fix: use npm co-located with the action node binary#239
Conversation
ec0592c to
5a9e198
Compare
Follow-up to 5a9e198. Two refinements to the GHE self-hosted runner fix: - Spawn npm via `path.join(dirname(process.execPath), 'npm[.cmd]')` instead of relying on PATH lookup. This matches the original PR description and is robust against PATH-shadowed npm installations. - Avoid `"<dir>:undefined"` leaking into PATH when `process.env.PATH` is unset (rare, but possible in stripped environments). PATH still has the node directory prepended so npm's `#!/usr/bin/env node` shebang can resolve node on Linux/macOS.
Revert 42e75a1's switch to absolute-path npm resolution. The premise that npm is co-located with the action's node binary is false on GitHub-hosted runners: `process.execPath` points into `runner/externals/node24/bin/`, which contains node only — not npm. The absolute-path spawn produced ENOENT on Linux/macOS and "not recognized" on Windows. Go back to spawning `'npm'` and relying on PATH lookup, which works on standard runners (npm is on PATH from the runner image) and on the GHE self-hosted setup that motivated the original fix. Keep the node-directory prepend so npm's `#!/usr/bin/env node` shebang resolves, and keep the unset-PATH guard.
|
Heads up — I pushed two follow-up commits and want to flag a finding from the CI run.
On the runner,
That Result of the bad commit:
If you want, the PR description should probably be updated to drop the "npm is always co-located with the node binary" claim, since CI just disproved it. |
|
fyi: after this was published, I started getting the following error:
Updating my workflows to use the exact tag fixed the issue:
Anyway, this is probably how you're suppose to reference releases in the action marketplace and is a good change for me anyway, but just a heads up. |
|
The v6 tag was removed just for a moment before I pointed it to a new commit. It should work. However, the recommended way is to use the commit hash. It is the secure way. |
|
Updated the PR description, and thank you! |
Fixes #234 —
spawn npm ENOENTon GHE self-hosted runners where npm is not onPATH.Root cause
#212 introduced
npm cias the bootstrap mechanism. On standard GitHub-hosted runners npm is onPATH; on GHE self-hosted runners it is not guaranteed to be present.Fix
join(dirname(process.execPath), 'npm'[.cmd])-npm is always co-located with the node binary that runs the actionCI disproved this statement. An alternative approach was required. See follow up commits for correction.dirname(process.execPath)to the childPATHso npm's#!/usr/bin/env nodeshebang can resolve nodeTest plan
PATH