feat!: replace bundled pnpm binary with npm + lockfile bootstrap

[zkochan]

Summary

• Remove the 9MB bundled pnpm.cjs/worker.js binaries from git
• Use npm ci with committed package-lock.json files (~5KB) to install a bootstrap pnpm with integrity verification
• Bootstrap pnpm then installs the target version, verified via the project's pnpm-lock.yaml (using --lockfile-dir)
• Switch bundler from @vercel/ncc to esbuild (faster, handles ESM + JSON natively)
• Modernize to ESM ("type": "module", module: "ESNext", moduleResolution: "bundler")

Trust chain

committed package-lock.json (text, reviewable, ~5KB)
  → npm ci installs bootstrap pnpm (integrity verified)
    → bootstrap pnpm installs target (verified via project's pnpm-lock.yaml)

Test plan

• Test with version input specifying a pnpm version
• Test with packageManager field in package.json
• Test with standalone: true (@pnpm/exe)
• Test with custom .npmrc for private registry
• Test on Linux, macOS, and Windows runners

🤖 Generated with Claude Code

[benquarmby]

I know this is already marked as a breaking change, but I just want to point out that pnpm/action-setup@5 solved a challenging chicken-egg scenario. With v6 and this change, that solution is gone:

• Use npm ci with committed package-lock.json files (~5KB) to install a bootstrap pnpm with integrity verification

Consumers inside a corporate GHE instance are likely to be using clean-slate GitHub actions runners without Node or NPM preinstalled. So npm ci is guaranteed to fail in that situation. We can't assume NPM exists on the runner before installing PNPM. PNPM needs to exist first so the package cache can be immediately configured

      - name: Install PNPM
        uses: actions/pnpm-action-setup@v5.0.0
      - name: Install Node.js
        uses: actions/setup-node@v6.3.0
        with:
          cache: pnpm # not possible unless PNPM is already installed
          node-version-file: .nvmrc

The only known workaround is to run actions/setup-node twice. Once before installing PNPM, then again afterwards to configure the cache. Highly inefficient.

FYI @Eynorey

[benquarmby]

Unfortunately the "use actions/setup-node twice" workaround also does not work. Steps like the following result in a cryptic error. We wont be able to upgrade to v6 in its current state.

      - name: Install Node.js
        uses: actions/setup-node@v6.3.0
        with:
          node-version-file: .nvmrc
      - name: Install PNPM
        uses: actions/pnpm-action-setup@v6.0.0
      - name: Configure Dependency Cache
        uses: actions/setup-node@v6.3.0
        with:
          cache: pnpm

Error: /home/runner/setup-pnpm/node_modules/.bin/pnpm: error while loading shared libraries: libatomic.so.1: cannot open shared object file: No such file or directory

[sondr3]

This deserves it's own issue FYI, you should open one. I was wondering why our GHE Actions had different errors compared to the GitHub ones.

[benquarmby]

Good idea, I'll try to find some time to explain this properly and open an issue.

From some quick research, it should be possible to use the NPM binary that lives beside the Node runtime the action is already executing on (via using: node24). I'll do some testing and make a suggestion if it pans out:

Suggested change

	const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest })
	const npmBinary = process.platform === 'win32' ? 'npm.cmd' : 'npm';
	const npmPath = path.join(path.dirname(process.execPath), npmBinary);
	const npmExitCode = await runCommand(npmPath, ['ci'], { cwd: dest })