fix: use --no-lockfile for target install

--lockfile-dir pointing to GITHUB_WORKSPACE causes the bootstrap pnpm
to use the project's pnpm-lock.yaml (which tracks project deps, not
pnpm itself), corrupting the install. Revert to --no-lockfile for now.
Lockfile-based integrity verification can be added when pnpm v11 has
proper support for verifying the pnpm package itself.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dist/index.js

@@ -261,7 +261,7 @@ ${r.comment}`:r.comment}this.doc.range[2]=r.offset;break}default:this.errors.pus
 `)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(`
 `,r)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let r=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,r.value){let n="end"in r.value?r.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type==="comment"?n?.push(this.sourceToken):e.items.push({start:[this.sourceToken]})}else r.sep?r.sep.push(this.sourceToken):r.start.push(this.sourceToken);return;case"space":case"comment":if(r.value)e.items.push({start:[this.sourceToken]});else if(r.sep)r.sep.push(this.sourceToken);else{if(this.atIndentedComment(r.start,e.indent)){let i=e.items[e.items.length-2]?.value?.end;if(Array.isArray(i)){Array.prototype.push.apply(i,r.start),i.push(this.sourceToken),e.items.pop();return}}r.start.push(this.sourceToken)}return}if(this.indent>=e.indent){let n=!this.onKeyLine&&this.indent===e.indent,i=n&&(r.sep||r.explicitKey)&&this.type!=="seq-item-ind",s=[];if(i&&r.sep&&!r.value){let o=[];for(let a=0;a<r.sep.length;++a){let A=r.sep[a];switch(A.type){case"newline":o.push(a);break;case"space":break;case"comment":A.indent>e.indent&&(o.length=0);break;default:o.length=0}}o.length>=2&&(s=r.sep.splice(o[1]))}switch(this.type){case"anchor":case"tag":i||r.value?(s.push(this.sourceToken),e.items.push({start:s}),this.onKeyLine=!0):r.sep?r.sep.push(this.sourceToken):r.start.push(this.sourceToken);return;case"explicit-key-ind":!r.sep&&!r.explicitKey?(r.start.push(this.sourceToken),r.explicitKey=!0):i||r.value?(s.push(this.sourceToken),e.items.push({start:s,explicitKey:!0})):this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken],explicitKey:!0}]}),this.onKeyLine=!0;return;case"map-value-ind":if(r.explicitKey)if(r.sep)if(r.value)e.items.push({start:[],key:null,sep:[this.sourceToken]});else if(VA(r.sep,"map-value-ind"))this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:s,key:null,sep:[this.sourceToken]}]});else if(k8(r.key)&&!VA(r.sep,"newline")){let o=kd(r.start),a=r.key,A=r.sep;A.push(this.sourceToken),delete r.key,delete r.sep,this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:o,key:a,sep:A}]})}else s.length>0?r.sep=r.sep.concat(s,this.sourceToken):r.sep.push(this.sourceToken);else if(VA(r.start,"newline"))Object.assign(r,{key:null,sep:[this.sourceToken]});else{let o=kd(r.start);this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:o,key:null,sep:[this.sourceToken]}]})}else r.sep?r.value||i?e.items.push({start:s,key:null,sep:[this.sourceToken]}):VA(r.sep,"map-value-ind")?this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:[],key:null,sep:[this.sourceToken]}]}):r.sep.push(this.sourceToken):Object.assign(r,{key:null,sep:[this.sourceToken]});this.onKeyLine=!0;return;case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":{let o=this.flowScalar(this.type);i||r.value?(e.items.push({start:s,key:o,sep:[]}),this.onKeyLine=!0):r.sep?this.stack.push(o):(Object.assign(r,{key:o,sep:[]}),this.onKeyLine=!0);return}default:{let o=this.startBlockValue(e);if(o){n&&o.type!=="block-seq"&&e.items.push({start:s}),this.stack.push(o);return}}}}yield*this.pop(),yield*this.step()}*blockSequence(e){let r=e.items[e.items.length-1];switch(this.type){case"newline":if(r.value){let n="end"in r.value?r.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type==="comment"?n?.push(this.sourceToken):e.items.push({start:[this.sourceToken]})}else r.start.push(this.sourceToken);return;case"space":case"comment":if(r.value)e.items.push({start:[this.sourceToken]});else{if(this.atIndentedComment(r.start,e.indent)){let i=e.items[e.items.length-2]?.value?.end;if(Array.isArray(i)){Array.prototype.push.apply(i,r.start),i.push(this.sourceToken),e.items.pop();return}}r.start.push(this.sourceToken)}return;case"anchor":case"tag":if(r.value||this.indent<=e.indent)break;r.start.push(this.sourceToken);return;case"seq-item-ind":if(this.indent!==e.indent)break;r.value||VA(r.start,"seq-item-ind")?e.items.push({start:[this.sourceToken]}):r.start.push(this.sourceToken);return}if(this.indent>e.indent){let n=this.startBlockValue(e);if(n){this.stack.push(n);return}}yield*this.pop(),yield*this.step()}*flowCollection(e){let r=e.items[e.items.length-1];if(this.type==="flow-error-end"){let n;do yield*this.pop(),n=this.peek(1);while(n&&n.type==="flow-collection")}else if(e.end.length===0){switch(this.type){case"comma":case"explicit-key-ind":!r||r.sep?e.items.push({start:[this.sourceToken]}):r.start.push(this.sourceToken);return;case"map-value-ind":!r||r.value?e.items.push({start:[],key:null,sep:[this.sourceToken]}):r.sep?r.sep.push(this.sourceToken):Object.assign(r,{key:null,sep:[this.sourceToken]});return;case"space":case"comment":case"newline":case"anchor":case"tag":!r||r.value?e.items.push({start:[this.sourceToken]}):r.sep?r.sep.push(this.sourceToken):r.start.push(this.sourceToken);return;case"alias":case"scalar":case"singl
Line truncated
 `)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(`
-`,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken]}]};case"explicit-key-ind":{this.onKeyLine=!0;let r=BQ(e),n=kd(r);return n.push(this.sourceToken),{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,explicitKey:!0}]}}case"map-value-ind":{this.onKeyLine=!0;let r=BQ(e),n=kd(r);return{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,key:null,sep:[this.sourceToken]}]}}}return null}atIndentedComment(e,r){return this.type!=="comment"||this.indent<=r?!1:e.every(n=>n.type==="newline"||n.type==="space")}*documentEnd(e){this.type!=="doc-mode"&&(e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop()))}*lineEnd(e){switch(this.type){case"comma":case"doc-start":case"doc-end":case"flow-seq-end":case"flow-map-end":case"map-value-ind":yield*this.pop(),yield*this.step();break;case"newline":this.onKeyLine=!1;default:e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop())}}};P8.Parser=oP});var F8=h(Em=>{"use strict";var T8=Jk(),uPe=lm(),ym=fm(),dPe=GD(),fPe=He(),hPe=sP(),O8=aP();function L8(t){let e=t.prettyErrors!==!1;return{lineCounter:t.lineCounter||e&&new hPe.LineCounter||null,prettyErrors:e}}function gPe(t,e={}){let{lineCounter:r,prettyErrors:n}=L8(e),i=new O8.Parser(r?.addNewLine),s=new T8.Composer(e),o=Array.from(s.compose(i.parse(t)));if(n&&r)for(let a of o)a.errors.forEach(ym.prettifyError(t,r)),a.warnings.forEach(ym.prettifyError(t,r));return o.length>0?o:Object.assign([],{empty:!0},s.streamInfo())}function M8(t,e={}){let{lineCounter:r,prettyErrors:n}=L8(e),i=new O8.Parser(r?.addNewLine),s=new T8.Composer(e),o=null;for(let a of s.compose(i.parse(t),!0,t.length))if(!o)o=a;else if(o.options.logLevel!=="silent"){o.errors.push(new ym.YAMLParseError(a.range.slice(0,2),"MULTIPLE_DOCS","Source contains multiple documents; please use YAML.parseAllDocuments()"));break}return n&&r&&(o.errors.forEach(ym.prettifyError(t,r)),o.warnings.forEach(ym.prettifyError(t,r))),o}function mPe(t,e,r){let n;typeof e=="function"?n=e:r===void 0&&e&&typeof e=="object"&&(r=e);let i=M8(t,r);if(!i)return null;if(i.warnings.forEach(s=>dPe.warn(i.options.logLevel,s)),i.errors.length>0){if(i.options.logLevel!=="silent")throw i.errors[0];i.errors=[]}return i.toJS(Object.assign({reviver:n},r))}function pPe(t,e,r){let n=null;if(typeof e=="function"||Array.isArray(e)?n=e:r===void 0&&e&&(r=e),typeof r=="string"&&(r=r.length),typeof r=="number"){let i=Math.round(r);r=i<1?void 0:i>8?{indent:8}:{indent:i}}if(t===void 0){let{keepUndefined:i}=r??e??{};if(!i)return}return fPe.isDocument(t)&&!n?t.toString(r):new uPe.Document(t,n,r).toString(r)}Em.parse=mPe;Em.parseAllDocuments=gPe;Em.parseDocument=M8;Em.stringify=pPe});var cP=h(tt=>{"use strict";var yPe=Jk(),EPe=lm(),CPe=Sk(),AP=fm(),IPe=Jg(),Ta=He(),BPe=_a(),QPe=sr(),bPe=ka(),NPe=Pa(),wPe=CQ(),SPe=nP(),xPe=sP(),RPe=aP(),QQ=F8(),U8=jg();tt.Composer=yPe.Composer;tt.Document=EPe.Document;tt.Schema=CPe.Schema;tt.YAMLError=AP.YAMLError;tt.YAMLParseError=AP.YAMLParseError;tt.YAMLWarning=AP.YAMLWarning;tt.Alias=IPe.Alias;tt.isAlias=Ta.isAlias;tt.isCollection=Ta.isCollection;tt.isDocument=Ta.isDocument;tt.isMap=Ta.isMap;tt.isNode=Ta.isNode;tt.isPair=Ta.isPair;tt.isScalar=Ta.isScalar;tt.isSeq=Ta.isSeq;tt.Pair=BPe.Pair;tt.Scalar=QPe.Scalar;tt.YAMLMap=bPe.YAMLMap;tt.YAMLSeq=NPe.YAMLSeq;tt.CST=wPe;tt.Lexer=SPe.Lexer;tt.LineCounter=xPe.LineCounter;tt.Parser=RPe.Parser;tt.parse=QQ.parse;tt.parseAllDocuments=QQ.parseAllDocuments;tt.parseDocument=QQ.parseDocument;tt.stringify=QQ.stringify;tt.visit=U8.visit;tt.visitAsync=U8.visitAsync});var Gd=Ct(at());var M$=Ct(EB()),Qd=Ct(at());var k$=Ct(EB()),ki=Ct(at()),P$=Ct(Pf()),T$=Ct(D$()),O$=Ct(require("os"));async function L$(t){let e=await JRe();(0,ki.saveState)("cache_path",e);let r=await(0,T$.hashFiles)(t.cacheDependencyPath);if(!r)throw new Error("Some specified paths were not resolved, unable to cache dependencies.");let n=`pnpm-cache-${process.env.RUNNER_OS}-${O$.default.arch()}-${r}`;(0,ki.debug)(`Primary key is ${n}`),(0,ki.saveState)("cache_primary_key",n);let i=await(0,k$.restoreCache)([e],n);if((0,ki.setOutput)("cache-hit",!!i),!i){(0,ki.info)("Cache is not found");return}(0,ki.saveState)("cache_restored_key",i),(0,ki.info)(`Cache restored from key: ${i}`)}async function JRe(){let{stdout:t}=await(0,P$.getExecOutput)("pnpm store path --silent"),e=t.trim();return(0,ki.debug)(`Cache folLine truncated
+`,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken]}]};case"explicit-key-ind":{this.onKeyLine=!0;let r=BQ(e),n=kd(r);return n.push(this.sourceToken),{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,explicitKey:!0}]}}case"map-value-ind":{this.onKeyLine=!0;let r=BQ(e),n=kd(r);return{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,key:null,sep:[this.sourceToken]}]}}}return null}atIndentedComment(e,r){return this.type!=="comment"||this.indent<=r?!1:e.every(n=>n.type==="newline"||n.type==="space")}*documentEnd(e){this.type!=="doc-mode"&&(e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop()))}*lineEnd(e){switch(this.type){case"comma":case"doc-start":case"doc-end":case"flow-seq-end":case"flow-map-end":case"map-value-ind":yield*this.pop(),yield*this.step();break;case"newline":this.onKeyLine=!1;default:e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop())}}};P8.Parser=oP});var F8=h(Em=>{"use strict";var T8=Jk(),uPe=lm(),ym=fm(),dPe=GD(),fPe=He(),hPe=sP(),O8=aP();function L8(t){let e=t.prettyErrors!==!1;return{lineCounter:t.lineCounter||e&&new hPe.LineCounter||null,prettyErrors:e}}function gPe(t,e={}){let{lineCounter:r,prettyErrors:n}=L8(e),i=new O8.Parser(r?.addNewLine),s=new T8.Composer(e),o=Array.from(s.compose(i.parse(t)));if(n&&r)for(let a of o)a.errors.forEach(ym.prettifyError(t,r)),a.warnings.forEach(ym.prettifyError(t,r));return o.length>0?o:Object.assign([],{empty:!0},s.streamInfo())}function M8(t,e={}){let{lineCounter:r,prettyErrors:n}=L8(e),i=new O8.Parser(r?.addNewLine),s=new T8.Composer(e),o=null;for(let a of s.compose(i.parse(t),!0,t.length))if(!o)o=a;else if(o.options.logLevel!=="silent"){o.errors.push(new ym.YAMLParseError(a.range.slice(0,2),"MULTIPLE_DOCS","Source contains multiple documents; please use YAML.parseAllDocuments()"));break}return n&&r&&(o.errors.forEach(ym.prettifyError(t,r)),o.warnings.forEach(ym.prettifyError(t,r))),o}function mPe(t,e,r){let n;typeof e=="function"?n=e:r===void 0&&e&&typeof e=="object"&&(r=e);let i=M8(t,r);if(!i)return null;if(i.warnings.forEach(s=>dPe.warn(i.options.logLevel,s)),i.errors.length>0){if(i.options.logLevel!=="silent")throw i.errors[0];i.errors=[]}return i.toJS(Object.assign({reviver:n},r))}function pPe(t,e,r){let n=null;if(typeof e=="function"||Array.isArray(e)?n=e:r===void 0&&e&&(r=e),typeof r=="string"&&(r=r.length),typeof r=="number"){let i=Math.round(r);r=i<1?void 0:i>8?{indent:8}:{indent:i}}if(t===void 0){let{keepUndefined:i}=r??e??{};if(!i)return}return fPe.isDocument(t)&&!n?t.toString(r):new uPe.Document(t,n,r).toString(r)}Em.parse=mPe;Em.parseAllDocuments=gPe;Em.parseDocument=M8;Em.stringify=pPe});var cP=h(tt=>{"use strict";var yPe=Jk(),EPe=lm(),CPe=Sk(),AP=fm(),IPe=Jg(),Ta=He(),BPe=_a(),QPe=sr(),bPe=ka(),NPe=Pa(),wPe=CQ(),SPe=nP(),xPe=sP(),RPe=aP(),QQ=F8(),U8=jg();tt.Composer=yPe.Composer;tt.Document=EPe.Document;tt.Schema=CPe.Schema;tt.YAMLError=AP.YAMLError;tt.YAMLParseError=AP.YAMLParseError;tt.YAMLWarning=AP.YAMLWarning;tt.Alias=IPe.Alias;tt.isAlias=Ta.isAlias;tt.isCollection=Ta.isCollection;tt.isDocument=Ta.isDocument;tt.isMap=Ta.isMap;tt.isNode=Ta.isNode;tt.isPair=Ta.isPair;tt.isScalar=Ta.isScalar;tt.isSeq=Ta.isSeq;tt.Pair=BPe.Pair;tt.Scalar=QPe.Scalar;tt.YAMLMap=bPe.YAMLMap;tt.YAMLSeq=NPe.YAMLSeq;tt.CST=wPe;tt.Lexer=SPe.Lexer;tt.LineCounter=xPe.LineCounter;tt.Parser=RPe.Parser;tt.parse=QQ.parse;tt.parseAllDocuments=QQ.parseAllDocuments;tt.parseDocument=QQ.parseDocument;tt.stringify=QQ.stringify;tt.visit=U8.visit;tt.visitAsync=U8.visitAsync});var Gd=Ct(at());var M$=Ct(EB()),Qd=Ct(at());var k$=Ct(EB()),ki=Ct(at()),P$=Ct(Pf()),T$=Ct(D$()),O$=Ct(require("os"));async function L$(t){let e=await JRe();(0,ki.saveState)("cache_path",e);let r=await(0,T$.hashFiles)(t.cacheDependencyPath);if(!r)throw new Error("Some specified paths were not resolved, unable to cache dependencies.");let n=`pnpm-cache-${process.env.RUNNER_OS}-${O$.default.arch()}-${r}`;(0,ki.debug)(`Primary key is ${n}`),(0,ki.saveState)("cache_primary_key",n);let i=await(0,k$.restoreCache)([e],n);if((0,ki.setOutput)("cache-hit",!!i),!i){(0,ki.info)("Cache is not found");return}(0,ki.saveState)("cache_restored_key",i),(0,ki.info)(`Cache restored from key: ${i}`)}async function JRe(){let{stdout:t}=await(0,P$.getExecOutput)("pnpm store path --silent"),e=t.trim();return(0,ki.debug)(`Cache folLine truncated
   - version ${e} in the GitHub Action config with the key "version"
   - version ${s} in the package.json with the key "packageManager"
 Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_PM_VERSION`);return`${n?"@pnpm/exe":"pnpm"}@${e}`}if(!i)throw new Error(`No workspace is found.

src/install-pnpm/run.ts

@@ -47,12 +47,7 @@ export async function runSelfInstaller(inputs: Inputs): Promise<number> {
 
   // prepare target pnpm
   const target = await readTarget({ version, packageJsonFile, standalone })
-  const installArgs = ['install', target]
-  if (GITHUB_WORKSPACE) {
-    installArgs.push('--lockfile-dir', GITHUB_WORKSPACE)
-  } else {
-    installArgs.push('--no-lockfile')
-  }
+  const installArgs = ['install', target, '--no-lockfile']
   const exitCode = await runCommand(bootstrapPnpm, installArgs, { cwd: dest })
   if (exitCode === 0) {
     const pnpmHome = path.join(dest, 'node_modules/.bin')