callstack__agent-device/.github/actions/setup-node-pnpm/action.yml

name: 'Setup Node and pnpm'
description: 'Setup pnpm, setup Node.js, and optionally install dependencies'

inputs:
  node-version:
    description: 'Node.js version'
    required: false
    default: '24.13'
  install-deps:
    description: 'Whether to install dependencies with pnpm install --frozen-lockfile'
    required: false
    default: 'true'
  cache-dependency-path:
    description: 'Lockfile path(s) used to key the pnpm store cache'
    required: false
    default: 'pnpm-lock.yaml'

runs:
  using: 'composite'
  steps:
    # package.json `packageManager` is the single source of truth for the pnpm
    # version. This action carries no default of its own: a second default is
    # how local (corepack) and CI pnpm versions drift apart silently.
    - name: Resolve pnpm version from packageManager
      id: package-manager
      run: |
        set -euo pipefail
        spec="$(node -p "require('$GITHUB_WORKSPACE/package.json').packageManager ?? ''")"
        case "$spec" in
          pnpm@[0-9]*) ;;
          *)
            echo "package.json packageManager must be pnpm@<version>, got '${spec}'" >&2
            exit 1
            ;;
        esac
        echo "pnpm-version=${spec#pnpm@}" >> "$GITHUB_OUTPUT"
      shell: bash

    - name: Setup pnpm
      uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
      with:
        version: ${{ steps.package-manager.outputs.pnpm-version }}

    - name: Setup Node.js
      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
      with:
        node-version: ${{ inputs.node-version }}
        # Only cache the pnpm store when this action also installs dependencies.
        # Jobs with install-deps: false never create the store, and on a cache
        # miss (any lockfile-changing PR) the post-job cache save fails the job.
        cache: ${{ inputs.install-deps == 'true' && 'pnpm' || '' }}
        cache-dependency-path: ${{ inputs.cache-dependency-path }}

    # Corepack resolves the same `packageManager` field locally, so a mismatch
    # here means CI is running a pnpm nobody develops against.
    - name: Assert pnpm matches packageManager
      env:
        EXPECTED_PNPM_VERSION: ${{ steps.package-manager.outputs.pnpm-version }}
      run: |
        set -euo pipefail
        actual="$(pnpm --version)"
        if [ "$actual" != "$EXPECTED_PNPM_VERSION" ]; then
          echo "pnpm ${actual} is installed but package.json pins pnpm@${EXPECTED_PNPM_VERSION}" >&2
          exit 1
        fi
        echo "pnpm ${actual} matches package.json packageManager"
      shell: bash

    - name: Install dependencies
      if: ${{ inputs.install-deps == 'true' }}
      run: pnpm install --frozen-lockfile
      shell: bash