refactor: use pnpm 12 native bootstrap

Install the plain pnpm v12 package as the single native bootstrap, remove the legacy @pnpm/exe lockfile and runtime path, and retain the standalone input as a no-op for workflow compatibility.

src/install-pnpm/run.ts

@@ -7,17 +7,12 @@ import util from 'util'
 import { Inputs } from '../inputs'
 import { parse as parseYaml } from 'yaml'
 import pnpmLock from './bootstrap/pnpm-lock.json'
-import exeLock from './bootstrap/exe-lock.json'
 
-const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
-const bootstrapExeVersion = exeLock.packages['node_modules/@pnpm/exe'].version
-const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({
+const bootstrapPnpmVersion = pnpmLock.packages['node_modules/pnpm'].version
+const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({
   private: true,
-  dependencies: { '@pnpm/exe': bootstrapExeVersion },
-  // npm 12 blocks dependency lifecycle scripts unless they are explicitly
-  // approved. @pnpm/exe's verified, lockfile-pinned install script replaces
-  // the placeholder executable with the native binary for this platform.
-  allowScripts: { [`@pnpm/exe@${bootstrapExeVersion}`]: true },
+  dependencies: { pnpm: bootstrapPnpmVersion },
+  allowScripts: { [`pnpm@${bootstrapPnpmVersion}`]: true },
 })
 
 export interface SelfInstallerResult {
@@ -27,20 +22,14 @@ export interface SelfInstallerResult {
 
 export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerResult> {
   const { version, dest, packageJsonFile } = inputs
-
-  // pnpm v11 requires Node >= 22.13; use standalone (exe) bootstrap which
-  // bundles its own Node.js when the system Node is too old
-  const systemNode = await getSystemNodeVersion()
-  const standalone = inputs.standalone || systemNode.major < 22 || (systemNode.major === 22 && systemNode.minor < 13)
+  const targetVersion = readTargetVersion({ version, packageJsonFile })
 
   // Install bootstrap pnpm via npm (integrity verified by committed lockfile)
   await rm(dest, { recursive: true, force: true })
   await mkdir(dest, { recursive: true })
 
-  const lockfile = standalone ? exeLock : pnpmLock
-  const packageJson = standalone ? BOOTSTRAP_EXE_PACKAGE_JSON : BOOTSTRAP_PNPM_PACKAGE_JSON
-  await writeFile(path.join(dest, 'package.json'), packageJson)
-  await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))
+  await writeFile(path.join(dest, 'package.json'), BOOTSTRAP_PNPM_PACKAGE_JSON)
+  await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(pnpmLock))
 
   // Append the action's node directory to PATH so npm's
   // `#!/usr/bin/env node` shebang resolves on runners (e.g. GHE
@@ -61,12 +50,7 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
     return { exitCode: npmExitCode, binDest: path.join(dest, 'node_modules', '.bin') }
   }
 
-  // On Windows with standalone mode, npm's .bin shims can't properly
-  // execute the extensionless @pnpm/exe native binaries. Add the
-  // @pnpm/exe directory directly to PATH so pnpm.exe is found natively.
-  const pnpmHome = standalone && process.platform === 'win32'
-    ? path.join(dest, 'node_modules', '@pnpm', 'exe')
-    : path.join(dest, 'node_modules', '.bin')
+  const pnpmHome = path.join(dest, 'node_modules', '.bin')
   // PNPM_HOME/bin is where `pnpm self-update` places the target version
   // binary. It must have higher PATH precedence than pnpmHome (which
   // contains the bootstrap binary) so the self-updated version is found
@@ -81,23 +65,17 @@ export async function runSelfInstaller(inputs: Inputs): Promise<SelfInstallerRes
     const pnpmBinLink = path.join(dest, 'node_modules', '.bin', 'pnpm')
     if (!existsSync(pnpmBinLink)) {
       await mkdir(path.join(dest, 'node_modules', '.bin'), { recursive: true })
-      const target = standalone
-        ? path.join('..', '@pnpm', 'exe', 'pnpm')
-        : path.join('..', 'pnpm', 'bin', 'pnpm.mjs')
-      await symlink(target, pnpmBinLink)
+      await symlink(path.join('..', 'pnpm', 'pnpm'), pnpmBinLink)
     }
   }
 
-  const bootstrapPnpm = standalone
-    ? path.join(dest, 'node_modules', '@pnpm', 'exe', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
-    : path.join(dest, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
+  const bootstrapPnpm = path.join(dest, 'node_modules', 'pnpm', process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')
 
-  // Self-update the bootstrap to the requested pnpm version. readTargetVersion
-  // either returns a value or throws, so this always runs.
-  const targetVersion = readTargetVersion({ version, packageJsonFile })
-  const cmd = standalone ? bootstrapPnpm : process.execPath
-  const args = standalone ? ['self-update', targetVersion] : [bootstrapPnpm, 'self-update', targetVersion]
-  const exitCode = await runCommand(cmd, args, { cwd: dest })
+  if (targetVersion === bootstrapPnpmVersion) {
+    return { exitCode: 0, binDest: pnpmHome }
+  }
+
+  const exitCode = await runCommand(bootstrapPnpm, ['self-update', targetVersion], { cwd: dest })
   if (exitCode !== 0) {
     return { exitCode, binDest: pnpmHome }
   }
@@ -187,19 +165,6 @@ Please specify it by one of the following ways:
   - in the package.json with the key "devEngines.packageManager"`)
 }
 
-function getSystemNodeVersion(): Promise<{ major: number; minor: number }> {
-  return new Promise((resolve) => {
-    const cp = spawn('node', ['--version'], { stdio: ['pipe', 'pipe', 'pipe'], shell: process.platform === 'win32' })
-    let output = ''
-    cp.stdout.on('data', (data: Buffer) => { output += data.toString() })
-    cp.on('close', () => {
-      const match = output.match(/^v(\d+)\.(\d+)/)
-      resolve(match ? { major: parseInt(match[1], 10), minor: parseInt(match[2], 10) } : { major: 0, minor: 0 })
-    })
-    cp.on('error', () => resolve({ major: 0, minor: 0 }))
-  })
-}
-
 function runCommand(cmd: string, args: string[], opts: { cwd: string; env?: Record<string, string | undefined> }): Promise<number> {
   return new Promise<number>((resolve, reject) => {
     const cp = spawn(cmd, args, {