feat(node): let a caller pin the pnpm version

A repo with no packageManager field got the newest pnpm through Corepack.
Several repos pin pnpm in their own workflows instead. Add a pnpm-version
input to node-pr and renovate-autoupdate and activate it with corepack.

.github/workflows/node-pr.yaml

@@ -21,6 +21,11 @@ on:
         required: false
         type: string
         default: "lint,typecheck,test,build"
+      pnpm-version:
+        description: "pnpm version to use, for a repo whose package.json has no packageManager field. Empty uses the packageManager field, or the newest pnpm."
+        required: false
+        type: string
+        default: ""
       require-tests:
         description: "Fail when package.json has no test script"
         required: false
@@ -119,6 +124,7 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
         env:
           PM: ${{ steps.detect.outputs.pm }}
+          PNPM_VERSION: ${{ inputs.pnpm-version }}
         run: |
           # Install without updating the lockfile, so a lockfile that does not match package.json fails.
           case "$PM" in
@@ -127,6 +133,9 @@ jobs:
               corepack enable "$PM"
               ;;
           esac
+          if [ "$PM" = pnpm ] && [ -n "$PNPM_VERSION" ]; then
+            corepack prepare "pnpm@$PNPM_VERSION" --activate
+          fi
           case "$PM" in
             pnpm) pnpm install --frozen-lockfile ;;
             yarn) yarn install --immutable ;;

.github/workflows/renovate-autoupdate.yaml

@@ -43,6 +43,11 @@ on:
         required: false
         type: string
         default: "lint,typecheck,test,build"
+      pnpm-version:
+        description: "pnpm version to use, for a repo whose package.json has no packageManager field. Empty uses the packageManager field, or the newest pnpm."
+        required: false
+        type: string
+        default: ""
       require-node-tests:
         description: "Fail when a Node project has no test script, so an untested update never merges"
         required: false
@@ -331,6 +336,7 @@ jobs:
         working-directory: ${{ inputs.node-working-directory }}
         env:
           PM: ${{ steps.detect.outputs.pm }}
+          PNPM_VERSION: ${{ inputs.pnpm-version }}
         run: |
           set -o pipefail
           {
@@ -341,6 +347,9 @@ jobs:
                 corepack enable "$PM"
                 ;;
             esac
+            if [ "$PM" = pnpm ] && [ -n "$PNPM_VERSION" ]; then
+              corepack prepare "pnpm@$PNPM_VERSION" --activate
+            fi
             case "$PM" in
               pnpm) pnpm install --frozen-lockfile ;;
               yarn) yarn install --immutable ;;

README.md

@@ -119,6 +119,7 @@ jobs:
 | `node-version` | `22` | Node.js version |
 | `working-directory` | `.` | Directory that holds `package.json` |
 | `scripts` | `lint,typecheck,test,build` | Scripts to run in order. A missing script is skipped. |
+| `pnpm-version` | | pnpm version for a repo with no `packageManager` field. Empty uses the field, or the newest pnpm. |
 | `require-tests` | `false` | Fail when there is no `test` script |
 | `lfs` | `false` | Git LFS checkout |
 | `runner` | | Runner label or runner group, as in the other workflows |
@@ -182,6 +183,7 @@ The workflow finds `go.mod` and `package.json` itself and tests what exists. A r
 | `node` | `true` | Update and test the Node project. Turn off for a repo with no frontend to test. |
 | `node-working-directory` | `.` | Directory that holds `package.json`. Only this project is updated and tested. |
 | `node-scripts` | `lint,typecheck,test,build` | Scripts to run in order. A missing script is skipped. |
+| `pnpm-version` | | pnpm version for a repo with no `packageManager` field. Empty uses the field, or the newest pnpm. |
 | `require-node-tests` | `true` | Fail when there is no `test` script, so an untested update never merges |
 | `major-updates` | `separate` | `separate`: each major gets its own branch, tested and merged on its own. `batch`: majors join the batch. `ignore`: skip majors. |
 | `minimum-release-age` | `2 days` | Skip releases younger than this |