Update dependencies and add pnpm workspace configuration (#279 )

chore(deps): bump the gh-actions group with 3 updates (#276 )
chore(deps): bump the gh-actions group with 3 updates (#273 )
2026-10-08 15:04:08 +03:00 · 2026-08-05 17:52:08 +02:00 · 2026-08-01 08:31:09 +02:00 · 2026-07-02 17:56:44 +02:00 · 2026-07-01 18:06:30 +02:00 · 2026-06-29 16:31:17 +02:00
18 changed files with 71595 additions and 76333 deletions
@@ -1 +1,2 @@
 dist/** merge=binary -diff linguist-generated=true
+pnpm-lock.yaml merge=binary linguist-generated=true
@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json
+issuer: https://token.actions.githubusercontent.com
+subject: repo:prefix-dev/setup-pixi:ref:refs/heads/main
+
+permissions:
+  contents: write
+  pull_requests: write
@@ -8,6 +8,8 @@ updates:
      gh-actions:
        patterns:
          - '*'
+    cooldown:
+      default-days: 7
  - package-ecosystem: npm
    directory: /
    schedule:
@@ -16,3 +18,5 @@ updates:
      nodejs:
        patterns:
          - '*'
+    cooldown:
+      default-days: 7
@@ -15,15 +15,15 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
-          version: 9
+          version: 10

      - name: Install Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -41,13 +41,13 @@ jobs:
    name: Reference latest version in README
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Assert latest setup-pixi version is mentioned in README
        run: |
          set -euo pipefail
          latest_version="$(jq -r '.version' package.json)"
-          count_expected=23
+          count_expected=24
          count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
          if [ "$count_actual" -ne "$count_expected" ]; then
            echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
@@ -59,10 +59,10 @@ jobs:
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
-      contents: write
-      pull-requests: write
+      contents: read
+      id-token: write
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Assert latest pixi version is mentioned in README
        run: |
@@ -78,11 +78,17 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          identity: write
+
      - name: Create pull request
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        if: failure() && github.ref_name == 'main'
        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
          commit-message: Reference latest Pixi version in README
          title: Reference latest Pixi version in README
          labels: ignore for release
@@ -90,15 +96,15 @@ jobs:
  check-dist:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
-          version: 9
+          version: 10

      - name: Install Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -119,7 +125,7 @@ jobs:
        id: diff

      # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
        with:
          name: dist
@@ -12,8 +12,8 @@ jobs:
  release:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: Quantco/ui-actions/version-metadata@cd71d2a0e30b25569f6d723e57acca83347e58fc # v1.0.18
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: Quantco/ui-actions/version-metadata@5bfb8cebf0801e07c6a1c208a35b41637a3ff7fa # v1.0.20
        id: version-metadata
        with:
          file: ./package.json
@@ -24,7 +24,7 @@ jobs:
          TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
      - name: Create release
        if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          generate_release_notes: true
          tag_name: v${{ steps.version-metadata.outputs.newVersion }}
@@ -22,7 +22,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    name: default ${{ matrix.cache == true && 'with' || 'without' }} cache (${{ matrix.os }})
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -53,7 +53,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -78,7 +78,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -102,7 +102,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -119,7 +119,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -134,7 +134,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -152,7 +152,7 @@ jobs:
        locked: [true, false]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -171,7 +171,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -184,7 +184,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -203,7 +203,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -218,7 +218,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -230,7 +230,7 @@ jobs:
  custom-pixi-url:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -242,7 +242,7 @@ jobs:
  pixi-url-headers-bearer:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - name: Setup caddy
@@ -283,7 +283,7 @@ jobs:
  pixi-url-custom-template-no-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          pixi-url: |
@@ -298,7 +298,7 @@ jobs:
  pixi-url-custom-template-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          pixi-url: |
@@ -314,7 +314,7 @@ jobs:
  pixi-url-custom-template-version-latest:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          pixi-url: |
@@ -333,7 +333,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -363,7 +363,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -392,7 +392,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -421,7 +421,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -433,7 +433,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -447,7 +447,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -468,7 +468,7 @@ jobs:
        ignore-reason: [none, version, version-latest, url, bin-path]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - name: Create pixi directory and add to PATH
@@ -587,7 +587,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -608,7 +608,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -631,7 +631,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -646,6 +646,52 @@ jobs:
        # https://github.com/prefix-dev/pixi/issues/330
        if: matrix.os == 'ubuntu-latest'

+  persist-credentials-false:
+    env:
+      # We must set this environment variable explicitly to force all
+      # operating systems to use the same storage mechanism.
+      # Otherwise, windows and mac will use the keychain, which is more cumbersome to test.
+      RATTLER_AUTH_FILE: .rattler-credentials.json
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      # Sanity check: Login with default persist-credentials behavior
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+      - name: Assert that the credentials are stored
+        run: |
+          # For human log readers
+          cat "${RATTLER_AUTH_FILE}"
+          # Actual test
+          [ $(jq '."*.custom-conda-registry.com".BearerToken' -r "${RATTLER_AUTH_FILE}") = "custom-token" ]
+      - name: Clean up credentials file
+        run: rm "${RATTLER_AUTH_FILE}"
+      # Actual test: Login with persist-credentials: false
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+          persist-credentials: false
+      - name: Assert that the credentials are not stored anymore
+        run: |
+          # For human log readers
+          cat "${RATTLER_AUTH_FILE}"
+
+          # Actual test
+          ! grep -q '"*.custom-conda-registry.com"' "${RATTLER_AUTH_FILE}"
+
  auth-token-install:
    strategy:
      matrix:
@@ -653,7 +699,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/auth/* .
      - uses: ./
@@ -672,7 +718,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/auth-s3/* .
      - uses: ./
@@ -692,7 +738,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -719,7 +765,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -741,7 +787,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -766,7 +812,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -788,7 +834,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -809,7 +855,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -830,7 +876,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -862,7 +908,7 @@ jobs:
        cache: ['true', 'false']
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -898,7 +944,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -914,7 +960,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -939,7 +985,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -963,7 +1009,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -980,7 +1026,7 @@ jobs:
        os: [windows-latest, ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/pyproject-manifest/* .
      - uses: ./
@@ -998,7 +1044,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: true
@@ -1010,7 +1056,7 @@ jobs:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1026,7 +1072,7 @@ jobs:
      run:
        shell: bash
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1042,7 +1088,7 @@ jobs:
      run:
        shell: pwsh
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1058,7 +1104,7 @@ jobs:
      run:
        shell: cmd
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1076,7 +1122,7 @@ jobs:
  environment-activation-false:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1087,7 +1133,7 @@ jobs:
  environment-activation-explicit-env:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -1100,7 +1146,7 @@ jobs:
  environment-activation-multiple-env:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -1117,7 +1163,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -1135,7 +1181,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1153,7 +1199,7 @@ jobs:
  env-variable-input-custom-pixi-url:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -1166,7 +1212,7 @@ jobs:
  env-variable-input-precendence:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -1184,7 +1230,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1206,7 +1252,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -1227,7 +1273,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -1250,7 +1296,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1271,7 +1317,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1292,7 +1338,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/lockfile-not-up-to-date/* .
      - uses: ./
@@ -1313,7 +1359,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -23,9 +23,9 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
-    pixi-version: v0.62.2
+    pixi-version: v0.66.0

    cache: true
    auth-host: prefix.dev
@@ -35,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m

 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.9.4`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.10.1`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -51,6 +51,8 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 >       dependencies:
 >         patterns:
 >           - '*'
+>     cooldown:
+>       default-days: 7
 > ```

 ## Features
@@ -77,7 +79,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    cache: true
    cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -122,7 +124,7 @@ test:
      environment: [py311, py312]
  steps:
    - uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.9.4
+    - uses: prefix-dev/setup-pixi@v0.10.1
      with:
        environments: ${{ matrix.environment }}
 ```
@@ -132,7 +134,7 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    # separated by spaces
    environments: >-
@@ -155,7 +157,7 @@ For instance, the `keyring`, or `gcloud` executables. The following example show
 By default, global environments are not cached. You can enable caching by setting the `global-cache` input to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    global-environments: |
      google-cloud-sdk
@@ -188,7 +190,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    auth-host: prefix.dev
    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -200,7 +202,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    auth-host: custom-artifactory.com
    auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -213,7 +215,7 @@ Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    auth-host: anaconda.org # or my-quetz-instance.com
    auth-conda-token: ${{ secrets.CONDA_TOKEN }}
@@ -225,7 +227,7 @@ Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-k
 You can also specify the session token using the `auth-session-token` input argument.

 ```yaml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    auth-host: s3://my-s3-bucket
    auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
@@ -236,12 +238,27 @@ You can also specify the session token using the `auth-session-token` input argu

 See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.

+#### Restricting credentials to the install step
+
+If you only want pixi to use the authenticated remote channel during the action's own install step
+(and not in any subsequent step of the workflow), set `persist-credentials: false`. The action will
+then run `pixi auth logout <auth-host>` after `pixi install` has completed but before the action
+returns, so that later steps cannot reach the private channel anymore.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.10.1
+  with:
+    auth-host: prefix.dev
+    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
+    persist-credentials: false
+```
+
 #### PyPI keyring provider

 You can specify whether to use keyring to look up credentials for PyPI.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    pypi-keyring-provider: subprocess # one of 'subprocess', 'disabled'
 ```
@@ -309,7 +326,7 @@ To this end, `setup-pixi` adds all environment variables set when executing `pix
 As a result, all installed binaries can be accessed without having to call `pixi run`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    activate-environment: true
 ```
@@ -317,7 +334,7 @@ As a result, all installed binaries can be accessed without having to call `pixi
 If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    environments: >-
      py311
@@ -334,7 +351,7 @@ You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi
 See the [official documentation](https://pixi.sh/latest/reference/cli/pixi/install/#update-options) for more information about the `--frozen` and `--locked` flags.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    locked: true
    # or
@@ -353,7 +370,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  env:
    RUNNER_DEBUG: true
 ```
@@ -371,7 +388,7 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    # one of `q`, `default`, `v`, `vv`, or `vvv`.
    log-level: vvv
@@ -392,12 +409,12 @@ If you set `post-cleanup` to `true`, the action will delete the following files:
 - the rattler cache
 - other rattler files in `~/.rattler`

-If nothing is specified, `post-cleanup` will default to `true`.
+If nothing is specified, `post-cleanup` will default to `false`.

 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    post-cleanup: true
    # ${{ runner.temp }}\Scripts\pixi.exe on Windows
@@ -413,7 +430,7 @@ You can also use a preinstalled local version of pixi on the runner by not setti
 This can be overwritten by setting the `manifest-path` input argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    manifest-path: pyproject.toml
 ```
@@ -423,7 +440,7 @@ This can be overwritten by setting the `manifest-path` input argument.
 If you're working with a monorepo where your pixi project is in a subdirectory, you can use the `working-directory` input to specify where pixi should look for manifest files (`pixi.toml` or `pyproject.toml`).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    working-directory: ./packages/my-project
 ```
@@ -442,7 +459,7 @@ This will make pixi look for `pixi.toml` or `pyproject.toml` in the `./packages/
 You can combine `working-directory` with `manifest-path` if needed:

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    working-directory: ./packages/my-project
    manifest-path: custom-pixi.toml
@@ -453,7 +470,7 @@ You can combine `working-directory` with `manifest-path` if needed:
 If you only want to install pixi and not install the current project, you can use the `run-install` option.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    run-install: false
 ```
@@ -464,7 +481,7 @@ You can also download pixi from a custom URL by setting the `pixi-url` input arg
 Optionally, you can combine this with the `pixi-url-headers` input argument to supply additional headers for the download request, such as a bearer token.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    pixi-url: https://pixi-mirror.example.com/releases/download/v0.48.0/pixi-x86_64-unknown-linux-musl
    pixi-url-headers: '{"Authorization": "Bearer ${{ secrets.PIXI_MIRROR_BEARER_TOKEN }}"}'
@@ -480,7 +497,7 @@ It will be rendered with the following variables:
 By default, `pixi-url` is equivalent to the following template:

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.10.1
  with:
    pixi-url: |
      {{#if latest~}}
@@ -63,7 +63,7 @@ inputs:
    description: |
      Host to use for authentication. If not set, pixi is not authenticating.
      Requires `auth-token` or `auth-conda-token` or `auth-username` and `auth-password` to be set.
-      See https://prefix.dev/docs/pixi/authentication
+      See https://pixi.prefix.dev/latest/deployment/authentication/
  auth-token:
    description: Token to use for authentication.
  auth-username:
@@ -78,13 +78,19 @@ inputs:
    description: Secret access key to use for S3 authentication.
  auth-s3-session-token:
    description: Session token to use for S3 authentication.
+  persist-credentials:
+    description: |
+      Whether to keep the credentials configured by `auth-host` available to subsequent workflow
+      steps. Defaults to `true`. If set to `false`, the action runs `pixi auth logout <auth-host>`
+      after install, so that later steps cannot reach the private channel anymore. Requires
+      `auth-host`.
  pypi-keyring-provider:
    description: |
      Specifies whether to use keyring to look up credentials for PyPI.
      options: disabled, subprocess
  post-cleanup:
    description: |
-      If the action should clean up after itself. Defaults to `true`.
+      If the action should clean up after itself. Defaults to `false`.
      If `true`, the pixi environment, the pixi binary and the rattler files in ~/.rattler and ~/.cache/rattler are removed.

 runs:
@@ -1,6 +1,6 @@
 {
  "name": "setup-pixi",
-  "version": "0.9.4",
+  "version": "0.10.1",
  "private": true,
  "description": "Action to set up the pixi package manager.",
  "scripts": {
@@ -22,25 +22,25 @@
  "author": "Pavel Zwerschke <pavelzw@gmail.com>",
  "license": "BSD-3-Clause",
  "dependencies": {
-    "@actions/cache": "^5.0.1",
-    "@actions/core": "^2.0.1",
-    "@actions/exec": "^2.0.0",
-    "@actions/io": "^2.0.0",
-    "@actions/tool-cache": "^2.0.2",
-    "handlebars": "^4.7.8",
-    "smol-toml": "^1.6.0",
+    "@actions/cache": "^6.2.0",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/io": "^3.0.2",
+    "@actions/tool-cache": "^4.0.0",
+    "handlebars": "^4.7.9",
+    "smol-toml": "^1.7.1",
    "untildify": "^6.0.0",
-    "which": "^6.0.0",
-    "zod": "^4.3.4"
+    "which": "^7.0.0",
+    "zod": "^4.4.3"
  },
  "devDependencies": {
-    "@eslint/js": "^9.39.2",
-    "@types/node": "^25.0.3",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^26.1.2",
    "@types/which": "^3.0.4",
-    "eslint": "^9.39.2",
-    "prettier": "^3.7.4",
+    "eslint": "^10.8.0",
+    "prettier": "^3.9.6",
    "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.51.0"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.66.0"
  }
 }
@@ -0,0 +1,9 @@
+allowBuilds:
+  esbuild: true
+
+overrides:
+  undici: ^6.28.0
+  rollup: ^4.59.0
+  fast-xml-parser: ^5.10.1
+  minimatch@3>brace-expansion: ^1.1.18
+  minimatch@10>brace-expansion: ^5.0.9
@@ -39,8 +39,7 @@ export const generateProjectCacheKey = async (cacheKeyPrefix: string) => {
    core.debug(`sha: ${sha}`)
    return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
  } catch (err: unknown) {
-    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-    throw new Error(`Failed to generate cache key: ${err}`)
+    throw new Error(`Failed to generate cache key`, { cause: err })
  }
 }

@@ -54,8 +53,7 @@ export const generateGlobalCacheKey = async (cacheKeyPrefix: string) => {
    core.debug(`sha: ${sha}`)
    return `${cacheKeyPrefix}${getCondaArch()}-${getYearMonth()}-${sha}`
  } catch (err: unknown) {
-    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-    throw new Error(`Failed to generate cache key: ${err}`)
+    throw new Error(`Failed to generate cache key`, { cause: err })
  }
 }

@@ -51,6 +51,18 @@ const pixiLogin = async () => {
  })
 }

+const pixiLogout = async () => {
+  const auth = options.auth
+  if (!auth || auth.persistCredentials) {
+    core.debug('Skipping pixi logout.')
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
+  })
+}
+
 const addPixiToPath = () => {
  core.addPath(path.dirname(options.pixiBinPath))
 }
@@ -163,6 +175,7 @@ const run = async () => {
  if (options.activatedEnvironment) {
    await activateEnv(options.activatedEnvironment)
  }
+  await pixiLogout()
 }

 const main = async () => {
@@ -35,6 +35,7 @@ type Inputs = Readonly<{
  authS3AccessKeyId?: string
  authS3SecretAccessKey?: string
  authS3SessionToken?: string
+  persistCredentials?: boolean
  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup?: boolean
  globalEnvironments?: string[]
@@ -48,6 +49,7 @@ export interface PixiSource {

 type Auth = {
  host: string
+  persistCredentials: boolean
 } & (
  | {
      token: string
@@ -91,6 +93,7 @@ export type Options = Readonly<{
  globalCache?: GlobalCache
  pixiBinPath: string
  auth?: Auth
+  persistCredentials: boolean
  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup: boolean
  activatedEnvironment?: string
@@ -240,6 +243,9 @@ const validateInputs = (inputs: Inputs): void => {
    if (inputs.authToken || inputs.authUsername || inputs.authCondaToken || inputs.authS3AccessKeyId) {
      throw new Error('You need to specify auth-host')
    }
+    if (inputs.persistCredentials === false) {
+      throw new Error('Cannot use persist-credentials without specifying auth-host')
+    }
  }
  if (inputs.runInstall === false && inputs.environments) {
    throw new Error('Cannot specify environments without running install')
@@ -355,31 +361,36 @@ const inferOptions = (inputs: Inputs): Options => {
      : undefined
  const frozen = inputs.frozen ?? false
  const locked = inputs.locked ?? (lockFileAvailable && !frozen)
+  const persistCredentials = inputs.persistCredentials ?? true
  const auth = !inputs.authHost
    ? undefined
    : ((inputs.authToken
        ? {
            host: inputs.authHost,
-            token: inputs.authToken
+            token: inputs.authToken,
+            persistCredentials: persistCredentials
          }
        : inputs.authCondaToken
          ? {
              host: inputs.authHost,
-              condaToken: inputs.authCondaToken
+              condaToken: inputs.authCondaToken,
+              persistCredentials: persistCredentials
            }
          : inputs.authUsername
            ? {
                host: inputs.authHost,
                username: inputs.authUsername,
-                password: inputs.authPassword
+                password: inputs.authPassword,
+                persistCredentials: persistCredentials
              }
            : {
                host: inputs.authHost,
                s3AccessKeyId: inputs.authS3AccessKeyId,
                s3SecretAccessKey: inputs.authS3SecretAccessKey,
-                s3SessionToken: inputs.authS3SessionToken
+                s3SessionToken: inputs.authS3SessionToken,
+                persistCredentials: persistCredentials
              }) as Auth)
-  const postCleanup = inputs.postCleanup ?? true
+  const postCleanup = inputs.postCleanup ?? false
  const pypiKeyringProvider = inputs.pypiKeyringProvider
  return {
    globalEnvironments: inputs.globalEnvironments,
@@ -399,6 +410,7 @@ const inferOptions = (inputs: Inputs): Options => {
    globalCache,
    pixiBinPath,
    auth,
+    persistCredentials,
    postCleanup
  }
 }
@@ -447,6 +459,7 @@ const getOptions = () => {
    authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
    authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
    authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
+    persistCredentials: parseOrUndefinedJSON('persist-credentials', z.boolean()),
    pypiKeyringProvider: parseOrUndefined('pypi-keyring-provider', pypiKeyringProviderSchema),
    globalEnvironments: parseOrUndefinedMultilineList('global-environments', z.string()),
    postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
@@ -477,3 +490,10 @@ try {
 }

 export const options = _options
+export const assertAuth = () => {
+  const auth = options.auth
+  if (!auth) {
+    throw new Error('Authentication configuration is missing.')
+  }
+  return auth
+}
@@ -1,12 +1,14 @@
 {
  "compilerOptions": {
-    "target": "ES2020" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
    "module": "CommonJS" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
    "outDir": "./lib" /* Redirect output structure to the directory. */,
    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
    "strict": true /* Enable all strict type-checking options. */,
    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
-    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
+    "types": ["node"],
+    "skipLibCheck": true
  },
  "exclude": ["node_modules", "**/*.test.ts"]
 }
@@ -12,6 +12,8 @@ export default defineConfig({
  sourcemap: false,
  platform: 'node',
  minify: false,
+  // shim `import.meta.url` in CJS output; some deps (e.g. @azure/storage-common) rely on it
+  shims: true,
  outExtension() {
    return {
      js: '.js'
Author	SHA1	Message	Date
Wolf Vollprecht	f00437f565	Update dependencies and add pnpm workspace configuration (#279 )	2026-08-05 17:52:08 +02:00
dependabot[bot]	d0c199d447	chore(deps): bump the gh-actions group with 3 updates (#276 )	2026-08-01 08:31:09 +02:00
dependabot[bot]andPavel Zwerschke	2253d9c931	chore(deps): bump the gh-actions group with 3 updates (#273 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-07-02 17:56:44 +02:00
dependabot[bot]andPavel Zwerschke	c5359a316e	chore(deps): bump the nodejs group with 6 updates (#274 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-07-01 18:06:30 +02:00
Hofer-Julian	a09b624715	feat: change post-cleanup default to false (#272 )	2026-06-29 16:31:17 +02:00
dependabot[bot]andPavel Zwerschke	947fc1f2cc	chore(deps): bump the nodejs group with 6 updates (#269 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-06-01 14:42:15 +02:00
dependabot[bot]	36c1c8cc24	chore(deps): bump the gh-actions group with 2 updates (#268 ) Signed-off-by: dependabot[bot] <support@github.com>	2026-06-01 14:24:05 +02:00
Andreas AlbertandPavel Zwerschke	5185adfbff	feat: Add `persist-credentials` option (#266 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2026-05-21 13:13:17 +02:00
dependabot[bot]andPavel Zwerschke	92596c33b0	chore(deps): bump the nodejs group with 6 updates (#264 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-05-21 13:04:19 +02:00
dependabot[bot]	68a459aa8a	chore(deps): bump the gh-actions group with 5 updates (#263 ) Signed-off-by: dependabot[bot] <support@github.com>	2026-05-21 12:54:08 +02:00
Pavel Zwerschke	8ce63489f8	add octo-sts (#262 )	2026-04-24 09:08:08 +02:00
github-actions[bot]	b92f01076d	Reference latest Pixi version in README (#260 )	2026-04-01 06:06:51 +00:00
dependabot[bot]	46d4c99b05	chore(deps): bump the gh-actions group with 4 updates (#261 )	2026-04-01 07:57:58 +02:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Pavel Zwerschke	1b2de7f335	chore(deps): bump dependencies (#259 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2026-03-31 11:00:43 +02:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Ruben Arts	6ef69835bb	chore(deps): bump the nodejs group with 10 dependencies (#257 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ruben Arts <ruben.arts@hotmail.com>	2026-03-30 14:23:16 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	e6477eb81d	chore(deps): bump Quantco/ui-actions from 1.0.18 to 1.0.19 in the gh-actions group (#256 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-30 13:50:53 +02:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Pavel Zwerschke	33be5bafa6	chore(deps): bump the nodejs group with 7 updates (#250 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2026-02-01 19:18:18 +01:00
dependabot[bot]	72f90fea0c	chore(deps): bump the gh-actions group across 1 directory with 3 updates (#253 )	2026-02-01 11:36:06 +01:00
Copilot	c0d7209ec3	Fix broken authentication documentation link (#252 )	2026-01-29 13:38:47 +00:00
Pavel Zwerschke	f1fb10f03b	docs: Mention cooldown in dependabot config (#247 )	2026-01-28 11:15:30 +01:00