feat: auto-pass --no-runtime when the runtime input is set

When the user pins a runtime via the action's `runtime` input, that
runtime has already been installed and put on PATH by the time `pnpm
install` runs. If the project's package.json also declares a different
`devEngines.runtime` with `onFail: download`, pnpm install would fetch
that second runtime and silently swap the active one — defeating the
matrix/explicit pin.

`--no-runtime` (pnpm v11.1.0+) tells pnpm install to skip the runtime
fetch entirely. Appending it whenever the `runtime` input is set
matches user intent: "I told the action which runtime I want, don't
let install second-guess it."

When the input is omitted (runtime fully driven by devEngines.runtime),
`pnpm install` runs unmodified — the devEngines runtime is the only
source of truth and install should honor it.

Adds a `runtime-overrides-devengines` test that pins node@22 in the
action input, declares ^20.0.0 in devEngines.runtime, and asserts node
22 is still active after install.

Bumps test workflow's pnpm pin to 11.1.0 since `--no-runtime` requires it.

Author: zkochan

.github/workflows/test.yaml

@@ -17,11 +17,11 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            version: '11.0.7'
+            version: '11.1.0'
           - os: macos-latest
-            version: '11.0.7'
+            version: '11.1.0'
           - os: windows-latest
-            version: '11.0.7'
+            version: '11.1.0'
 
     steps:
       - uses: actions/checkout@v6
@@ -73,7 +73,7 @@ jobs:
       - id: pnpm
         uses: ./
         with:
-          version: '11.0.7'
+          version: '11.1.0'
           runtime: node@${{ matrix.major }}
 
       - name: 'Test: node binary on PATH'
@@ -114,7 +114,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: ./
         with:
-          version: '11.0.7'
+          version: '11.1.0'
           runtime: bun@latest
       - name: 'Test: bun on PATH'
         run: |
@@ -130,7 +130,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: ./
         with:
-          version: '11.0.7'
+          version: '11.1.0'
           runtime: deno@2
       - name: 'Test: deno on PATH'
         run: |
@@ -155,7 +155,7 @@ jobs:
           rm -f pnpm-lock.yaml
           cat > package.json <<'EOF'
           {
-            "packageManager": "pnpm@11.0.7",
+            "packageManager": "pnpm@11.1.0",
             "devEngines": {
               "runtime": { "name": "node", "version": "^22.0.0", "onFail": "download" }
             },
@@ -197,6 +197,53 @@ jobs:
           fi
         shell: bash
 
+  runtime-overrides-devengines:
+    # Explicit `runtime` input conflicts with `devEngines.runtime` in
+    # package.json. The action should install the explicit version AND pass
+    # `--no-runtime` to pnpm install so the devEngines runtime doesn't shadow
+    # the matrix one. Requires pnpm >= 11.1.0.
+    name: 'Explicit runtime overrides devEngines.runtime'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up package.json with conflicting devEngines.runtime
+        run: |
+          rm -f pnpm-lock.yaml
+          cat > package.json <<'EOF'
+          {
+            "packageManager": "pnpm@11.1.0",
+            "devEngines": {
+              "runtime": { "name": "node", "version": "^20.0.0", "onFail": "download" }
+            },
+            "dependencies": {
+              "is-odd": "3.0.1"
+            }
+          }
+          EOF
+        shell: bash
+
+      - id: pnpm
+        uses: ./
+        with:
+          runtime: node@22
+
+      - name: 'Test: node 22 stays active after pnpm install'
+        run: |
+          set -e
+          actual="$(node --version)"
+          echo "node --version: ${actual}"
+          case "${actual}" in
+            v22.*) ;;
+            *) echo "Expected node v22.x after install (--no-runtime should have suppressed the devEngines runtime fetch), got ${actual}"; exit 1 ;;
+          esac
+          # pnpm install should still have run.
+          if [ ! -d node_modules/is-odd ]; then
+            echo "Expected pnpm install to have populated node_modules/is-odd"
+            exit 1
+          fi
+        shell: bash
+
   runtime-version-fallback:
     # `runtime: node` without an `@<version>` suffix should fall back to the
     # version declared in devEngines.runtime.
@@ -210,7 +257,7 @@ jobs:
           rm -f pnpm-lock.yaml
           cat > package.json <<'EOF'
           {
-            "packageManager": "pnpm@11.0.7",
+            "packageManager": "pnpm@11.1.0",
             "devEngines": {
               "runtime": { "name": "node", "version": "^20.0.0", "onFail": "download" }
             }
@@ -246,7 +293,7 @@ jobs:
       - id: pnpm
         uses: ./
         with:
-          version: '11.0.7'
+          version: '11.1.0'
 
       - name: 'Test: pnpm works, runtime outputs are empty'
         env:

README.md

@@ -95,7 +95,7 @@ jobs:
 1. The action installs `@pnpm/exe` (a Node.js-bundled standalone build of pnpm) into `dest`, then self-updates to the requested pnpm version.
 2. `PNPM_HOME` is exported and `$PNPM_HOME/bin` is added to `PATH`.
 3. The action runs `pnpm runtime set <name> <version> -g`, which downloads the requested runtime into `$PNPM_HOME/bin` — making `node`, `bun`, or `deno` available to later workflow steps.
-4. If a `package.json` exists in the workspace, the action runs `pnpm install`.
+4. If a `package.json` exists in the workspace, the action runs `pnpm install`. When the `runtime` input is set, `--no-runtime` is appended so the just-installed runtime isn't shadowed by a different version declared in `devEngines.runtime`. This flag requires pnpm ≥ 11.1.0.
 
 ## License
 

dist/index.js

@@ -20,8 +20,16 @@ export function runPnpmInstall(inputs: Inputs) {
     return
   }
 
-  startGroup('Running pnpm install...')
-  const { error, status } = spawnSync('pnpm', ['install'], {
+  // When the user pinned a runtime explicitly via the `runtime` input, we've
+  // already installed it via `pnpm runtime set` above. Pass `--no-runtime`
+  // to `pnpm install` so the matrix/explicit node isn't shadowed by a
+  // different version from `devEngines.runtime` on the same install.
+  // Requires pnpm >= 11.1.0 (the version that introduced `--no-runtime`).
+  const args = ['install']
+  if (inputs.runtime) args.push('--no-runtime')
+
+  startGroup(`Running pnpm ${args.join(' ')}...`)
+  const { error, status } = spawnSync('pnpm', args, {
     stdio: 'inherit',
     cwd: GITHUB_WORKSPACE,
     shell: true,