NPM is not defined on the PATH when running using: "node"

[tiagoboeing]

This is a question about the expected behavior when using JavaScript Custom Actions.

I have a custom Action that runs using NodeJS and needs to install another CLI tool at the runtime, like azure-functions-core-tools, but looks like the NPM is not defined to PATH when using NodeJS runtime.

Custom Action using NodeJS runtime

runs:
  using: "node16"
  main: "dist/index.js"

Install call using @actions/exec

import { exec } from '@actions/exec'

await exec('npm install --location=global azure-functions-core-tools@4')

Received error:

Error: Unable to locate executable file: npm. Please verify either the file path exists or the file can be found within a directory specified by the PATH environment variable. Also check the file mode to verify the file is executable.

Is this correct for custom actions that run using NodeJS? The NodeJS should be automatically defined to PATH. (Or not?)

The workaround is to define a custom action to use using: composite and do a pure call to NodeJS (node ./dist/index.js) passing all inputs using env (INPUT_ABC: abc) and after install the Node through @actions/tool-cache, but this sounds stranger because I'm using a NodeJS custom actions to install NodeJS. 🤔

[gistrec]

This is expected for JavaScript actions

When you use:

runs:
  using: "node16"
  main: "dist/index.js"

the runner invokes the Node.js binary for the action, but it does not guarantee that npm is available on PATH. JavaScript actions are generally expected to be packaged/self-contained, with their dependencies bundled into dist/ at build time

For normal JS dependencies, the recommended approach is to install them during development/CI and bundle the action, for example with @vercel/ncc:

npm ci
npx @vercel/ncc build index.js -o dist

Then commit the generated dist/ file.

If your action really needs to install or call an external CLI at runtime, a composite action is probably a better fit, because you can explicitly prepare the environment first:

runs:
  using: "composite"
  steps:
    - uses: actions/setup-node@v4
      with:
        node-version: "20"

    - run: npm install --location=global azure-functions-core-tools@4
      shell: bash

    - run: node ./dist/index.js
      shell: bash

So in short: node being available for a JavaScript action does not imply that npm is also available on PATH. For JS package dependencies, bundle them; for runtime CLI installation, use a composite action or install the CLI in a separate workflow step