Set registry to install pnpm from

[KnisterPeter]

Hi there,

is there a way to set the registry to install pnpm from? We do receive a lot of 429 errors from the public npm registry now. This happens while we try to install pnpm on github workflow runs.

[matanper]

same here
I started caching the pnpm dest dir

    - name: Restore pnpm installation
      id: pnpm-cache
      uses: actions/cache@v4
      with:
        path: ~/.cache/setup-pnpm
        key: pnpm-bin-${{ runner.os }}-${{ runner.arch }}-v${{ inputs.pnpm-version }}

    - name: Add cached pnpm to PATH
      if: steps.pnpm-cache.outputs.cache-hit == 'true'
      shell: bash
      run: |
        # Match what pnpm action-setup does: binaries are in dest/node_modules/.bin
        PNPM_HOME=~/.cache/setup-pnpm/node_modules/.bin
        echo "$PNPM_HOME" >> "$GITHUB_PATH"
        echo "PNPM_HOME=$PNPM_HOME" >> "$GITHUB_ENV"

    - name: Setup pnpm (cache miss)
      if: steps.pnpm-cache.outputs.cache-hit != 'true'
      uses: pnpm/action-setup@v4
      with:
        dest: ~/.cache/setup-pnpm
        run_install: false

[MikevPeeren]

We are also receiving allot of 429 errors as of late

[BartJanvanAssen]

also receiving a lot of 429 recently.

[remihuigen]

We are not just seeing 429 but also an increase in 403

[MikevPeeren]

The issue stems from NPM, see the status page here:

https://status.npmjs.org/

And a thread at pnpm here:

pnpm/pnpm#8953

[KnisterPeter]

@MikevPeeren thanks for pointing that out. Still it would make sense to allow this action to install e.g. via a proxy with a cached version to mitigate this kind of issues.

[benquarmby]

Does this action respect the local .npmrc file and its registry setting when installing PNPM? If so, that would be a viable workflow for our purposes since we use a private registry for everything.

In the age of supply chain attacks like the recent NPM breach, the ability to install package managers from a controlled internal registry is critical.

Edit: The answer is no, it does not observe a local .npmrc file and its registry setting when installing PNPM 😞

[Eynorey]

I raised a PR to add support for custom registry configuration via .npmrc.

Would that cover your needs or does anyone have a scenario where you need to differentiate between the registry used to install PNPM vs other packages?