A GitHub Action that detects the Node.js package manager (npm, yarn, or pnpm) and version manager (nvm, nodenv, or n) used by a project, based on lockfiles and version files present in the repository.

Useful as a building block in reusable workflows that need to adapt to the package manager a project uses — for example, to decide which install command to run or which cache key to use with actions/setup-node.

• Detects npm, yarn, and pnpm from the presence of their lockfiles.
• Detects the Node.js version file used by nvm (.nvmrc), nodenv (.node-version), or n (.n-node-version).
• Returns the path to the lockfile, ready to be fed into the cache-dependency-path input of actions/setup-node.
• Fails the workflow if the detected manager is not in the allow list.

steps:
  - uses: actions/checkout@v4

  - name: Detect package manager
    id: detect
    uses: deividfortuna/[email protected]

  - uses: actions/setup-node@v4
    with:
      node-version-file: ${{ steps.detect.outputs.node-version-file }}
      cache: ${{ steps.detect.outputs.package-manager }}
      cache-dependency-path: ${{ steps.detect.outputs.lockfile }}

  - name: Install dependencies
    env:
      PACKAGE_MANAGER: ${{ steps.detect.outputs.package-manager }}
    run: $PACKAGE_MANAGER install

- uses: deividfortuna/[email protected]
  id: detect
  with:
    working-directory: ./packages/app

- uses: deividfortuna/[email protected]
  id: detect
  with:
    supported-package-managers: npm,pnpm
    supported-node-version-managers: nvm

If the detected package manager or Node.js version manager is not in the corresponding allow list, the action fails the workflow step.

The first match wins, checked in this order:

If no lockfile is found, the action fails.

If no version file is found, the action emits a warning and sets both node-version-manager and node-version-file outputs to empty strings.

• All dependencies pinned to exact versions. No ^ or ~ ranges in package.json — every direct dependency resolves to a single, known version.
• No floating tags. Versions are pinned literals, not moving targets, so builds are reproducible and a new upstream release cannot silently enter the dependency tree.
• Dependabot cooldown. Updates are held for 5 days after a release before a PR is opened (see .github/dependabot.yml), giving the ecosystem time to surface compromised or broken releases before they land here.
• Signed commits required. All commits to main must carry a verified signature, so every change in the history is attributable to a known author.

MIT