fix(javascript-npm-packages): disable pnpm 10.33.0 package-manager self-switch

.github/workflows/javascript-npm-packages.yml

@@ -87,8 +87,12 @@ jobs:
             curl -fsSL "https://github.com/pnpm/pnpm/releases/download/v${PNPM_BOOTSTRAP_VERSION}/pnpm-linux-x64" -o "${pnpm_bin}"
             echo "${PNPM_BOOTSTRAP_SHA256}  ${pnpm_bin}" | sha256sum -c -
             chmod +x "${pnpm_bin}"
-            "${pnpm_bin}" --version
-            "${pnpm_bin}" publish --no-git-checks
+            # Disable pnpm's package-manager self-switch: when the standalone
+            # 10.33.0 binary reads `packageManager: pnpm@11.x` from
+            # package.json it tries `pnpm add @pnpm/exe@11.x` which fails
+            # against the single-file standalone (no `/snapshot/dist/pnpm.cjs`).
+            "${pnpm_bin}" --config.manage-package-manager-versions=false --version
+            "${pnpm_bin}" --config.manage-package-manager-versions=false publish --no-git-checks
           else
             echo "Publishing with OIDC Trusted Publisher + provenance"
             pnpm publish --provenance --no-git-checks

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v0.1.9 - 20/05/2026
+
+### Fixes
+- `javascript-npm-packages` — pass `--config.manage-package-manager-versions=false` to the pinned pnpm 10.33.0 binary so it does not attempt to self-switch to the consumer's `packageManager` pin. v0.1.8 successfully fetched and SHA-verified `pnpm-linux-x64@10.33.0`, but pnpm 10.33.0 read `packageManager: pnpm@11.x` from the package's `package.json` and tried `pnpm add @pnpm/exe@11.x`, which crashes against the single-file standalone binary (`/snapshot/dist/pnpm.cjs not found`). Disabling the self-switch keeps the pinned 10.33.0 running for the publish call only.
+
 ## v0.1.8 - 20/05/2026
 
 ### Fixes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coroboros/ci",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "private": true,
   "description": "Reusable GitHub Actions CI for the Coroboros stack.",
   "license": "SEE LICENSE IN LICENSE.md",