12.3.4",
+        "@pnpm/exe.darwin-arm64": "12.17.0",
-        "@pnpm/exe.linux-arm64-musl": "12.3.4",
+        "@pnpm/exe.darwin-x64": "12.17.0",
-        "@pnpm/exe.linux-x64": "12.3.4",
+        "@pnpm/exe.freebsd-x64": "12.17.0",
-        "@pnpm/exe.linux-x64-musl": "12.3.4",
+        "@pnpm/exe.linux-arm64": "12.17.0",
-        "@pnpm/exe.win32-arm64": "12.3.4",
+        "@pnpm/exe.linux-arm64-musl": "12.17.0",
-        "@pnpm/exe.win32-x64": "12.3.4"
+        "@pnpm/exe.linux-ppc64": "12.17.0",
+        "@pnpm/exe.linux-riscv64": "12.17.0",
+        "@pnpm/exe.linux-s390x": "12.17.0",
+        "@pnpm/exe.linux-x64": "12.17.0",
+        "@pnpm/exe.linux-x64-musl": "12.17.0",
+        "@pnpm/exe.win32-arm64": "12.17.0",
+        "@pnpm/exe.win32-x64": "12.17.0"
       }
     }
   }

src/install-pnpm/bootstrap/pnpm-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "pnpm": "11.25.0"
+        "pnpm": "11.28.10"
       }
     },
     "node_modules/pnpm": {
-      "version": "11.25.0",
+      "version": "11.28.10",
-      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.25.0.tgz",
+      "resolved": "https://registry.npmjs.org/pnpm/-/pnpm-11.28.10.tgz",
-      "integrity": "sha512-XN6SW08HX3Jetx+64YpC/+eEUkeJ8ZthxzHLhyHsKKruFg4BqNWvT+2ypCzb8wDv4j2zVrDUoXtNY+EfirfJVg==",
+      "integrity": "sha512-ZyIW8G4VwQm4VHHUnT++0X5vA+rSWN8Iwr9bSlwzMh6/v1lHa86BMl762has4Kx4VI/Qv816UTaek5GCo91Q5A==",
       "license": "MIT",
       "bin": {
         "pn": "bin/pnpm.mjs",

src/install-pnpm/run.ts

@@ -1,4 +1,5 @@
 import { addPath, exportVariable } from '@actions/core'
+import { exec } from '@actions/exec'
 import { spawn } from 'child_process'
 import { rm, writeFile, mkdir, symlink } from 'fs/promises'
 import { readFileSync, existsSync } from 'fs'
@@ -221,15 +222,10 @@ function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
 }
 
 function runCommand(cmd: string, args: string[], opts: { cwd: string; env?: Record<string, string | undefined> }): Promise<number> {
-  return new Promise<number>((resolve, reject) => {
+  return exec(`"${cmd}"`, args, {
-    const cp = spawn(cmd, args, {
+    cwd: opts.cwd,
-      cwd: opts.cwd,
+    env: opts.env && Object.fromEntries(Object.entries(opts.env).filter((entry): entry is [string, string] => entry[1] !== undefined)),
-      env: opts.env,
+    ignoreReturnCode: true,
-      stdio: ['pipe', 'inherit', 'inherit'],
-      shell: process.platform === 'win32',
-    })
-    cp.on('error', reject)
-    cp.on('close', resolve)
   })
 }
 

test/cache-save.test.mjs

@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, access } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { after, beforeEach, mock, test } from 'node:test'
+
+const directory = await mkdtemp(join(tmpdir(), 'pnpm-cache-save-'))
+after(() => rm(directory, { recursive: true, force: true }))
+let state
+let checkAccess
+const saveCache = mock.fn(async () => 1)
+mock.module('@actions/cache', { namedExports: { saveCache } })
+mock.module('@actions/core', {
+  namedExports: { getState: name => state[name], info: () => {} },
+})
+mock.module('fs/promises', { namedExports: { access: path => checkAccess(path) } })
+const { runSaveCache } = await import('../src/cache-save/run.ts')
+
+beforeEach(() => {
+  state = { cache_restored_key: 'old', cache_primary_key: 'new', cache_path: directory }
+  checkAccess = access
+  saveCache.mock.resetCalls()
+})
+
+test('skips saving a missing directory', async () => {
+  state.cache_path = join(directory, 'missing')
+  await runSaveCache()
+  assert.equal(saveCache.mock.callCount(), 0)
+})
+
+test('saves an existing directory with the primary key', async () => {
+  await runSaveCache()
+  assert.deepEqual(saveCache.mock.calls[0].arguments, [[directory], 'new'])
+})
+
+test('skips saving a primary-key cache hit', async () => {
+  state.cache_restored_key = 'new'
+  await runSaveCache()
+  assert.equal(saveCache.mock.callCount(), 0)
+})
+
+test('propagates unexpected filesystem errors', async () => {
+  const error = Object.assign(new Error('access denied'), { code: 'EACCES' })
+  checkAccess = async () => { throw error }
+  await assert.rejects(runSaveCache(), error)
+  assert.equal(saveCache.mock.callCount(), 0)
+})