fix: append (not prepend) action node dir to PATH for npm bootstrap

src/install-pnpm/run.ts

@@ -29,16 +29,20 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
   await writeFile(path.join(dest, 'package.json'), packageJson)
   await writeFile(path.join(dest, 'package-lock.json'), JSON.stringify(lockfile))
 
-  // Prepend the action's node directory to PATH so npm's
+  // Append the action's node directory to PATH so npm's
   // `#!/usr/bin/env node` shebang resolves on runners (e.g. GHE
-  // self-hosted) where node isn't already on PATH. npm itself is
-  // resolved via PATH — on the GitHub Actions runner it is not
-  // co-located with `process.execPath`.
+  // self-hosted) where node isn't already on PATH. Append (not
+  // prepend) so a user-installed toolchain on PATH — e.g. from a
+  // prior `setup-node` step — keeps precedence; otherwise the
+  // runner-bundled node would shadow it and pair the user's npm
+  // with a mismatched node version. npm itself is resolved via
+  // PATH — on the GitHub Actions runner it is not co-located with
+  // `process.execPath`.
   const nodeDir = path.dirname(process.execPath)
   // On Windows, the PATH key casing varies; search case-insensitively.
   const pathKey = Object.keys(process.env).find(k => k.toUpperCase() === 'PATH') ?? 'PATH'
   const currentPath = process.env[pathKey]
-  const npmEnv = { ...process.env, [pathKey]: currentPath ? nodeDir + path.delimiter + currentPath : nodeDir }
+  const npmEnv = { ...process.env, [pathKey]: currentPath ? currentPath + path.delimiter + nodeDir : nodeDir }
   const npmExitCode = await runCommand('npm', ['ci'], { cwd: dest, env: npmEnv })
   if (npmExitCode !== 0) {
     return npmExitCode