From f9d6871a3df05a7dd07bead5cf0a4f90969540dd Mon Sep 17 00:00:00 2001 From: Zoltan Kochan Date: Thu, 30 Apr 2026 22:24:36 +0200 Subject: [PATCH] fix: revert npm to PATH lookup; runner externals lacks npm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Revert 42e75a1's switch to absolute-path npm resolution. The premise that npm is co-located with the action's node binary is false on GitHub-hosted runners: `process.execPath` points into `runner/externals/node24/bin/`, which contains node only — not npm. The absolute-path spawn produced ENOENT on Linux/macOS and "not recognized" on Windows. Go back to spawning `'npm'` and relying on PATH lookup, which works on standard runners (npm is on PATH from the runner image) and on the GHE self-hosted setup that motivated the original fix. Keep the node-directory prepend so npm's `#!/usr/bin/env node` shebang resolves, and keep the unset-PATH guard. --- dist/index.js | Bin 1433526 -> 1433466 bytes src/install-pnpm/run.ts | 11 ++++++----- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/dist/index.js b/dist/index.js index 5ea74e333360b47f01fb2400289b3a23245b2551..453a9a6f09b5ac97716343dd352ae273467606ff 100644 GIT binary patch delta 5733 zcmai2e|!^Fw*O2r)3i6GB%MxMD5YtDI%6hjS{0>XS_)LG%Fyzo6l1q!l1YiQNlntG zl;-hEmt7RW5ab$#lptoo1^@CQ_vRX}$2x!{89KGfCSckUzsV?rZsoX7yd}LrCEJ>1m#vEC0m@(fjR8;Um zZ)VtEt{ax>!^KY821-qF(vN}kKRD@Z&`~>8NzW&%OsS?913X+!j{_aFYI-)&g}H{F zLyeb3m&=t%N{ybVD-ymz^##;ujF)@56gA4rT68i!n*zW7?pk_gmYiHHcqVG-I{H{P zi2rmN?P356ucx;W+h1s;r!&+|+IKSj88z-Eup=Ut$Crd+UT9ZTs43t9_cqg$De5MC z?OZwl6E@EUpH3tb%H3jSf|Q!t>2Bi%p@vU&M_cHJv#3^WN*n#65%BMe>HnapR=iuGI{?P|=^Fu5Kivy(%umk)a0lo~ z04)Jnq!r&AplbmR1t8L`_pdzIc(xk#3LnV9;#_NW?VaW!gh z^T-fqS;|C35M?P8lYKHT3w4RG3Q!|oS*2bjcskX%Eg{LZ?z-8&_!3uFC=5YtKSzsX zlidA1y|D;z634t$4ETwY@sDQZwn)%6LuhdMy1UhIfNvCKZIQ%y#{kFkEzH+Wqbzmc za~-3L@mqH=MWFBTJD6`7Q2!6>7^gwz@tjts8c)58DXWqN-9(p9iA3X4B8{?;6femw zF(J+s=L^fhZ?bmxT}-_JWDT!pJRllvU?!4$s~lu{0G=2GQpWoSncV=EdzdMB?>$UD zP1eEnex`6dv>L&FvcQ7wjwqxrFOvmQ;vc-1!TGWni~Hg|vH5CWye1q|y|T9RUglj2 z>`UIyoF7lMVCpzCM%%EP$*};j@ik_K;g+cO$JdzW4A8*0zQbIJU-~^G5aP4nGtY3h zMB7|SB(Tim^FkByoS?Sr4Q7ZUJOghrS}qKb)F_WG;{*8I2vdpw^(JG&!*4M*?ScPf zZld#nqb4kc)r74p#;XE|z+VnA_mQ=KI?TLhOs~CwbnJPD>D6WbK$(^AF>jL5#`l>$ zh*85yNw;MYrDE@K#$`~$_;x2%0OZ!=U=)xmXEPk$Jj7&Es%AXFSg0TJT!)tUV)mpU zs*?KPCk&5&agxcujKv&*Jh{lT@v`Aj0Tr@Py~tq4g{PSD87}R{Q_N^^vv$i@j0hz> z<@>GwV%Ahb=fuh^$5|-c0Z#+OF(`Os>@71@K=4n~H1Z$4&WEZamC~gt~gkZm)^s z(NCHt!N{ELrssZq z%VohI3CBa>9yL=K@SU5oJM!eDeX)=#7IP&Tf4eCgytKAxbGBBrIcHiMElWWcu8)o? zWJm_fxc8f!s|#du042P0U9lb|7LSI)9k6|0{wC*v5>ReFhiU)@IdoNyEH!u&Z9;Me z9xOy-QHLmtb~PG}L~&CgD$tCDXj?AuK50i&z@FoF^rbvjk>hX9&&dzChFL{7C=R6yHNrBiiw-Fn3#Rf~$`=etEk z5EU1wAV5{^iH2=TQtgbXqyP~K<+=oYPQBhCTy$G{0&b0=k`+pu!+wP=6tjgRahuxL zt@`6?z-1R@eF-7CJf*fmoCX?-8THCRAw}xcxjdPOq_}&f@+wb;uM*7Qp~o!}`}B}C zLF(up0qdJG=Ih4lYS*R=*W0#B+Bp~7i_zkX{I^E!9wNKRA;F?}dK^us6ntkKtza`o z5F7d>@QkS7q8>E6Bt4+3)1XTIu3ld!Bowg`ujoNnfPfu6C;$=7?L|pOXU7|QQ8)Db zs~5Ebv?fp$z`6u_6hP=h-Zb0K`%rtjd8QA^D?qpZGt7FBK=X8@b;p9E|F?5fp#?S) zTu2Bds`{4dI_nAHaQtXWl&ZFLPLQmsfUps7_*AJucgN9Xs4get4h5I>qcLFolzvpj zWqLEABpC_r=|?w%!3X+L3#~}CidL~4b-?kaZ5TiTldnkAz0Gaj>eM;W$SVR~yb6uM z|6GYif#9>N&}749eREc$QX?ci-fGP%z-v~cS-|-AYE%O7>1xyf;9P?~g(bK<5S(WU zQ-FK#LZ=KMZPNy{hzK1- zCD<~E#--Y&0L?KAi+?hR;=ujxAUc@?eS055n}MA7Fgi|zT)i1>0mSb;g0_xTy#4yk zHVG~+pQGFcyT`RuT^55h+VCg}>l;5Ex)Q!F1h(%1|X%r^L;?AZ;mG84j-;Q#NVXiB5QQZr(@fX`s8Td5s2_yhq_XPT)2zVXUshai!OQa{!FNpu&*?|rN zZ2u*i2Joj}qNU)I=AGz}!Kz3;HJMswo?aBR>Zeh=u~2~m(X1!tJg{6D7+6LCJKoP8 zr@j7b^av5_dlnU3tGHsSFX~^ySKb<{6vQS;5&NNpd3s^zIjf+cLC+;ehFk1~Vhoa= zeiq#WGNj$;4uIEoqiX=Z-i_+Al%!`mFi3mQ3AZBYL77g%DR>kR$HSlEiu*cbUzbYU zxGYUK^pTP#Kc{;q{2c1FDbn&}>L`%X`R0qoLLFg#c~b0)Kz7j2qpJ%+yQQJ-n?p-g z(6~1e3fSCa@5;}kYVgvk=TRTo2j6PwD}cZL25p4ipS=JDt@KCoGkpYrCfbqTqAv_^ zur+56t;-HJ?W32_0jd@Pz%LW03wm(^4dCq;UlNTZYz^ed+Kd4dT4;W$|M%50Zaeux{sl&2`FkG zxDWM_tvdP*^d0PAE%y-GPm!u~=6zJ6{p~Osl|`6GP%*&R5vb}4zH0={1Ne9Z)x(VP z56}X572w2K^Z>x9bEp@}&mHHGItIwkk@=%6SrEjf68@{*T#Wy0HkVmtu|ti|RbxG! z@fu!`YGquQYpwCxsgyd%%t0PQn*=9g1l3jhojb2TOJxW-~8 ze3PwYw$@`c|5p&Oz0XXMM}@E7T#zeY2x}dD80a@oCL_NYFxvn=7%=}kJa6Q+>yl>p zH@$1ghM`{{vOES0Hy^fSeMg10)*kQL7cdc+irEXYaC%!XFP=T&aP=VM_(xdDJ=v^TROeAGX-Yzj%~ixalxV`^z4y83&2@t%ocVu=_(000Sj!M?SP_BOm7f zxydNQt^HL8TL{h?aj+qP=^{H5V6DhLX_Q47yPfP}pzn3EjT2?K+R0P>nO)*=$f;vD zA^E*>n>d$%_D?5ULIO5cX0HN}Wp+%qocgq*;>B6{h1#7md)$x(59RVi9X>sqErS@{ z)y%$N0rm!kEiaYpc-iHTbakoWIP8-K=>i4sX>E|{T5c2Y1namLDL{KY_eYM3?On))3?SmRMI2WOTq}FIaw>+m^>UvAwJyQk z2-N!tt_yf(^l@1rUc2$%xOa?zrK`DTiKv5XxQ#i$y<|Q20Vv25ui@_X-1XXq4cvK< zj?MRR6Y$P^IUh)Y_J8NWEW=~m*EG=oc!Il!0=#<%mv1om!rIoI+`Bet;Ai%8#d!UG zt~^cD54- z@ee?qa%WyB0sXoilwy#GXLsa}HP(St*Dxp2LQSe=!#_K~jhPUHFNJPV?sEA8fhPFm zBk;bkE1(8_P+DELMd15S5bry{IjA5$dw{dk4N_+MdF?T^GwAH;4nV%z#jds*Z-;n!U)pskr!`*c fw8qT+(VYzTg#GbQB#du6$i+Z0?c;;o(b4|{Y1e3& delta 5842 zcmai2e|!^Fw*O2r)3i6GBu%F+l(tEPI%6j34;7?gT1u%}l%eG}#B9kVlM-o@nxsuB z%>zLf7lneZToe>Vlx5ZT6p&e;PhG`TAJPK;fa0zpWd81FDfqPxV9OJ5Sww|`P&M1 z7hG_2)I7DNoO-|r_}Nv|s$9VE1nT9eCyE{4rdG%|3 z6#R7RYkm5n5H(gk{*k`S0Ic7Arhh0K@PWVUTWIM2?1J8@qi#}*ztx`s#LN%+CLnM6 zLBFX0hEJPmqmCMj&spdSAd3p<{?UNGPOlEykN_&8uQ%2X5;rs3Mb|SQP z9DOyR!#ur>u$cuq2+%9gBEVjOc3m?z>J@EOyud~J`@^Cr+8bv`Qd8q>J6}=31wENz zzfChN)rX6nv=x+^=%gP7>3??8*`T9(x{{tvR+(5sF9LY5h8_bts5SI-q6>2^J%cKf z1((Z}NQ%wws4Eh_QSk+oXpED(J7p!x$!c^wJ)Hu-{&505HA_w|;@vl?=sNm%Hi-XZ zGVNjj3$LfQ5!;_{rl&B}eD!;Y{*)RsAMA(-w)o;u%meL;3MB;`;NDhxJVnjN6K2u@ zn6PCg_;f6pV5<@`6U5Zijw&z5^R-;68^1N1u7!zNbLatpjdSR7fW33*UVzHEbP>P} zbLqJt^x?VmgIUx9Q@++5~sr(PD@@%i?V z#rVxTm?F^k#2w7H45wTv4?qjk(!l5dp*OgF&e13=1n{{XWKz_gy3i1)5%@@cXT zZtydOWzcE{`^f@xy4s_VzMQr|O8mwR49=H@Slk!yj?Gqj{Bic+i~G(ri}31=A;VLX{VWy;9hm%SBwCqJLU67 zeq>fvLg(1ZEXO%0*a3GF#4pIZW$Y<8R6x*ImK#V4>?k*gkRN|7Hw>78?5;Lk0q{Vz zp)^YtrY_~(__i9uXndsF&X%TyQ*AOpoH4?q+#~0pza2`5A1ns)Lszy7$h^vIda^|po1I*De}6OYZgd4g!JsIs<09EpgfiI*+c>DDy-nu* zk#IZ|?p87d0pGbfyFE`%+86PuA~92x@wc0^!Aq-)wq&bCTXH6QX;}=qa6@!NAwx1( z#y#KUTvH&EgD2sc>56sBv3N8TZij9A(ljWU`F8miQ<+*RG{h$(Y9RReZr0=f;}hf=u2s|B+hbmDB96V^&<&nJPXq;rPsDQSkTBGXin)Q-HtPv#9&vgkBFGwy> zfro0^9SvKhq|y;nNZ}z8Y?=gZPJ`CLUvgV|0-hg3CCeqR!+xbT6tjjSajVkXrTF7Y zz-1R?Z3#ZPETy(YoCX>S8TD+SkR*0!T<%OnQrtbFt=gU8s{}JR=&2HjeOky`Aayj4 zfb}gI^EG2Nwd+!bYi;Xg?VL;PMQG6_{#&AUH<8`q5Mfa~C61<0623EzmRmAL5F7eL z@QfhgqHZ+3Bt4+1)1-)ft{z_pBowg`FYiWIf`A>}C;$=7?LkRKW5?@yP#5(4*n{Q+ z%uk?dfHev9FaY0+JZZMy^rE(O^K37YmV<8pXPC7hf#&H*YmNm+|8M7}LJMppxR4NX zRPim*bk-8W;rPXrC{?WKoFG|M0bwKF@F`-G=8mIFQGHIv9TG0@L!-d>iG8S=&GcqM zNiq`L(}!*bgAeqfxwItKNovJ1)DFj*x~?DbOui&e@w9q9HL3HVnUi?D=yo&;|8oTz z0fNunj>hYL);D7%D%C^M<44R{1$fm;bOSKHwGx#8e6kWX0XSEoPhbi54g}|z1oogKEt%P$Sico5nDYN^`g93MCqrdATy5g@J_wh+&JG#; z@K)pmMGkC5g04am+q8|J4)SH?BDHa6w~{ccW!q32MN52A!nZ$$Y<9>t;cA{_gw5&v z*&=!3q9pV|33KaA;?n2iBe7y_RXGux-6krf{qmxyVs0C#T2`BHCKpY2uk}K|OmwcTHapTf7 z-PB7;nzTprPIwRMu}b2yWa=mo)A{C$#X{|2Zdp?3jX-wL&!KAyLAxcPuA4(k6wtUQ z5(-$W$ljHnLp9)~+n+we@w}>a&^YqleHP5BNSFN zO8xX@bRW^L|5fycnfRyGA*#yf!D{Xyw4WkX=j?l^ME(0=G$M;I52Ip$(Zf*HC4BcVng#ITFlvAqwqs}x zyasUM9J(K1#Cg;M<>!v`NErp>XUOQ<~d6w0us`AuRRU_>eU=G8XI)Nj`nG&0+u=@Ev(=9pp<6~ws z?tICVjR%jIr{NJprX0L`&}7EkF>@YnIc8??%X`h)_~xT#7a1){4U8W$m8V*Vj+(8h zX%8JVD0wO>RO~;m;46*5Mc5hb2DWZ8qW` zkD06SzC)(9q_0F>a@cg{J1VBmA2i>Rql<;{uU;}0Q8DZrG?f4(2Te|V?x;BjTaTK} zWW3>N(z_sx$2v>rB%UOoK2Ssi{q|Kk?D3>W@a9F{`x z^RUAb0+=FLrUI-MEKlfVLB>^1%OapRI4#X%Ww;f}ll++t=5WZV6FVXLJ+fDrNkILl z(^5iWJzBC{4IoLDQQ30pYmkB$W#t#DcS@EMx-7Y(!j`DVXQo@qA-s3DTAnundy{Oj zmCE&;?D9uCJC$%8wpf#Rk%A|^l;dGGh3)iM+-JHR7Cykc)>^WDW5uYEgQ+Ae7J5B`#peLWd8wBUB_+$ z*k8wP2A*I&`vL`MZ(#qzQjxv$*pLoH+`52eOMz=e4{M_$cv}zq2~cYi>@=X>OR$~5 z)7Z;qfp~S=zp!uX0ZUi1&k|7wSFxLNfP3*;_82J05wGE{we0okx^?UYkdBS_vRB}p z8(1Gmf%bpr!7SaQ?AJ8V-#yN*rvUHS!RG69bEE1bJK1-v(7?~^XN&RL{j4ob)Db+l zpB-nO8+8Sgpbu)8>(&T-U}?Z7_Zv#a*W1Hgoi2Z8z+OvQcJgez{JPT>jrf&V3^JgH zcLhW6rKM4huJJV^8jnPq8&a=!ZW4Q&5uy>Fx$Z8g2Wbwox%ag%vgY0Bev(U&VljLsG znHtTgmW#`V*vhn!>!>Dt*ARQ<@}^W7XawHQ+KbNXRs2L%_-J;~KaE1H-eZp`9YJSz zR{%2IE;M;-J)OeO`_c|fxsIGD7hNZ3F0EC`V0YLb4@JV*b&!pLPU>R^*`p)>2VZoP Ad;kCd diff --git a/src/install-pnpm/run.ts b/src/install-pnpm/run.ts index d611dcf..e22ee79 100644 --- a/src/install-pnpm/run.ts +++ b/src/install-pnpm/run.ts @@ -29,16 +29,17 @@ export async function runSelfInstaller(inputs: Inputs): Promise { await writeFile(path.join(dest, 'package.json'), packageJson) await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile)) - // npm is co-located with the action's node binary; resolve it directly - // so it works on runners (e.g. GHE self-hosted) where npm is not on PATH. - // PATH still needs node on it for npm's `#!/usr/bin/env node` shebang. + // Prepend the action's node directory to PATH so npm's + // `#!/usr/bin/env node` shebang resolves on runners (e.g. GHE + // self-hosted) where node isn't already on PATH. npm itself is + // resolved via PATH — on the GitHub Actions runner it is not + // co-located with `process.execPath`. const nodeDir = path.dirname(process.execPath) - const npmPath = path.join(nodeDir, process.platform === 'win32' ? 'npm.cmd' : 'npm') // On Windows, the PATH key casing varies; search case-insensitively. const pathKey = Object.keys(process.env).find(k => k.toUpperCase() === 'PATH') ?? 'PATH' const currentPath = process.env[pathKey] const npmEnv = { ...process.env, [pathKey]: currentPath ? nodeDir + path.delimiter + currentPath : nodeDir } - const npmExitCode = await runCommand(npmPath, ['ci'], { cwd: dest, env: npmEnv }) + const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest, env: npmEnv }) if (npmExitCode !== 0) { return npmExitCode }