fix: update bundled brace expansion to a patched version

.github/workflows/test.yaml

@@ -7,9 +7,6 @@ on:
       - master
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   smoke:
     # Cross-OS coverage. Exercises the bootstrap install + PATH on each platform,
@@ -422,45 +419,3 @@ jobs:
             exit 1
           fi
         shell: bash
-
-  windows_dest_spaces:
-    name: 'Windows destination with spaces (${{ matrix.version }} / standalone=${{ matrix.standalone }})'
-    runs-on: windows-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - version: '10.33.0'
-            standalone: false
-          - version: '11.25.0'
-            standalone: true
-          - version: '12.3.4'
-            standalone: false
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - id: pnpm
-        uses: ./
-        with:
-          version: ${{ matrix.version }}
-          standalone: ${{ matrix.standalone }}
-          dest: '${{ runner.temp }}/pnpm setup & tools'
-      - name: Verify PowerShell and bin_dest use the requested version
-        shell: pwsh
-        env:
-          EXPECTED_VERSION: ${{ matrix.version }}
-          BIN_DEST: ${{ steps.pnpm.outputs.bin_dest }}
-        run: |
-          $actual = pnpm --version
-          if ($LASTEXITCODE -ne 0 -or $actual -ne $env:EXPECTED_VERSION) {
-            throw "Expected $env:EXPECTED_VERSION on PATH, got $actual"
-          }
-          $command = Get-Command pnpm
-          $executable = Join-Path $env:BIN_DEST $command.Name
-          $actual = & $executable --version
-          if ($LASTEXITCODE -ne 0 -or $actual -ne $env:EXPECTED_VERSION) {
-            throw "Expected $env:EXPECTED_VERSION via bin_dest, got $actual"
-          }
-          $pnpx = Get-Command pnpx -ErrorAction Stop
-          if ((Split-Path -Parent $pnpx.Source) -ne $env:BIN_DEST) {
-            throw "pnpx resolves to $($pnpx.Source), expected under $env:BIN_DEST"
-          }

pnpm-lock.yaml

@@ -320,8 +320,8 @@ packages:
   balanced-match@1.0.2:
     resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
 
-  brace-expansion@1.1.12:
+  brace-expansion@1.1.21:
-    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}
+    resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==}
 
   call-bind-apply-helpers@1.0.2:
     resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
@@ -804,7 +804,7 @@ snapshots:
 
   balanced-match@1.0.2: {}
 
-  brace-expansion@1.1.12:
+  brace-expansion@1.1.21:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
@@ -957,7 +957,7 @@ snapshots:
 
   minimatch@3.1.2:
     dependencies:
-      brace-expansion: 1.1.12
+      brace-expansion: 1.1.21
 
   ms@2.1.3: {}
 

src/install-pnpm/run.ts

@@ -1,5 +1,4 @@
 import { addPath, exportVariable } from '@actions/core'
-import { exec } from '@actions/exec'
 import { spawn } from 'child_process'
 import { rm, writeFile, mkdir, symlink } from 'fs/promises'
 import { readFileSync, existsSync } from 'fs'
@@ -222,10 +221,15 @@ function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
 }
 
 function runCommand(cmd: string, args: string[], opts: { cwd: string; env?: Record<string, string | undefined> }): Promise<number> {
-  return exec(`"${cmd}"`, args, {
+  return new Promise<number>((resolve, reject) => {
-    cwd: opts.cwd,
+    const cp = spawn(cmd, args, {
-    env: opts.env && Object.fromEntries(Object.entries(opts.env).filter((entry): entry is [string, string] => entry[1] !== undefined)),
+      cwd: opts.cwd,
-    ignoreReturnCode: true,
+      env: opts.env,
+      stdio: ['pipe', 'inherit', 'inherit'],
+      shell: process.platform === 'win32',
+    })
+    cp.on('error', reject)
+    cp.on('close', resolve)
   })
 }