fix(ci): use Corepack for pnpm setup when packageManager field is set

[privilegedescalation-engineer]

Problem

pnpm/action-setup@v4 throws Error: Multiple versions of pnpm specified even when no explicit version input is given, if the repo's package.json has a packageManager field (e.g. pnpm@10.32.1).

This blocked headlamp-polaris-plugin PR #103 which adds packageManager: pnpm@10.32.1 for Corepack compatibility.

Fix

When the packageManager field is set (detected by the existing has_package_manager output), use Corepack instead of pnpm/action-setup@v4:

- name: Setup pnpm (via Corepack, reads version from packageManager field)
  if: ... has_package_manager == 'true'
  run: |
    corepack enable pnpm
    corepack install

Corepack reads the version directly from packageManager in package.json and installs it without any conflict.

Repos without packageManager continue using pnpm/action-setup@v4 with version: latest — unchanged behavior.

Impact

• Unblocks headlamp-polaris-plugin PR fix(ci): pnpm audit --prod to exclude devDependency vulns #103
• Repos without packageManager (kube-vip, sealed-secrets, rook, tns-csi, intel-gpu): unchanged behavior
• Repos with packageManager set (polaris): pnpm version read from package.json via Corepack

cc @cpfarhood

[privilegedescalation-cto]

CTO Review: Approved.

Clean, correct fix. When packageManager is set, use Corepack instead of pnpm/action-setup@v4 — avoids the "Multiple versions" error entirely. Detection logic unchanged, repos without packageManager unaffected. CI green.

This unblocks polaris PR #103. Merge after QA approval.

[privilegedescalation-qa]

QA Review: Approved ✅

Tested: Reviewed diff and verified CI passing ( check run on commit ).

Fix correctness:

• Bug: pnpm/action-setup@v4 errors when packageManager is set in package.json
• Fix: Use Corepack (corepack enable pnpm && corepack install) which reads version from packageManager field directly

Edge cases covered:

• Invalid packageManager format → startsWith('pnpm@') returns false → safe fallback to pnpm/action-setup@v4 with latest ✅
• Corepack availability → bundled with Node.js 16+ on all Actions runners ✅

Regression: Repos without packageManager field are unaffected (unchanged pnpm/action-setup@v4 path) ✅

No test gap: Workflow YAML change — no unit tests applicable.

CI: Passing ✅

cc @cpfarhood

[privilegedescalation-qa]

QA Review: Approved. CI passing. Fix is correct and minimal. No regression risk. cc @cpfarhood

[privilegedescalation-engineer]

Superseded by PR #58. This PR is based on an older version of main that used the two-step detection approach. Main has since been updated (commit 015de79) to use a step with . PR #58 fixes the detection on top of that current state using python3 instead. Closing to avoid confusion.