Summary
Since v6, the action fails when the dest input (or its default location) resolves to a path containing a space on Windows. This worked correctly on v5.
Error output
(node:9744) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
added 1 package, and audited 2 packages in 21s
1 package is looking for funding
run `npm fund` for details
found 0 vulnerabilities
'C:\GitHub' is not recognized as an internal or external command,
operable program or batch file.
Error: Something went wrong, self-installer exits with code 1
The 'C:\GitHub' is not recognized... line is the giveaway: the path (something like C:\GitHub Actions\...) is being split on the space and cmd.exe is trying to execute C:\GitHub as a command. The accompanying DEP0190 warning points at the same root cause — args being concatenated into a shell command line without escaping.
Likely cause
In src/install-pnpm/run.ts, runCommand is invoked with shell: process.platform === 'win32'. On Windows that routes the command through cmd.exe, and any argument or path containing a space is not quoted, so it gets word-split by the shell.
This behavior was introduced in v6.0.0 — the v5.x implementation spawned process.execPath directly without a shell, so paths with spaces were never an issue.
v6.0.4 (#239) made it worse by also prepending path.dirname(process.execPath) to PATH, which on Windows is common C:\Program Files\nodejs — another unquoted space.
Reproduction
Use pnpm/action-setup@v6 on a Windows runner whose workspace / dest resolves to a path containing a space (e.g. a self-hosted runner installed under C:\GitHub Actions\...). The self-installer exits with code 1 as shown above. Downgrading to pnpm/action-setup@v5 works.
Expected behavior
dest, and any path the action derives internally, should support spaces — as it did in v5.
Suggested fix
Drop shell: true and invoke the binaries directly (resolving npm.cmd explicitly on Windows), or properly quote every argument and any PATH entries before they reach the shell.
Summary
Since v6, the action fails when the
destinput (or its default location) resolves to a path containing a space on Windows. This worked correctly on v5.Error output
The
'C:\GitHub' is not recognized...line is the giveaway: the path (something likeC:\GitHub Actions\...) is being split on the space and cmd.exe is trying to executeC:\GitHubas a command. The accompanyingDEP0190warning points at the same root cause — args being concatenated into a shell command line without escaping.Likely cause
In
src/install-pnpm/run.ts,runCommandis invoked withshell: process.platform === 'win32'. On Windows that routes the command through cmd.exe, and any argument or path containing a space is not quoted, so it gets word-split by the shell.This behavior was introduced in v6.0.0 — the v5.x implementation spawned
process.execPathdirectly without a shell, so paths with spaces were never an issue.v6.0.4 (#239) made it worse by also prepending
path.dirname(process.execPath)toPATH, which on Windows is commonC:\Program Files\nodejs— another unquoted space.Reproduction
Use
pnpm/action-setup@v6on a Windows runner whose workspace /destresolves to a path containing a space (e.g. a self-hosted runner installed underC:\GitHub Actions\...). The self-installer exits with code 1 as shown above. Downgrading topnpm/action-setup@v5works.Expected behavior
dest, and any path the action derives internally, should support spaces — as it did in v5.Suggested fix
Drop
shell: trueand invoke the binaries directly (resolvingnpm.cmdexplicitly on Windows), or properly quote every argument and any PATH entries before they reach the shell.