GitHub Actions

A collection of reusable GitHub Actions for SF Studios.

install-node-modules

Installs Node.js dependencies with automatic package manager detection and caching.

Supports: npm, yarn, pnpm, and bun.

How it works

1. Optionally checks out the repository (if branch is provided)
2. Auto-detects the package manager from the lock file:
   • bun.lockb or bun.lock → bun
   • yarn.lock → yarn
   • pnpm-lock.yaml → pnpm
   • package-lock.json → npm
3. Resolves the node and bun version files (see below)
4. Sets up the runtime (actions/setup-node, pnpm/setup, and/or oven-sh/setup-bun) with built-in caching and @sfstudios registry auth
5. Runs the appropriate install command (npm ci, yarn install --frozen-lockfile, pnpm install --frozen-lockfile, or bun install --frozen-lockfile)

Tool versions

Resolved in order, first match wins:

• node: node-version-file input, mise.toml, .mise.toml, .config/mise/config.toml, .tool-versions, .nvmrc
• bun: bun-version-file input, .tool-versions, .bun-version

.tool-versions counts only if it pins that tool; Mise config takes precedence. mise.toml is node-only, since setup-bun cannot read it. A bun project with no bun version file fails rather than installing latest.

pnpm projects must pin pnpm 11 or newer with packageManager or devEngines.packageManager in package.json.

Inputs

Input	Required	Default	Description
NPM_TOKEN	yes	—	Token for private GitHub Packages registry
branch	no	""	Git ref to checkout. Leave empty to skip checkout.
package-manager	no	"auto"	Force npm, yarn, pnpm, bun, or auto (detect from lock file)
node-version-file	no	""	File to read Node.js version from. Empty to auto-detect.
bun-version-file	no	""	File to read Bun version from. Empty to auto-detect.

Usage

Auto-detect (recommended)

The action detects the package manager from the lock file in your repository:

- uses: sfstudios/actions/install-node-modules@master
  with:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    branch: ${{ github.ref }}

Without checkout

If you handle checkout yourself, omit branch:

- uses: actions/checkout@v6

- uses: sfstudios/actions/install-node-modules@master
  with:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Force a specific package manager

- uses: sfstudios/actions/install-node-modules@master
  with:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    branch: ${{ github.ref }}
    package-manager: bun

npm-install-node-modules (legacy wrapper)

Backwards-compatible wrapper that calls install-node-modules with package-manager: npm.

Existing workflows using this action will continue to work without changes.

- uses: sfstudios/actions/npm-install-node-modules@master
  with:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    branch: ${{ github.ref }}

Migration from previous versions

If you were using the old install-node-modules action with yarn, no changes are needed — the action auto-detects yarn.lock and behaves the same way.

If you were using npm-install-node-modules, no changes are needed — the wrapper forwards to the unified action.

What changed

• Caching is now handled by actions/setup-node built-in cache (global package cache instead of node_modules)
• Registry auth is handled by actions/setup-node built-in registry-url + NODE_AUTH_TOKEN (no more manual .npmrc manipulation)
• All action dependencies updated to latest versions (checkout@v7, setup-node@v7, pnpm/setup@v2, setup-bun@v2)
• Bun support added via oven-sh/setup-bun@v2