Bug: Different devEngines.packageManager.version in repo root vs working-directory breaks setup

[alecglassford]

Minimal bug reproduction: https://github.com/alecglassford/bug-reproduction-pnpm-setup-multiple-package-json-pnpm-versions

If you set the working-directory input, the action downloads a version of pnpm according to the devEngines.packageManager.version ("inner version") from the package.json in the working-directory. However, if there is a separate package.json with a different devEngines.packageManager.version ("outer version") at the repo root¹, the post-download version check fails.

This occurs because, even though the pnpm executable used for the check is the inner version, pnpm --version always returns the version of the pnpm configured for the current working directory, which is the outer version.

This can lead to error like the following in logs:

  Downloading pnpm 12.0.0 from the npm registry
  ==> Downloading pnpm 12.0.0
  Error: The installed pnpm reports version 12.1.0, expected 12.0.0

(In this case the "inner version" is 12.0.0 and the "outer version" is 12.1.0.)

Suggested fix

When the action runs pnpm --version, set the cwd to the working-directory input, rather than running from the default GITHUB_WORKSPACE. I.e.

setup/src/install-pnpm/run.ts

Line 117 in 703c526

const cp = spawn(pnpmBin, ['--version'], { stdio: ['ignore', 'pipe', 'inherit'] })

-->

const cp = spawn(pnpmBin, ['--version'], { cwd: workingDirectory, stdio: ['ignore', 'pipe', 'inherit'] })

Workaround

For my use case, it is sufficient to run rm package.json in a step before setup/node. This might also work for other users.

Footnotes

1. Or more specifically, I think, at GITHUB_WORKSPACE — which is usually also the repo root ↩