v6 regression: dest input breaks when path contains a space (Windows) #261

Summary

Since v6, the action fails when the dest input (or its default location) resolves to a path containing a space on Windows. This worked correctly on v5.

Error output

(node:9744) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)

added 1 package, and audited 2 packages in 21s

1 package is looking for funding
  run `npm fund` for details

found 0 vulnerabilities
'C:\GitHub' is not recognized as an internal or external command,
operable program or batch file.
Error: Something went wrong, self-installer exits with code 1

The 'C:\GitHub' is not recognized... line is the giveaway: the path (something like C:\GitHub Actions\...) is being split on the space and cmd.exe is trying to execute C:\GitHub as a command. The accompanying DEP0190 warning points at the same root cause — args being concatenated into a shell command line without escaping.

Likely cause

In src/install-pnpm/run.ts, runCommand is invoked with shell: process.platform === 'win32'. On Windows that routes the command through cmd.exe, and any argument or path containing a space is not quoted, so it gets word-split by the shell.

This behavior was introduced in v6.0.0 — the v5.x implementation spawned process.execPath directly without a shell, so paths with spaces were never an issue.

v6.0.4 (#239) made it worse by also prepending path.dirname(process.execPath) to PATH, which on Windows is common C:\Program Files\nodejs — another unquoted space.

Reproduction

Use pnpm/action-setup@v6 on a Windows runner whose workspace / dest resolves to a path containing a space (e.g. a self-hosted runner installed under C:\GitHub Actions\...). The self-installer exits with code 1 as shown above. Downgrading to pnpm/action-setup@v5 works.

Expected behavior

dest, and any path the action derives internally, should support spaces — as it did in v5.

Suggested fix

Drop shell: true and invoke the binaries directly (resolving npm.cmd explicitly on Windows), or properly quote every argument and any PATH entries before they reach the shell.