feat: add install input to opt out of auto pnpm install

The action runs `pnpm install` by default when a package.json is
present. Set `install: false` to skip it — useful for jobs that only
need pnpm itself (e.g. `pnpm audit`, lockfile-only regeneration).

Author: zkochan

.github/workflows/test.yaml

@@ -281,6 +281,44 @@ jobs:
           esac
         shell: bash
 
+  install-false:
+    # `install: false` skips the auto-install step even though a manifest is
+    # present.
+    name: 'install: false skips pnpm install'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up package.json with a dependency
+        run: |
+          rm -f pnpm-lock.yaml
+          cat > package.json <<'EOF'
+          {
+            "packageManager": "pnpm@11.1.0",
+            "dependencies": {
+              "is-odd": "3.0.1"
+            }
+          }
+          EOF
+        shell: bash
+
+      - uses: ./
+        with:
+          version: '11.1.0'
+          install: false
+
+      - name: 'Test: node_modules was not populated'
+        run: |
+          set -e
+          if [ -d node_modules/is-odd ]; then
+            echo "Expected install: false to skip pnpm install, but node_modules/is-odd exists"
+            exit 1
+          fi
+          # pnpm itself should still be on PATH.
+          which pnpm
+          pnpm --version
+        shell: bash
+
   no-runtime:
     # No runtime input, no devEngines.runtime. Action installs pnpm only and
     # leaves the runtime outputs empty. With no package.json, `pnpm install`

README.md

@@ -16,6 +16,7 @@ If your `package.json` declares `devEngines.runtime`, the action picks up the ru
 | `cache` | Cache the pnpm store directory. Default: `false`. |
 | `cache-dependency-path` | Path(s) to the pnpm lockfile, used to compute the cache key. Default: `pnpm-lock.yaml`. |
 | `package-json-file` | Path to `package.json` (relative to `GITHUB_WORKSPACE`). Default: `package.json`. |
+| `install` | Run `pnpm install` after setup. Default: `true`. Set to `false` for jobs that only need pnpm itself (e.g. `pnpm audit`, lockfile-only regeneration). |
 
 ## Outputs
 
@@ -90,12 +91,23 @@ jobs:
     cache: true
 ```
 
+### Skip `pnpm install`
+
+For jobs that only need pnpm itself — e.g. `pnpm audit`, lockfile-only regeneration — set `install: false`:
+
+```yaml
+- uses: pnpm/setup@v0
+  with:
+    install: false
+- run: pnpm audit
+```
+
 ## How it works
 
 1. The action installs `@pnpm/exe` (a Node.js-bundled standalone build of pnpm) into `dest`, then self-updates to the requested pnpm version.
 2. `PNPM_HOME` is exported and `$PNPM_HOME/bin` is added to `PATH`.
 3. The action runs `pnpm runtime set <name> <version> -g`, which downloads the requested runtime into `$PNPM_HOME/bin` — making `node`, `bun`, or `deno` available to later workflow steps.
-4. If a `package.json` exists in the workspace, the action runs `pnpm install`. When the `runtime` input is set, `--no-runtime` is appended so the just-installed runtime isn't shadowed by a different version declared in `devEngines.runtime`. This flag requires pnpm ≥ 11.1.0.
+4. If a `package.json` exists in the workspace, the action runs `pnpm install` (unless `install: false` is set). When the `runtime` input is set, `--no-runtime` is appended so the just-installed runtime isn't shadowed by a different version declared in `devEngines.runtime`. This flag requires pnpm ≥ 11.1.0.
 
 ## License
 

action.yml

@@ -38,6 +38,20 @@ inputs:
     description: File path to the package.json to read `packageManager` and `devEngines.runtime` configuration. This path must be relative to the repository root (GITHUB_WORKSPACE).
     required: false
     default: 'package.json'
+  install:
+    description: |
+      Whether to run `pnpm install` after pnpm and the runtime are set up.
+
+      When set to `true` (the default), the action runs `pnpm install` in the
+      workspace when a package.json is present. When the `runtime` input is
+      also set, `--no-runtime` is appended automatically so the installed
+      runtime isn't shadowed by a different version declared in
+      `devEngines.runtime`.
+
+      Set to `false` to skip the install step — useful for jobs that only
+      need pnpm itself (e.g. `pnpm audit`, lockfile-only regeneration).
+    required: false
+    default: 'true'
 outputs:
   dest:
     description: Expanded path of inputs#dest

dist/index.js

@@ -38,7 +38,9 @@ async function runMain() {
 
   await restoreCache(inputs)
 
-  pnpmInstall(inputs)
+  if (inputs.install) {
+    pnpmInstall(inputs)
+  }
 }
 
 async function runPost() {

src/index.ts

@@ -17,6 +17,7 @@ export interface Inputs {
   readonly cacheDependencyPath: string
   readonly packageJsonFile: string
   readonly runtime?: RuntimeInput
+  readonly install: boolean
 }
 
 const options: InputOptions = {
@@ -56,6 +57,7 @@ export const getInputs = (): Inputs => ({
   cacheDependencyPath: parseInputPath('cache-dependency-path'),
   packageJsonFile: parseInputPath('package-json-file'),
   runtime: parseRuntime(),
+  install: getBooleanInput('install'),
 })
 
 export default getInputs