feat: support pnpm v12

Approve the pinned @pnpm/exe install script for npm 12, add pnpm 12 coverage across supported runner platforms, and clarify that action-setup remains supported alongside pnpm/setup.

.github/workflows/test.yaml

@@ -27,6 +27,12 @@ jobs:
           - name: 'ubuntu / v10.33.0'
             os: ubuntu-latest
             version: '10.33.0'
+          - name: 'ubuntu / v11.25.0'
+            os: ubuntu-latest
+            version: '11.25.0'
+          - name: 'ubuntu / v12.3.4'
+            os: ubuntu-latest
+            version: '12.3.4'
           - name: 'ubuntu / v9.15.5 / custom-dest'
             os: ubuntu-latest
             version: '9.15.5'
@@ -34,9 +40,15 @@ jobs:
           - name: 'macos / v9.15.5'
             os: macos-latest
             version: '9.15.5'
+          - name: 'macos / v12.3.4'
+            os: macos-latest
+            version: '12.3.4'
           - name: 'windows / v9.15.5'
             os: windows-latest
             version: '9.15.5'
+          - name: 'windows / v12.3.4'
+            os: windows-latest
+            version: '12.3.4'
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -166,17 +178,26 @@ jobs:
         shell: bash
 
   standalone:
-    name: Standalone mode
+    # npm 12 blocks dependency lifecycle scripts by default. @pnpm/exe needs
+    # its install script to replace the placeholder with the native binary.
+    name: 'Standalone mode (pnpm 12 / npm 12)'
 
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 26
+
+      - name: Use npm 12
+        run: npm install --global npm@12.0.2
+
       - name: Run the action
         uses: ./
         with:
-          version: 9.15.0
+          version: 12.3.4
           standalone: true
 
       - name: 'Test: pnpm works'
@@ -184,8 +205,8 @@ jobs:
           set -e
           which pnpm
           actual="$(pnpm --version)"
-          if [ "${actual}" != "9.15.0" ]; then
-            echo "Expected 9.15.0, got ${actual}"
+          if [ "${actual}" != "12.3.4" ]; then
+            echo "Expected 12.3.4, got ${actual}"
             exit 1
           fi
           mkdir /tmp/test-standalone

README.md

@@ -1,9 +1,9 @@
 > [!IMPORTANT]
-> **This action has a successor: [`pnpm/setup`](https://github.com/pnpm/setup).**
+> **This action supports pnpm v12 and earlier.**
 >
-> For pnpm v11 and newer, use [`pnpm/setup`](https://github.com/pnpm/setup) instead. It downloads pnpm's self-contained release binary (no Node.js or npm required) and can install a JavaScript runtime (Node.js, Bun, or Deno) in the same step, replacing `actions/setup-node`.
+> For pnpm v11 and newer, [`pnpm/setup`](https://github.com/pnpm/setup) is also available. It downloads pnpm's self-contained release binary (no Node.js or npm required) and can install a JavaScript runtime (Node.js, Bun, or Deno) in the same step, replacing `actions/setup-node` when its feature set fits your workflow.
 >
-> `pnpm/action-setup` remains the action to use for installing pnpm v10 and older. See [Migrating to pnpm/setup](#migrating-to-pnpmsetup) below.
+> You can continue using `pnpm/action-setup` with `actions/setup-node`, including for pnpm v11 and v12. See [Using pnpm/setup instead](#using-pnpmsetup-instead) below if you want a single action to install pnpm and a JavaScript runtime.
 
 # Setup pnpm
 
@@ -13,7 +13,7 @@ Install pnpm package manager.
 >
 > The v2 version of this action [has stopped working](https://github.com/pnpm/action-setup/issues/135) with newer Node.js versions. Please, upgrade to the latest version to fix any issues.
 
-## Migrating to pnpm/setup
+## Using pnpm/setup instead
 
 [`pnpm/setup`](https://github.com/pnpm/setup) installs pnpm v11+ as a native standalone executable and can install Node.js, Bun, or Deno in the same step, so a typical workflow no longer needs `actions/setup-node` or an explicit `pnpm install` step:
 
@@ -237,7 +237,7 @@ jobs:
 
 ## Notes
 
-This action does not set up Node.js. Use [actions/setup-node](https://github.com/actions/setup-node) yourself. If you are on pnpm v11 or newer, [`pnpm/setup`](https://github.com/pnpm/setup) can install pnpm and Node.js in a single step.
+This action does not set up Node.js. Use [actions/setup-node](https://github.com/actions/setup-node) yourself. As an alternative for pnpm v11 or newer, [`pnpm/setup`](https://github.com/pnpm/setup) can install pnpm and Node.js in a single step.
 
 ## License
 

src/install-pnpm/run.ts

@@ -10,7 +10,15 @@ import pnpmLock from './bootstrap/pnpm-lock.json'
 import exeLock from './bootstrap/exe-lock.json'
 
 const BOOTSTRAP_PNPM_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { pnpm: pnpmLock.packages['node_modules/pnpm'].version } })
-const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({ private: true, dependencies: { '@pnpm/exe': exeLock.packages['node_modules/@pnpm/exe'].version } })
+const bootstrapExeVersion = exeLock.packages['node_modules/@pnpm/exe'].version
+const BOOTSTRAP_EXE_PACKAGE_JSON = JSON.stringify({
+  private: true,
+  dependencies: { '@pnpm/exe': bootstrapExeVersion },
+  // npm 12 blocks dependency lifecycle scripts unless they are explicitly
+  // approved. @pnpm/exe's verified, lockfile-pinned install script replaces
+  // the placeholder executable with the native binary for this platform.
+  allowScripts: { [`@pnpm/exe@${bootstrapExeVersion}`]: true },
+})
 
 export interface SelfInstallerResult {
   exitCode: number