feat!: Add auth-logout input and run pixi auth status after login (#291 )

chore: bump typescript to v7 and migrate to oxlint and oxfmt (#289 )
chore(deps): bump the nodejs group across 1 directory with 7 updates (#288 )
2026-10-08 15:04:08 +03:00 · 2026-10-06 18:15:30 +02:00 · 2026-10-01 12:31:45 +02:00 · 2026-10-01 11:46:57 +02:00 · 2026-10-01 11:22:52 +02:00 · 2026-09-15 17:24:57 +02:00
23 changed files with 10197 additions and 5380 deletions
@@ -18,7 +18,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10

@@ -35,7 +35,10 @@ jobs:
        run: pnpm build

      - name: Lint
-        run: pnpm lint
+        run: pnpm lint:check
+
+      - name: Format
+        run: pnpm fmt:check

  reference-latest-version-in-readme:
    name: Reference latest version in README
@@ -99,7 +102,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10

@@ -24,7 +24,7 @@ jobs:
          TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
      - name: Create release
        if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          generate_release_notes: true
          tag_name: v${{ steps.version-metadata.outputs.newVersion }}
@@ -16,8 +16,13 @@ jobs:
  default:
    strategy:
      matrix:
-        # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+          - ubuntu-24.04-riscv
+          - macos-latest
+          - windows-latest
+          - windows-11-arm
        cache: [true, false]
    runs-on: ${{ matrix.os }}
    name: default ${{ matrix.cache == true && 'with' || 'without' }} cache (${{ matrix.os }})
@@ -33,18 +38,18 @@ jobs:
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/bin/python
-          ./.pixi/envs/default/bin/python --version | grep -q 3.11
+          ./.pixi/envs/default/bin/python --version | grep -q 3.14
        shell: bash
-        if: matrix.os != 'windows-latest'
+        if: "!startsWith(matrix.os, 'windows')"
      - run: |
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/python.exe
-          ./.pixi/envs/default/python.exe --version | grep -q 3.11
+          ./.pixi/envs/default/python.exe --version | grep -q 3.14
        shell: bash
-        if: matrix.os == 'windows-latest'
+        if: startsWith(matrix.os, 'windows')
      - run: |
-          pixi run python --version | grep -q 3.11
+          pixi run python --version | grep -q 3.14
          pixi run test | grep -q "Hello world"

  global-environments:
@@ -66,10 +71,10 @@ jobs:
          set -o pipefail
          pixi info
          test -f ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }}
-          ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }} --version | grep -q 3.11
+          ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }} --version | grep -q 3.14
        shell: bash
      - run: |
-          pixi run python --version | grep -q 3.11
+          pixi run python --version | grep -q 3.14
          pixi run test | grep -q "Hello world"

  global-environments-with-project-install:
@@ -210,7 +215,7 @@ jobs:
        with:
          cache: false
          frozen: true
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14

  locked:
    strategy:
@@ -225,7 +230,7 @@ jobs:
        with:
          cache: false
          locked: true
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14

  custom-pixi-url:
    runs-on: ubuntu-latest
@@ -342,7 +347,7 @@ jobs:
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/bin/python
-          .pixi/envs/default/bin/python --version | grep -q 3.11
+          .pixi/envs/default/bin/python --version | grep -q 3.14
        shell: bash
        working-directory: test/default
        if: matrix.os != 'windows-latest'
@@ -350,11 +355,11 @@ jobs:
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/python.exe
-          .pixi/envs/default/python.exe --version | grep -q 3.11
+          .pixi/envs/default/python.exe --version | grep -q 3.14
        shell: bash
        working-directory: test/default
        if: matrix.os == 'windows-latest'
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14
        working-directory: test/default

  working-directory-with-manifest-path:
@@ -383,7 +388,7 @@ jobs:
        shell: bash
        working-directory: test/default
        if: matrix.os == 'windows-latest'
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14
        working-directory: test/default

  working-directory-with-absolute-manifest-path:
@@ -412,7 +417,7 @@ jobs:
        shell: bash
        working-directory: test/default
        if: matrix.os == 'windows-latest'
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14
        working-directory: test/default

  custom-manifest-path:
@@ -485,18 +490,18 @@ jobs:
      - name: Download pixi binary (Ubuntu)
        run: |
          set -o pipefail
-          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.43.0/pixi-x86_64-unknown-linux-musl
+          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.79.0/pixi-x86_64-unknown-linux-musl
          chmod +x "$HOME/custom existing pixi/pixi"
        if: matrix.os == 'ubuntu-latest'
      - name: Download pixi binary (macOS)
        run: |
          set -o pipefail
-          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.43.0/pixi-x86_64-apple-darwin
+          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.79.0/pixi-x86_64-apple-darwin
          chmod +x "$HOME/custom existing pixi/pixi"
        if: matrix.os == 'macos-latest'
      - name: Download pixi binary (Windows)
        run: |
-          curl -L --output "$HOME/custom existing pixi/pixi.exe" https://github.com/prefix-dev/pixi/releases/download/v0.43.0/pixi-x86_64-pc-windows-msvc.exe
+          curl -L --output "$HOME/custom existing pixi/pixi.exe" https://github.com/prefix-dev/pixi/releases/download/v0.79.0/pixi-x86_64-pc-windows-msvc.exe
        if: matrix.os == 'windows-latest'
      - run: |
          echo "Path: $PATH"
@@ -504,7 +509,7 @@ jobs:
      - name: Verify pixi version (before setup-pixi)
        run: |
          pixi --version
-          pixi --version | grep -q "pixi 0.43.0"
+          pixi --version | grep -q "pixi 0.79.0"
        shell: bash
      - name: Verify pixi path (before setup-pixi)
        run: |
@@ -525,7 +530,7 @@ jobs:
        uses: ./
        with:
          cache: false
-          pixi-version: v0.44.0
+          pixi-version: v0.80.0
        if: matrix.ignore-reason == 'version'
      - name: Run Action (url should overwrite preinstalled pixi)
        uses: ./
@@ -534,10 +539,10 @@ jobs:
          pixi-url: |
            ${{
                matrix.os == 'ubuntu-latest' &&
-                    'https://github.com/prefix-dev/pixi/releases/download/v0.44.0/pixi-x86_64-unknown-linux-musl'
+                    'https://github.com/prefix-dev/pixi/releases/download/v0.80.0/pixi-x86_64-unknown-linux-musl'
                || matrix.os == 'macos-latest' &&
-                    'https://github.com/prefix-dev/pixi/releases/download/v0.44.0/pixi-x86_64-apple-darwin'
-                    || 'https://github.com/prefix-dev/pixi/releases/download/v0.44.0/pixi-x86_64-pc-windows-msvc.exe'
+                    'https://github.com/prefix-dev/pixi/releases/download/v0.80.0/pixi-x86_64-apple-darwin'
+                    || 'https://github.com/prefix-dev/pixi/releases/download/v0.80.0/pixi-x86_64-pc-windows-msvc.exe'
            }}
        if: matrix.ignore-reason == 'url'
      - name: Create custom bin directory
@@ -551,23 +556,23 @@ jobs:
          # this will implicitly set pixi-version to latest
          pixi-bin-path: custom-bin/pixi${{ matrix.os == 'windows-latest' && '.exe' || '' }}
        if: matrix.ignore-reason == 'bin-path'
-      - name: Verify pixi version (after setup-pixi) - still at 0.43.0
+      - name: Verify pixi version (after setup-pixi) - still at 0.79.0
        run: |
          pixi --version
-          pixi --version | grep -q 0.43.0
+          pixi --version | grep -q 0.79.0
        shell: bash
        if: matrix.ignore-reason == 'none'
-      - name: Verify pixi version (after setup-pixi) - should be 0.44.0
+      - name: Verify pixi version (after setup-pixi) - should be 0.80.0
        run: |
          pixi --version
-          pixi --version | grep -q 0.44.0
+          pixi --version | grep -q 0.80.0
        shell: bash
        if: matrix.ignore-reason != 'none' && matrix.ignore-reason != 'bin-path' && matrix.ignore-reason != 'version-latest'
      - name: Verify pixi version (after setup-pixi) - should be latest
        run: |
          pixi --version
-          pixi --version | grep -vq 0.43.0
-          pixi --version | grep -vq 0.44.0
+          pixi --version | grep -vq 0.79.0
+          pixi --version | grep -vq 0.80.0
        shell: bash
        if: matrix.ignore-reason == 'bin-path' || matrix.ignore-reason == 'version-latest'
      - name: Verify pixi path (after setup-pixi, no ignore reason)
@@ -646,7 +651,7 @@ jobs:
        # https://github.com/prefix-dev/pixi/issues/330
        if: matrix.os == 'ubuntu-latest'

-  persist-credentials-false:
+  auth-logout-after-install:
    env:
      # We must set this environment variable explicitly to force all
      # operating systems to use the same storage mechanism.
@@ -663,27 +668,13 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
-      # Sanity check: Login with default persist-credentials behavior
+      # auth-logout: post and never are tested in auth-logout-post-never
      - uses: ./
        with:
          cache: false
          auth-host: https://custom-conda-registry.com
          auth-token: custom-token
-      - name: Assert that the credentials are stored
-        run: |
-          # For human log readers
-          cat "${RATTLER_AUTH_FILE}"
-          # Actual test
-          [ $(jq '."*.custom-conda-registry.com".BearerToken' -r "${RATTLER_AUTH_FILE}") = "custom-token" ]
-      - name: Clean up credentials file
-        run: rm "${RATTLER_AUTH_FILE}"
-      # Actual test: Login with persist-credentials: false
-      - uses: ./
-        with:
-          cache: false
-          auth-host: https://custom-conda-registry.com
-          auth-token: custom-token
-          persist-credentials: false
+          auth-logout: after-install
      - name: Assert that the credentials are not stored anymore
        run: |
          # For human log readers
@@ -692,6 +683,43 @@ jobs:
          # Actual test
          ! grep -q '"*.custom-conda-registry.com"' "${RATTLER_AUTH_FILE}"

+  auth-logout-post-never:
+    env:
+      # We must set this environment variable explicitly to force all
+      # operating systems to use the same storage mechanism.
+      # Otherwise, mac will use the keychain, which is more cumbersome to test.
+      RATTLER_AUTH_FILE: .rattler-credentials.json
+    strategy:
+      matrix:
+        # action-post-run doesn't support bash on windows
+        os: [ubuntu-latest, macos-latest]
+        auth-logout: [post, never]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      # post steps run in reverse order, so this runs after the post step of setup-pixi
+      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
+        with:
+          run: |
+            set -euxo pipefail
+            cat "${RATTLER_AUTH_FILE}"
+            ${{ matrix.auth-logout == 'post' && '! ' || '' }}grep -q '"*.custom-conda-registry.com"' "${RATTLER_AUTH_FILE}"
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+          auth-logout: ${{ matrix.auth-logout }}
+      - name: Assert that the credentials are still stored
+        run: |
+          cat "${RATTLER_AUTH_FILE}"
+          [ $(jq '."*.custom-conda-registry.com".BearerToken' -r "${RATTLER_AUTH_FILE}") = "custom-token" ]
+
  auth-token-install:
    strategy:
      matrix:
@@ -734,8 +762,7 @@ jobs:
  pixi-shell:
    strategy:
      matrix:
-        # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -745,7 +772,7 @@ jobs:
        with:
          cache: false
      - run: |
-          python --version | grep -q "3.11"
+          python --version | grep -q "3.14"
        shell: pixi run bash -e {0}
      - run: |
          import sys
@@ -753,7 +780,7 @@ jobs:
          print("Hello world")
        shell: pixi run python {0}
      - run: |
-          python --version | Select-String "3.11"
+          python --version | Select-String "3.14"
        shell: pixi run pwsh -Command {0}
        # TODO investigate: for some reason, this errors on ubuntu-arm
        if: matrix.os != 'ubuntu-24.04-arm'
@@ -761,8 +788,7 @@ jobs:
  pixi-shell-exec:
    strategy:
      matrix:
-        # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -770,14 +796,14 @@ jobs:
        with:
          run-install: false
      - run: |
-          python --version | grep -q "3.11"
-        shell: pixi exec --spec python=3.11.* -- bash -e {0}
+          python --version | grep -q "3.14"
+        shell: pixi exec --spec python=3.14.* -- bash -e {0}
      - run: |
          import ruamel.yaml
        shell: pixi exec --spec python --spec ruamel.yaml -- python {0}
      - run: |
-          python --version | Select-String "3.11"
-        shell: pixi exec --spec python=3.11.* -- pwsh -Command {0}
+          python --version | Select-String "3.14"
+        shell: pixi exec --spec python=3.14.* -- pwsh -Command {0}
        # TODO investigate: for some reason, this errors on ubuntu-arm
        if: matrix.os != 'ubuntu-24.04-arm'

@@ -0,0 +1,10 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "tabWidth": 2,
+  "printWidth": 120,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "semi": false,
+  "sortPackageJson": false,
+  "ignorePatterns": ["dist", "pnpm-lock.yaml", "pixi.lock", "**/*.toml"]
+}
@@ -0,0 +1,23 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["eslint", "typescript", "unicorn", "oxc", "node"],
+  "categories": {
+    "correctness": "error"
+  },
+  "options": {
+    "typeAware": true,
+    "typeCheck": true,
+    "denyWarnings": true
+  },
+  "ignorePatterns": ["dist"],
+  "rules": {
+    "no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
+    "typescript/no-explicit-any": "error",
+    "typescript/no-unsafe-argument": "error",
+    "typescript/no-unsafe-assignment": "error",
+    "typescript/no-unsafe-call": "error",
+    "typescript/no-unsafe-member-access": "error",
+    "typescript/no-unsafe-return": "error",
+    "typescript/prefer-nullish-coalescing": ["error", { "ignoreConditionalTests": true }]
+  }
+}
@@ -1,3 +0,0 @@
-dist
-pnpm-lock.yaml
-pixi.lock
@@ -1,3 +1,3 @@
 {
-  "editor.defaultFormatter": "esbenp.prettier-vscode"
+  "editor.defaultFormatter": "oxc.oxc-vscode"
 }
@@ -23,7 +23,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    pixi-version: v0.66.0

@@ -35,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m

 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.10.1`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.11.0`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -79,7 +79,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    cache: true
    cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -124,7 +124,7 @@ test:
      environment: [py311, py312]
  steps:
    - uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.10.1
+    - uses: prefix-dev/setup-pixi@v0.11.0
      with:
        environments: ${{ matrix.environment }}
 ```
@@ -134,7 +134,7 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    # separated by spaces
    environments: >-
@@ -157,7 +157,7 @@ For instance, the `keyring`, or `gcloud` executables. The following example show
 By default, global environments are not cached. You can enable caching by setting the `global-cache` input to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    global-environments: |
      google-cloud-sdk
@@ -190,7 +190,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: prefix.dev
    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -202,7 +202,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: custom-artifactory.com
    auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -215,7 +215,7 @@ Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: anaconda.org # or my-quetz-instance.com
    auth-conda-token: ${{ secrets.CONDA_TOKEN }}
@@ -227,7 +227,7 @@ Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-k
 You can also specify the session token using the `auth-session-token` input argument.

 ```yaml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: s3://my-s3-bucket
    auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
@@ -238,27 +238,36 @@ You can also specify the session token using the `auth-session-token` input argu

 See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.

-#### Restricting credentials to the install step
+#### Logging out

-If you only want pixi to use the authenticated remote channel during the action's own install step
-(and not in any subsequent step of the workflow), set `persist-credentials: false`. The action will
-then run `pixi auth logout <auth-host>` after `pixi install` has completed but before the action
-returns, so that later steps cannot reach the private channel anymore.
+By default, the credentials stay available to all subsequent steps of the job and the action runs
+`pixi auth logout <auth-host>` in its post step at the end of the job.
+You can change this behavior with the `auth-logout` input:
+
+- `post` (default): log out in the post step at the end of the job.
+- `after-install`: log out at the end of the action, after `pixi install` has completed.
+  Use this if you only want pixi to use the authenticated remote channel during the action's own install step,
+  so that later steps cannot reach the private channel anymore.
+- `never`: never log out, for example on self-hosted runners where the credentials should persist between jobs.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: prefix.dev
    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
-    persist-credentials: false
+    auth-logout: after-install
 ```

+> [!NOTE]
+> `auth-logout` replaces the removed `persist-credentials` input.
+> Use `auth-logout: after-install` instead of `persist-credentials: false` and `auth-logout: never` instead of `persist-credentials: true`.
+
 #### PyPI keyring provider

 You can specify whether to use keyring to look up credentials for PyPI.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    pypi-keyring-provider: subprocess # one of 'subprocess', 'disabled'
 ```
@@ -326,7 +335,7 @@ To this end, `setup-pixi` adds all environment variables set when executing `pix
 As a result, all installed binaries can be accessed without having to call `pixi run`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    activate-environment: true
 ```
@@ -334,7 +343,7 @@ As a result, all installed binaries can be accessed without having to call `pixi
 If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    environments: >-
      py311
@@ -351,7 +360,7 @@ You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi
 See the [official documentation](https://pixi.sh/latest/reference/cli/pixi/install/#update-options) for more information about the `--frozen` and `--locked` flags.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    locked: true
    # or
@@ -370,7 +379,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  env:
    RUNNER_DEBUG: true
 ```
@@ -388,7 +397,7 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    # one of `q`, `default`, `v`, `vv`, or `vvv`.
    log-level: vvv
@@ -414,7 +423,7 @@ If nothing is specified, `post-cleanup` will default to `false`.
 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    post-cleanup: true
    # ${{ runner.temp }}\Scripts\pixi.exe on Windows
@@ -430,7 +439,7 @@ You can also use a preinstalled local version of pixi on the runner by not setti
 This can be overwritten by setting the `manifest-path` input argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    manifest-path: pyproject.toml
 ```
@@ -440,7 +449,7 @@ This can be overwritten by setting the `manifest-path` input argument.
 If you're working with a monorepo where your pixi project is in a subdirectory, you can use the `working-directory` input to specify where pixi should look for manifest files (`pixi.toml` or `pyproject.toml`).

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    working-directory: ./packages/my-project
 ```
@@ -459,7 +468,7 @@ This will make pixi look for `pixi.toml` or `pyproject.toml` in the `./packages/
 You can combine `working-directory` with `manifest-path` if needed:

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    working-directory: ./packages/my-project
    manifest-path: custom-pixi.toml
@@ -470,7 +479,7 @@ You can combine `working-directory` with `manifest-path` if needed:
 If you only want to install pixi and not install the current project, you can use the `run-install` option.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    run-install: false
 ```
@@ -481,7 +490,7 @@ You can also download pixi from a custom URL by setting the `pixi-url` input arg
 Optionally, you can combine this with the `pixi-url-headers` input argument to supply additional headers for the download request, such as a bearer token.

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    pixi-url: https://pixi-mirror.example.com/releases/download/v0.48.0/pixi-x86_64-unknown-linux-musl
    pixi-url-headers: '{"Authorization": "Bearer ${{ secrets.PIXI_MIRROR_BEARER_TOKEN }}"}'
@@ -497,7 +506,7 @@ It will be rendered with the following variables:
 By default, `pixi-url` is equivalent to the following template:

 ```yml
- uses: prefix-dev/setup-pixi@v0.10.1
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    pixi-url: |
      {{#if latest~}}
@@ -78,12 +78,16 @@ inputs:
    description: Secret access key to use for S3 authentication.
  auth-s3-session-token:
    description: Session token to use for S3 authentication.
-  persist-credentials:
+  auth-logout:
    description: |
-      Whether to keep the credentials configured by `auth-host` available to subsequent workflow
-      steps. Defaults to `true`. If set to `false`, the action runs `pixi auth logout <auth-host>`
-      after install, so that later steps cannot reach the private channel anymore. Requires
-      `auth-host`.
+      When to run `pixi auth logout <auth-host>`. Requires `auth-host`.
+      options: post, after-install, never
+      - `post` (default): The credentials stay available to all subsequent steps and are removed in the post step at the end of the job.
+      - `after-install`: The credentials are removed at the end of this action, so that later steps cannot reach the private channel anymore.
+      - `never`: The credentials are never removed.
+  persist-credentials:
+    description: Removed, use `auth-logout` instead.
+    deprecationMessage: '`persist-credentials` has been removed, use `auth-logout: after-install` (instead of `false`) or `auth-logout: never` (instead of `true`).'
  pypi-keyring-provider:
    description: |
      Specifies whether to use keyring to look up credentials for PyPI.
@@ -1,42 +0,0 @@
-// @ts-check
-
-import eslint from '@eslint/js'
-import tseslint from 'typescript-eslint'
-
-export default tseslint.config(
-  eslint.configs.recommended,
-  ...tseslint.configs.strictTypeChecked,
-  ...tseslint.configs.stylisticTypeChecked,
-  {
-    ignores: ['dist/*']
-  },
-  {
-    languageOptions: {
-      parserOptions: {
-        project: true,
-        tsconfigRootDir: import.meta.dirname
-      }
-    }
-  },
-  {
-    rules: {
-      '@typescript-eslint/no-unused-vars': [
-        'error',
-        {
-          argsIgnorePattern: '^_'
-        }
-      ],
-      '@typescript-eslint/prefer-nullish-coalescing': [
-        'error',
-        {
-          ignoreConditionalTests: true
-        }
-      ]
-    }
-  },
-  // disable type checking for config files as they aren't in the TS root
-  {
-    files: ['eslint.config.mjs', 'prettier.config.mjs', 'tsup.config.js'],
-    ...tseslint.configs.disableTypeChecked
-  }
-)
@@ -1,14 +1,15 @@
 {
  "name": "setup-pixi",
-  "version": "0.10.1",
+  "version": "0.11.0",
  "private": true,
  "description": "Action to set up the pixi package manager.",
  "scripts": {
    "build": "tsup",
    "dev": "tsup --watch",
-    "eslint": "eslint .",
-    "lint": "pnpm eslint && prettier -c .",
-    "lint:fix": "eslint . --fix && prettier -w ."
+    "lint": "oxlint --fix",
+    "lint:check": "oxlint",
+    "fmt": "oxfmt",
+    "fmt:check": "oxfmt --check"
  },
  "repository": {
    "type": "git",
@@ -28,19 +29,18 @@
    "@actions/io": "^3.0.2",
    "@actions/tool-cache": "^4.0.0",
    "handlebars": "^4.7.9",
-    "smol-toml": "^1.7.1",
+    "smol-toml": "^1.9.0",
    "untildify": "^6.0.0",
    "which": "^7.0.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.5"
  },
  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.6.2",
    "@types/which": "^3.0.4",
-    "eslint": "^10.8.0",
-    "prettier": "^3.9.6",
+    "oxfmt": "^0.71.0",
+    "oxlint": "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
    "tsup": "^8.5.1",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.66.0"
+    "typescript": "^7.0.2"
  }
 }
@@ -1,9 +0,0 @@
-const config = {
-  tabWidth: 2,
-  printWidth: 120,
-  singleQuote: true,
-  trailingComma: 'none',
-  semi: false
-}
-
-export default config
@@ -14,7 +14,6 @@ const splitEnvironment = (shellHook: ShellHook): [Record<string, string>, string
    if (pathEnvs.length > 0) {
      const caseSensitivePathName = pathEnvs[0]
      const path = shellHook.environment_variables[caseSensitivePathName]
-      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
      delete shellHook.environment_variables[caseSensitivePathName]
      return [shellHook.environment_variables, path]
    }
@@ -116,7 +116,7 @@ async function _saveCache(
      const cacheId = await cache.saveCache([cachePath], cacheKey, undefined, false)
      core.info(`Saved cache with ID "${cacheId.toString()}"`)
    } catch (err: unknown) {
-      // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+      // oxlint-disable-next-line typescript/restrict-template-expressions
      core.error(`Error saving ${type} cache: ${err}`)
    }
  })
@@ -48,12 +48,13 @@ const pixiLogin = async () => {
      core.debug(`Logging in to ${auth.host} with conda token`)
      await execute(pixiCmd(`auth login --conda-token ${auth.condaToken} ${auth.host}`, false))
    }
+    await execute(pixiCmd('auth status', false))
  })
 }

 const pixiLogout = async () => {
  const auth = options.auth
-  if (!auth || auth.persistCredentials) {
+  if (auth?.logout !== 'after-install') {
    core.debug('Skipping pixi logout.')
    return
  }
@@ -35,7 +35,7 @@ type Inputs = Readonly<{
  authS3AccessKeyId?: string
  authS3SecretAccessKey?: string
  authS3SessionToken?: string
-  persistCredentials?: boolean
+  authLogout?: AuthLogout
  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup?: boolean
  globalEnvironments?: string[]
@@ -49,7 +49,7 @@ export interface PixiSource {

 type Auth = {
  host: string
-  persistCredentials: boolean
+  logout: AuthLogout
 } & (
  | {
      token: string
@@ -93,7 +93,6 @@ export type Options = Readonly<{
  globalCache?: GlobalCache
  pixiBinPath: string
  auth?: Auth
-  persistCredentials: boolean
  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup: boolean
  activatedEnvironment?: string
@@ -105,6 +104,9 @@ const pyprojectPath = 'pyproject.toml'
 const logLevelSchema = z.enum(['q', 'default', 'v', 'vv', 'vvv'])
 export type LogLevel = z.infer<typeof logLevelSchema>

+const authLogoutSchema = z.enum(['post', 'after-install', 'never'])
+export type AuthLogout = z.infer<typeof authLogoutSchema>
+
 const pypiKeyringProviderSchema = z.enum(['disabled', 'subprocess'])
 export type PypiKeyringProvider = z.infer<typeof pypiKeyringProviderSchema>

@@ -243,8 +245,8 @@ const validateInputs = (inputs: Inputs): void => {
    if (inputs.authToken || inputs.authUsername || inputs.authCondaToken || inputs.authS3AccessKeyId) {
      throw new Error('You need to specify auth-host')
    }
-    if (inputs.persistCredentials === false) {
-      throw new Error('Cannot use persist-credentials without specifying auth-host')
+    if (inputs.authLogout) {
+      throw new Error('Cannot use auth-logout without specifying auth-host')
    }
  }
  if (inputs.runInstall === false && inputs.environments) {
@@ -361,34 +363,34 @@ const inferOptions = (inputs: Inputs): Options => {
      : undefined
  const frozen = inputs.frozen ?? false
  const locked = inputs.locked ?? (lockFileAvailable && !frozen)
-  const persistCredentials = inputs.persistCredentials ?? true
+  const authLogout = inputs.authLogout ?? 'post'
  const auth = !inputs.authHost
    ? undefined
    : ((inputs.authToken
        ? {
            host: inputs.authHost,
            token: inputs.authToken,
-            persistCredentials: persistCredentials
+            logout: authLogout
          }
        : inputs.authCondaToken
          ? {
              host: inputs.authHost,
              condaToken: inputs.authCondaToken,
-              persistCredentials: persistCredentials
+              logout: authLogout
            }
          : inputs.authUsername
            ? {
                host: inputs.authHost,
                username: inputs.authUsername,
                password: inputs.authPassword,
-                persistCredentials: persistCredentials
+                logout: authLogout
              }
            : {
                host: inputs.authHost,
                s3AccessKeyId: inputs.authS3AccessKeyId,
                s3SecretAccessKey: inputs.authS3SecretAccessKey,
                s3SessionToken: inputs.authS3SessionToken,
-                persistCredentials: persistCredentials
+                logout: authLogout
              }) as Auth)
  const postCleanup = inputs.postCleanup ?? false
  const pypiKeyringProvider = inputs.pypiKeyringProvider
@@ -410,7 +412,6 @@ const inferOptions = (inputs: Inputs): Options => {
    globalCache,
    pixiBinPath,
    auth,
-    persistCredentials,
    postCleanup
  }
 }
@@ -425,6 +426,11 @@ const assertOptions = (_options: Options) => {
 }

 const getOptions = () => {
+  if (inputOrEnvironmentVariable('persist-credentials') !== undefined) {
+    throw new Error(
+      '`persist-credentials` has been removed, use `auth-logout: after-install` (instead of `false`) or `auth-logout: never` (instead of `true`).'
+    )
+  }
  const inputs: Inputs = {
    pixiVersion: parseOrUndefined(
      'pixi-version',
@@ -459,7 +465,11 @@ const getOptions = () => {
    authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
    authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
    authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
-    persistCredentials: parseOrUndefinedJSON('persist-credentials', z.boolean()),
+    authLogout: parseOrUndefined(
+      'auth-logout',
+      authLogoutSchema,
+      'auth-logout must be one of `post`, `after-install`, `never`.'
+    ),
    pypiKeyringProvider: parseOrUndefined('pypi-keyring-provider', pypiKeyringProviderSchema),
    globalEnvironments: parseOrUndefinedMultilineList('global-environments', z.string()),
    postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
@@ -5,6 +5,7 @@ import os from 'os'
 import { exit } from 'process'
 import * as core from '@actions/core'
 import { options } from './options'
+import { execute, pixiCmd } from './util'

 const removeEmptyParentDirs = (dirPath: string): Promise<void> => {
  if (existsSync(dirPath)) {
@@ -52,7 +53,6 @@ const cleanupEnv = () => {
 const determineCacheDir = (): string => {
  // rattler uses dirs::cache_dir https://docs.rs/dirs/latest/dirs/fn.cache_dir.html
  if (os.platform() === 'win32') {
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
    return process.env.LOCALAPPDATA!
  }
  if (os.platform() === 'linux') {
@@ -72,13 +72,31 @@ const cleanupRattler = () => {
  ])
 }

-const run = () => {
+const pixiLogout = async () => {
+  const auth = options.auth
+  if (auth?.logout !== 'post') {
+    core.debug('Skipping pixi logout.')
+    return
+  }
+  if (!existsSync(options.pixiBinPath)) {
+    core.debug(`Skipping pixi logout, pixi binary ${options.pixiBinPath} does not exist.`)
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
+  })
+}
+
+const run = async () => {
+  // needs to happen before the cleanup since that removes the pixi binary
+  await pixiLogout()
  const postCleanup = options.postCleanup
  if (postCleanup) {
-    return Promise.all([cleanupPixiBin(), cleanupEnv(), cleanupRattler()])
+    await Promise.all([cleanupPixiBin(), cleanupEnv(), cleanupRattler()])
+    return
  }
  core.debug('Skipping post-cleanup.')
-  return Promise.resolve()
 }

 run()
@@ -1,4 +1,3 @@
-import type { BinaryLike } from 'crypto'
 import { createHash } from 'crypto'
 import os from 'os'
 import * as core from '@actions/core'
@@ -21,6 +20,7 @@ export const getCondaArch = () => {
    'linux-x64': 'linux-64',
    'linux-arm64': 'linux-aarch64',
    'linux-ppc64': 'linux-ppc64le',
+    'linux-riscv64': 'linux-riscv64',
    'win32-x64': 'win-64',
    'win32-arm64': 'win-arm64'
  }
@@ -33,15 +33,21 @@ export const getCondaArch = () => {

 const getPlatform = () => {
  const platform = os.platform()
+  const arch = os.arch()
+
  switch (platform) {
    case 'darwin':
      return 'apple-darwin'
    case 'linux':
+      if (arch == 'riscv64') {
+        // https://github.com/prefix-dev/pixi/issues/6903
+        return 'unknown-linux-gnu'
+      }
      return 'unknown-linux-musl'
    case 'win32':
      return 'pc-windows-msvc'
    default:
-      throw new Error(`Unsupported architecture: ${platform}`)
+      throw new Error(`Unsupported platform: ${platform}`)
  }
 }

@@ -52,6 +58,8 @@ const getArch = () => {
      return 'x86_64'
    case 'arm64':
      return 'aarch64'
+    case 'riscv64':
+      return 'riscv64gc'
    default:
      throw new Error(`Unsupported architecture: ${arch}`)
  }
@@ -70,11 +78,11 @@ export const renderPixiUrl = (urlTemplate: string, version: string) => {
  })
 }

-export const sha256 = (s: BinaryLike) => {
+export const sha256 = (s: string | NodeJS.ArrayBufferView) => {
  return createHash('sha256').update(s).digest('hex')
 }

-export const sha256Short = (s: BinaryLike) => {
+export const sha256Short = (s: string | NodeJS.ArrayBufferView) => {
  return sha256(s).slice(0, 7)
 }

@@ -1,10 +1,19 @@
 [workspace]
 name = "test-default"
 channels = ["conda-forge"]
-platforms = ["linux-64", "linux-aarch64", "osx-64", "osx-arm64", "win-64"]
+platforms = [
+  "linux-64",
+  "linux-aarch64",
+  "linux-riscv64",
+  "linux-ppc64le",
+  "osx-64",
+  "osx-arm64",
+  "win-64",
+  "win-arm64",
+]

 [tasks]
 test = "python -c 'print(\"Hello world!\")'"

 [dependencies]
-python = "3.11.*"
+python = "3.14.*"
Author	SHA1	Message	Date
Pavel Zwerschke	9dabb60412	feat!: Add auth-logout input and run pixi auth status after login (#291 )	2026-10-06 18:15:30 +02:00
Pavel Zwerschke	5fdf4c63fe	chore: bump typescript to v7 and migrate to oxlint and oxfmt (#289 )	2026-10-01 12:31:45 +02:00
dependabot[bot]andPavel Zwerschke	1fa34b61c2	chore(deps): bump the nodejs group across 1 directory with 7 updates (#288 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-10-01 11:46:57 +02:00
dependabot[bot]	999d92afb1	chore(deps): bump the gh-actions group across 1 directory with 2 updates (#287 ) Signed-off-by: dependabot[bot] <support@github.com>	2026-10-01 11:22:52 +02:00
Pavel Zwerschke	2a8a9843bb	chore: simplify example recipe (#285 )	2026-09-15 17:24:57 +02:00
Pavel Zwerschke	d3f436a425	feat: Add support for linux-riscv64 (#282 )	2026-08-28 10:55:29 +02:00