Support installation from custom NPM registry via `.npmrc` by Eynorey · Pull Request #179 · pnpm/action-setup

Eynorey · 2025-09-22T19:28:16Z

Related to #177.

This PR adds support for custom NPM registry configurations, allowing the action to install PNPM from there.

With this, the action copies a potential .npmrc into the destination directory from where PNPM runs self-install, respecting potential custom registry configurations.

# My custom registry
registry = https://my-registry.my-company.com/

Note

I was also considering an action parameter, but this feels more natural - if you are already using a custom registry via .npmrc, then you'll likely want your package manager to be fetched form there as well.

But I could also see a parameter being helpful for some setups, perhaps even acting as an override to the .npmrc registry configuration. Maybe as a follow-up?

Any feedback is greatly appreciated!

benquarmby

❤️ Love this.

My opinion doesn't matter a great deal, but I'm going to give it anyway 😜

src/utils/index.ts

src/install-pnpm/run.ts

Eynorey · 2025-10-06T17:05:45Z

@zkochan @KSXGitHub would you mind taking a look when you get a chance, thanks!

Ellosaur · 2025-10-07T08:28:29Z

I have an environment where using the public registry is not an option due to security constraints, so being able to configure this installation to use our private registry is essential so thanks for doing this!

KSXGitHub

Alternatively, pnpm itself uses the package ini (with @types/ini for typing) to parse INI. That could be used instead of trying to reinvent the parser.

src/utils/index.ts

zkochan · 2025-10-07T12:22:37Z

Just copy the .npmrc file from GITHUB_WORKSPACE to dest. Installation is performed by a pnpm version bundled with the action. It can read the .npmrc file.

copy .npmrc from GitHub workspace if it exists so that PNPM respects custom registry configurations when self-installing

Eynorey · 2025-10-07T21:30:18Z

Thank you everyone for taking a look, and thank you for the feedback!

Just copy the .npmrc file from GITHUB_WORKSPACE to dest. Installation is performed by a pnpm version bundled with the action. It can read the .npmrc file.

That's so much more elegant, thank you for the suggestion!
Updated.

@zkochan

* Fix multiline run_install example in README.md (pnpm#167) * Remove --frozen-lockfile from examples (pnpm#171) * feat: support installation from custom NPM registry (pnpm#179) copy .npmrc from GitHub workspace if it exists so that PNPM respects custom registry configurations when self-installing * Update README.md (pnpm#175) fix the string run_install example * Remove unused `@types/node-fetch` dependency (pnpm#186) * Clarify that package_json_file is relative to GITHUB_WORKSPACE (pnpm#184) * Clarify that package_json_file is relative to GITHUB_WORKSPACE Clarify the description for package_json_file parameter to specify that the path must be relative to the repository root. * Apply suggestion from @zkochan --------- Co-authored-by: Zoltan Kochan <z@kochan.io> * feat: store caching (pnpm#188) * add pnpm store caching * style: format * no semicolons * no star imports * import order * style: no star imports --------- Co-authored-by: khai96_ <hvksmr1996@gmail.com> * refactor: remove star imports (pnpm#196) * fix(ci): exclude macos (pnpm#197) * ci: pin github actions (pnpm#199) * fix: regenerate lockfile to match package.json overrides * fix(security): override fast-xml-parser to >=5.3.4 Resolves GHSA-37qj-frw5-hhjh (RangeError DoS via numeric entities) in transitive dependency @actions/cache > @azure/storage-blob > @azure/core-xml > fast-xml-parser. * fix: resolve lint, build, and security audit failures - Fix prefer-const lint error in cache-restore/run.ts - Override undici to >=6.23.0 (GHSA-g9mf-h72j-4rw9) - Rebuild dist to match source changes * fix(ci): exclude dist from CodeQL analysis dist/index.js is generated by ncc bundling — CodeQL flags dependency code as security issues. Ignore the dist directory since it's not source code. --------- Co-authored-by: Matthias <matthias.dailey@gmail.com> Co-authored-by: Adrian Riedel <Eynorey@users.noreply.github.com> Co-authored-by: Roman Usherenko <roman.usherenko@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Chris Martin <ch.martin@gmail.com> Co-authored-by: Zoltan Kochan <z@kochan.io> Co-authored-by: Jeremiasz Major <jrh.mjr@gmail.com> Co-authored-by: khai96_ <hvksmr1996@gmail.com> Co-authored-by: Boosted-Bonobo <boostedbonobo1@outlook.com>

@zkochan

* Fix multiline run_install example in README.md (pnpm#167) * Remove --frozen-lockfile from examples (pnpm#171) * feat: support installation from custom NPM registry (pnpm#179) copy .npmrc from GitHub workspace if it exists so that PNPM respects custom registry configurations when self-installing * Update README.md (pnpm#175) fix the string run_install example * Remove unused `@types/node-fetch` dependency (pnpm#186) * Clarify that package_json_file is relative to GITHUB_WORKSPACE (pnpm#184) * Clarify that package_json_file is relative to GITHUB_WORKSPACE Clarify the description for package_json_file parameter to specify that the path must be relative to the repository root. * Apply suggestion from @zkochan --------- Co-authored-by: Zoltan Kochan <z@kochan.io> * feat: store caching (pnpm#188) * add pnpm store caching * style: format * no semicolons * no star imports * import order * style: no star imports --------- Co-authored-by: khai96_ <hvksmr1996@gmail.com> * refactor: remove star imports (pnpm#196) * fix(ci): exclude macos (pnpm#197) * ci: pin github actions (pnpm#199) * fix: regenerate lockfile to match package.json overrides * fix(security): override fast-xml-parser to >=5.3.4 Resolves GHSA-37qj-frw5-hhjh (RangeError DoS via numeric entities) in transitive dependency @actions/cache > @azure/storage-blob > @azure/core-xml > fast-xml-parser. * fix: resolve lint, build, and security audit failures - Fix prefer-const lint error in cache-restore/run.ts - Override undici to >=6.23.0 (GHSA-g9mf-h72j-4rw9) - Rebuild dist to match source changes * fix(ci): exclude dist from CodeQL analysis dist/index.js is generated by ncc bundling — CodeQL flags dependency code as security issues. Ignore the dist directory since it's not source code. --------- Co-authored-by: Matthias <matthias.dailey@gmail.com> Co-authored-by: Adrian Riedel <Eynorey@users.noreply.github.com> Co-authored-by: Roman Usherenko <roman.usherenko@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Chris Martin <ch.martin@gmail.com> Co-authored-by: Zoltan Kochan <z@kochan.io> Co-authored-by: Jeremiasz Major <jrh.mjr@gmail.com> Co-authored-by: khai96_ <hvksmr1996@gmail.com> Co-authored-by: Boosted-Bonobo <boostedbonobo1@outlook.com>

benquarmby reviewed Sep 22, 2025

View reviewed changes

src/utils/index.ts Outdated Show resolved Hide resolved

src/install-pnpm/run.ts Outdated Show resolved Hide resolved

Eynorey force-pushed the support-custom-registry branch 2 times, most recently from 3ea717c to eee93a8 Compare September 22, 2025 21:23

Eynorey mentioned this pull request Sep 22, 2025

Set registry to install pnpm from #177

Open

KSXGitHub reviewed Oct 7, 2025

View reviewed changes

src/utils/index.ts Outdated Show resolved Hide resolved

src/utils/index.ts Outdated Show resolved Hide resolved

src/utils/index.ts Outdated Show resolved Hide resolved

src/utils/index.ts Outdated Show resolved Hide resolved

KSXGitHub requested a review from zkochan October 7, 2025 12:00

feat: support installation from custom NPM registry

0ca63ec

copy .npmrc from GitHub workspace if it exists so that PNPM respects custom registry configurations when self-installing

Eynorey force-pushed the support-custom-registry branch from eee93a8 to 0ca63ec Compare October 7, 2025 21:25

zkochan approved these changes Oct 7, 2025

View reviewed changes

KSXGitHub approved these changes Oct 7, 2025

View reviewed changes

zkochan merged commit 41ff726 into pnpm:master Oct 8, 2025
50 of 54 checks passed

github-actions bot mentioned this pull request Nov 8, 2025

chore(deps): update pnpm/action-setup action to v4.2.0 lacolaco/blog.lacolaco.net#1173

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support installation from custom NPM registry via `.npmrc`#179

Support installation from custom NPM registry via `.npmrc`#179
zkochan merged 1 commit intopnpm:masterfrom
Eynorey:support-custom-registry

Eynorey commented Sep 22, 2025 •

edited

Loading

Uh oh!

benquarmby left a comment

Uh oh!

Uh oh!

Uh oh!

Eynorey commented Oct 6, 2025 •

edited by KSXGitHub

Loading

Uh oh!

Ellosaur commented Oct 7, 2025

Uh oh!

KSXGitHub left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zkochan commented Oct 7, 2025

Uh oh!

Eynorey commented Oct 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

Eynorey commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

benquarmby left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Eynorey commented Oct 6, 2025 • edited by KSXGitHub Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ellosaur commented Oct 7, 2025

Uh oh!

KSXGitHub left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zkochan commented Oct 7, 2025

Uh oh!

Eynorey commented Oct 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Eynorey commented Sep 22, 2025 •

edited

Loading

Eynorey commented Oct 6, 2025 •

edited by KSXGitHub

Loading