[feature request] Use version of pnpm specified in package.json's engines section

[kopach]

In my projects, I'm trying to specify exact versions of dependencies (including node and pnpm).

I would like to specify a version of pnpm once in package.json and reuse in pnpm/action-setup action

package.json has engines section for this

{
  "engines": {
    "pnpm": "7.32.5"
  },
}

Would be great, if pnpm/action-setup could support this field.

Note: actions/setup-node supports engines.node via node-version-file property.

I'm also aware of packageManager property of package.json, but with it – I can't enforce exact version of PNPM, however with engines.pnpm + engine-strict=true - I can, so everyone in the team has same environment

---

It might be related to this: #24

[kopach]

For anyone interested, as a workaround, I'm doing this right now

    - name: Get PNPM version from package.json
      id: pnpm-version
      shell: bash
      run: echo "pnpm_version=$(node -p 'require(`./package.json`).engines.pnpm')" >> $GITHUB_OUTPUT

    - name: Install PNPM
      uses: pnpm/action-setup@v2.2.4
      with:
        version: ${{ steps.pnpm-version.outputs.pnpm_version }}

[jrmajor]

I'm also aware of packageManager property of package.json, but with it – I can't enforce exact version of PNPM, however with engines.pnpm + engine-strict=true - I can, so everyone in the team has same environment

You can specify both packageManager and devEngines fields in package.json:

  "packageManager": "pnpm@10.13.1",
  "devEngines": {
    "packageManager": {
      "name": "pnpm",
      "version": "10.13.1"
    }
  }

I think this covers all cases where you may want to enforce usage of specific version of pnpm:

• In CI, pnpm/action-setup will automatically respect version from packageManager,
• When somebody tries to use npm install, it fails because of devEngines (feat: devEngines npm/cli#7766)
• When somebody tries to use yarn install, it fails because of packageManager (Hotfixes for the 1.22.20 yarnpkg/yarn#9009),
• When somebody tries to use the wrong pnpm version, pnpm will automatically download and use the one from packageManager (feat: automatically switch to the right pnpm version pnpm#8363 and pnpm/pnpm@dfcf034).

Would that solve your issue, or are there more reasons why engines.pnpm support would be needed?

[kopach]

Hi @jrmajor , thanks for your reply. This is a good solution, although I think it's not optimal and doesn't solve the original issue. It requires mental effort to keep version of PNPM in sync between packageManager and engines/devEngines sections.(almost the same as syncing it between actions/setup-node setup and package.json engines I have now).

I would like to have just 1 source of truth for PNPM version management. This way, updating 1 place is easy and less error-prone.