vp 0.3.2: pnpm 12.4.2 integrity check compares sha384-computed (?) hash against sha512 packageManager pin

[XrayIran]

Environment: setup-vp@v1.20.0, vp 0.3.2, ubuntu-latest runner, packageManager pin pnpm@12.4.2+sha512.CK3GYTGAJ1x8ntraOdzwjJxhrU5+rzMKTzRh8QKw+QdCNFTRF/mOctR/7wYWBwZE17/8lzpqV/UJCm18NosHyQ==.

Every job running vp install fails with:
error: Hash mismatch for pnpm@12.4.2: expected sha512.CK3GYTGAJ1x8ntraOdzwjJxhrU5+rzMKTzRh8QKw+QdCNFTRF/mOctR/7wYWBwZE17/8lzpqV/UJCm18NosHyQ==, got sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9

Observations:

• The expected hash matches the npm registry dist.integrity for pnpm 12.4.2 exactly (verified), and a locally downloaded tarball hashes to it.
• The 'got' value base64-decodes to 96 bytes (SHA-384 digest length), not 64 bytes (SHA-512). So the comparison looks like an algorithm mix-up (computed sha384 digest labeled sha512?) rather than a registry/tarball change.
• Started when the repo moved to pnpm 12.4.2 + vite-plus 0.3.2 + setup-vp v1.20.0 (previous combo pnpm 11.x + vp 0.3.0 + setup-vp v1.18.0 installed fine).
• Project: https://github.com/XrayIran/the-ai-studio/actions/runs/35150599162

Is this a known issue, and is there a recommended workaround (e.g. setup-vp package-manager input, VP_* override, or unpinned packageManager) until fixed?

[fengmk2]

I can’t open https://github.com/XrayIran/the-ai-studio. Is it a private repo? Could you provide a minimal reproduction repo so we can quickly investigate and pinpoint the issue?