Repository navigation
get.pnpm.io/install.sh returns HTTP 403 from GitHub Actions Docker builds #16973
Description
Verify latest release
- I verified that the issue exists in the latest pnpm release
pnpm version
12.11.2 (packageManager in the image being built). The install script never finished, so the pnpm binary was not installed.
Which area(s) of pnpm are affected? (leave empty if unsure)
Operating System (Windows, MacOS, Linux)
Link to the code that reproduces this issue or a replay of the bug
N/A
Reproduction steps
From a GitHub Actions runner, the official installer URL returns HTTP 403. This happened while building a Docker image based on node:24.21.0-alpine3.24:
RUN apk add --no-cache curl openssl \
&& export PNPM_VERSION="12.11.2" \
&& touch /root/.shrc \
&& set -o pipefail \
&& curl -fsSL --retry 5 https://get.pnpm.io/install.sh | SHELL=/bin/sh ENV=/root/.shrc sh - \
&& pnpm --versioncurl -f exits 22:
curl: (22) The requested URL returned error: 403
The same URL returned HTTP 200 from outside GitHub Actions a few minutes later, so this looks like the installer host rejecting that runner rather than a missing script.
Describe the Bug
https://get.pnpm.io/install.sh responds with HTTP 403 when fetched with curl -fsSL during a GitHub Actions Docker build. curl --retry 5 does not help, and the image build fails before pnpm is installed.
Expected Behavior
https://get.pnpm.io/install.sh returns HTTP 200 and the install script, including from GitHub Actions runners.
Which Node.js version are you using?
24.21.0
Which operating systems have you used?
- macOS
- Windows
- Linux
If your OS is a Linux based, which one it is? (Include the version if relevant)
Alpine 3.24 (node:24.21.0-alpine3.24), built on a GitHub Actions runner.
Activity
github-actions commentedon Oct 16, 2026
@joshunger, are you planning to open a pull request for this? If so, reply here and a maintainer will assign the issue to you, so nobody else starts on the same fix.
lteyjolfur commentedon Oct 16, 2026
This looks like the hosting edge rather than pnpm or the script itself.
get.pnpm.io is served by Vercel, and the repo has no access rules. Nothing changed recently that would explain a 403. My best guess is that Vercel's edge mitigation challenged that runner's IP. GitHub-hosted runners share Azure IP ranges, so this tends to be intermittent and CI-only. Scripted clients like curl can't complete a challenge, so they get a plain 403. Also,
curl --retrynever retries a 403 (only timeouts, 408, 429 and 5xx), so--retry 5couldn't help here.To confirm, could you capture the response headers from a failing run?
If it's a Vercel challenge, you'll see
x-vercel-mitigated: challenge. Anx-vercel-idvalue would also help us find the request in the firewall log.Workarounds in the meantime:
On a
node:*image you already have npm, so you can skip the installer:Or download
install.shpinned to a commit from raw.githubusercontent.com, and check it againstSHASUMS256.txt(see the README).Note that
install.shonly contactsregistry.npmjs.orgonce it runs. get.pnpm.io is just the first download.For maintainers: the Vercel Firewall log around 11:2x UTC on 2026-10-16 should show whether this was a mitigation. If so, a bypass rule for
/,/install.shand/ps1would keep CI installs from being challenged.joshunger commentedon Oct 16, 2026
@lteyjolfur what do you recommend for CI?
lteyjolfur commentedon Oct 16, 2026
Since you’re building on a
node:*image, I’d use npm and pin the pnpm version:RUN npm install -g pnpm@12.11.2 && pnpm --versionThis bypasses
get.pnpm.io, so a 403 from the installer host won’t affect that step.The cause of the 403 is still unconfirmed; response headers from a failing run would help establish whether it’s a Vercel challenge.
zkochan commentedon Oct 16, 2026
We have not made any changes to the vercel configuration. So, I am not sure what is the problem. I see there was a spike of denials today at one point. 115 requests were denied. I'd rather not change any configuration as I might break more than fix.
You can try using this alternative URL if you want: https://cdn.jsdelivr.net/gh/pnpm/get.pnpm.io@main/install.sh
Alternatively, you may pick one of the alternative installation methods.
joshunger commentedon Oct 17, 2026
We saw a ton more 403s this morning. @zkochan what do you recommend for CI where a build can trigger several concurrent jobs that install pnpm at almost the same time? I can look at downloading pnpm once and sharing it using an artifact as well. Thanks.
zkochan commentedon Oct 17, 2026
I see that we currently recommend this installation method for CI. So, I guess we should have a solution for this or change the docs.
zkochan commentedon Oct 17, 2026
#17069 adds an Alpine variant of the official image (
ghcr.io/pnpm/pnpm:<version>-alpine,12-alpine,alpine). After it ships, an Alpine Dockerfile can get pnpm from ghcr.io instead of get.pnpm.io:Copy the whole
/opt/pnpmdirectory, not just the binary, because it also holds the bundled node-gyp.This covers Docker builds only. The 403s from get.pnpm.io itself still need a hosting fix, so this issue stays open for that.
Written by an agent (Claude Code, claude-opus-5-5).
ci: publish the installer scripts as release assets (#70)
feat(docker): publish an Alpine variant of the pnpm image (#17069)
zkochan commentedon Oct 17, 2026
No hosting fix needed. I have added a fallback URL to the docs via pr #17069
fix(setup): succeed when no shell config file can be found (#17079)
joshunger commentedon Oct 18, 2026
Thank you @zkochan
Update pnpm to v12.15.0 (#2046)
Update pnpm to v12.15.0 (#2046)