Add S3 authentication (#176)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.eslintrc.js

@@ -1,28 +0,0 @@
-module.exports = {
-  ignorePatterns: ['dist/**/*', 'build/**/*'],
-  extends: ['standard', 'plugin:@typescript-eslint/recommended', 'plugin:prettier/recommended'],
-  parser: '@typescript-eslint/parser',
-  parserOptions: {
-    ecmaVersion: '2020'
-  },
-  plugins: ['@typescript-eslint', 'prettier'],
-  rules: {
-    'import/order': 'error',
-    'no-use-before-define': 'off',
-    'no-unused-vars': 'off',
-    '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-    'n/no-callback-literal': 'off',
-    '@typescript-eslint/consistent-type-imports': ['error', { prefer: 'type-imports' }],
-    '@typescript-eslint/no-use-before-define': 'error',
-    'prettier/prettier': [
-      'error',
-      {
-        tabWidth: 2,
-        printWidth: 120,
-        singleQuote: true,
-        trailingComma: 'none',
-        semi: false
-      }
-    ]
-  }
-}

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,3 @@
+If updating documentation:
+
+- [ ] Updated documentation in https://github.com/prefix-dev/pixi/blob/main/docs/advanced/github_actions.md as well

.github/dependabot.yml

@@ -3,14 +3,16 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
+    groups:
+      gh-actions:
+        patterns:
+          - '*'
   - package-ecosystem: npm
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
     groups:
-      dev-dependencies:
+      nodejs:
         patterns:
-          - "*eslint*"
-          - "@types/*"
-          - "prettier"
+          - '*'

.github/release.yml

@@ -3,21 +3,24 @@ changelog:
     labels:
       - ignore for release
   categories:
-    - title: New features
+    - title: 💥 Breaking changes
+      labels:
+        - breaking
+    - title: ✨ New features
       labels:
         - enhancement
-    - title: CI
+    - title: 👷🏻 CI
       labels:
         - ci
-    - title: Bug fixes
+    - title: 🐛 Bug fixes
       labels:
         - bug
-    - title: Documentation
+    - title: 📝 Documentation
       labels:
         - documentation
-    - title: Dependency updates
+    - title: ⬆️ Dependency updates
       labels:
         - dependencies
-    - title: Other changes
+    - title: 🤷🏻 Other changes
       labels:
-        - "*"
+        - '*'

.github/workflows/build.yml

@@ -6,20 +6,24 @@ on:
   pull_request:
     branches: [main]
   merge_group:
+  schedule:
+    # every 3 months
+    - cron: 0 0 1 */3 *
+  workflow_dispatch:
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.4.0
         with:
-          version: 8
+          version: 9
 
       - name: Install Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: 20
           cache: pnpm
@@ -29,6 +33,94 @@ jobs:
 
       - name: Rebuild the dist/ directory
         run: pnpm build
-      
+
       - name: Lint
         run: pnpm lint
+
+  reference-latest-version-in-readme:
+    name: Reference latest version in README
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Assert latest setup-pixi version is mentioned in README
+        run: |
+          set -euo pipefail
+          latest_version="$(jq -r '.version' package.json)"
+          count_expected=16
+          count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
+          if [ "$count_actual" -ne "$count_expected" ]; then
+            echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
+            exit 1
+          fi
+
+  reference-latest-pixi-version-in-readme:
+    name: Reference latest Pixi version in README
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Assert latest pixi version is mentioned in README
+        run: |
+          set -euo pipefail
+          latest_version="$(gh repo view --json latestRelease prefix-dev/pixi | jq -r '.latestRelease.tagName')"
+          count_expected=1
+          count_actual="$(grep -c "pixi-version: $latest_version" README.md || true)"
+          if [ "$count_actual" -ne "$count_expected" ]; then
+            echo "::error file=README.md::Expected $count_expected mentions of \`pixi-version: $latest_version\` in README.md, but found $count_actual."
+            sed -i "s/pixi-version: .*/pixi-version: $latest_version/" README.md
+            exit 1
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
+        if: failure() && github.ref_name == 'main'
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Reference latest Pixi version in README
+          title: Reference latest Pixi version in README
+          labels: ignore for release
+
+  check-dist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.4.0
+        with:
+          version: 9
+
+      - name: Install Node.js
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Rebuild the dist/ directory
+        run: pnpm build
+
+      - name: Compare the expected and actual dist/ directories
+        run: |
+          if [ "$(git diff --ignore-space-at-eol dist/* | wc -l)" -gt "0" ]; then
+            echo "Detected uncommitted changes after build.  See status below:"
+            git diff
+            exit 1
+          fi
+        id: diff
+
+      # If index.js or post.js are different than expected, upload the expected version as an artifact
+      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
+        with:
+          name: dist
+          path: dist/

.github/workflows/check-dist.yml

@@ -1,48 +0,0 @@
-name: Check dist
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  merge_group:
-
-jobs:
-  check-dist:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 8
-
-      - name: Install Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: 20
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Rebuild the dist/ directory
-        run: pnpm build
-
-      - name: Compare the expected and actual dist/ directories
-        run: |
-          if [ "$(git diff --ignore-space-at-eol dist/* | wc -l)" -gt "0" ]; then
-            echo "Detected uncommitted changes after build.  See status below:"
-            git diff
-            exit 1
-          fi
-        id: diff
-
-      # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v3
-        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
-        with:
-          name: dist
-          path: dist/

.github/workflows/release.yml

@@ -12,8 +12,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: Quantco/ui-actions/version-metadata@v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: Quantco/ui-actions/version-metadata@cd71d2a0e30b25569f6d723e57acca83347e58fc # v1.0.18
         id: version-metadata
         with:
           file: ./package.json
@@ -24,7 +24,7 @@ jobs:
           TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
       - name: Create release
         if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
         with:
           generate_release_notes: true
           tag_name: v${{ steps.version-metadata.outputs.newVersion }}

.github/workflows/test.yml

@@ -7,29 +7,39 @@ on:
     branches: [main]
   merge_group:
 
+# Automatically stop old builds on the same branch/PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   default:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        cache: [true, false]
     runs-on: ${{ matrix.os }}
+    name: default ${{ matrix.cache == true && 'with' || 'without' }} cache (${{ matrix.os }})
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
+        # check the action logs to see if the cache was used or not
+        with:
+          cache: ${{ matrix.cache }}
       - run: |
           set -o pipefail
           pixi info
-          test -f .pixi/env/bin/python
-          ./.pixi/env/bin/python --version | grep -q 3.11
+          test -f .pixi/envs/default/bin/python
+          ./.pixi/envs/default/bin/python --version | grep -q 3.11
         shell: bash
         if: matrix.os != 'windows-latest'
       - run: |
           set -o pipefail
           pixi info
-          test -f .pixi/env/python.exe
-          ./.pixi/env/python.exe --version | grep -q 3.11
+          test -f .pixi/envs/default/python.exe
+          ./.pixi/envs/default/python.exe --version | grep -q 3.11
         shell: bash
         if: matrix.os == 'windows-latest'
       - run: |
@@ -42,63 +52,167 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
+      - uses: ./
+        with:
+          run-install: false
+          cache: false
+      - run: |
+          ! test -d .pixi
+        shell: bash
+
+  no-pixi-toml:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./
         with:
           run-install: false
       - run: |
           ! test -d .pixi
         shell: bash
+      - run: pixi info
 
   custom-pixi-version:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/old-pixi-lockfiles/* .
+      - uses: ./
+        with:
+          cache: false
+          pixi-version: v0.1.0
+          # pixi 0.1.0 doesn't support --locked
+          locked: false
+      - run: pixi --version | grep -q "pixi 0.1.0"
+
+  old-lockfile:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        locked: [true, false]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/old-pixi-lockfiles/* .
+      - uses: ./
+        with:
+          pixi-version: latest
+          cache: false
+          locked: ${{ matrix.locked }}
+      - if: matrix.os == 'windows-latest'
+        run: choco install yq
+      # assert that the lockfile wasn't updated
+      - run: test "$(yq '.version' pixi.lock)" = 1
+
+  install-path:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./
+        with:
+          run-install: false
+      - run: test "$(which pixi)" = "$HOME/.pixi/bin/pixi"
+        shell: bash
+
+  global-install:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./
+        with:
+          run-install: false
+      - run: pixi global install cowpy
+      - run: |
+          pixi global list 2>&1 | grep cowpy
+          cowpy hello world
+          test "$(which cowpy)" = "$HOME/.pixi/bin/cowpy"
+        if: matrix.os != 'windows-latest'
+      - run: cowpy hello world
+        if: matrix.os == 'windows-latest'
+
+  frozen:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
         with:
-          pixi-version: v0.1.0
-      - run: pixi --version | grep -q "pixi 0.1.0"
+          cache: false
+          frozen: true
+      - run: pixi run python --version | grep -q 3.11
+
+  locked:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          cache: false
+          locked: true
+      - run: pixi run python --version | grep -q 3.11
 
   custom-pixi-url:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
-        run: mv test/default/* .
+        run: mv test/old-pixi-lockfiles/* .
       - uses: ./
         with:
-          pixi-url: https://github.com/prefix-dev/pixi/releases/download/v0.0.8/pixi-x86_64-unknown-linux-musl
-      - run: pixi --version | grep -q "pixi 0.0.8"
-  
+          cache: false
+          pixi-url: https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-unknown-linux-musl
+      - run: pixi --version | grep -q "pixi 0.14.0"
+
   custom-manifest-path:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./
         with:
+          cache: false
           manifest-path: test/default/pixi.toml
-  
+
   different-log-level:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
         with:
+          cache: false
           log-level: v
 
   custom-bin-path:
@@ -107,18 +221,139 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-    - name: Move pixi.toml
-      run: mv test/default/* .
-    - uses: ./
-      with:
-        pixi-bin-path: custom-bin/pixi${{ matrix.os == 'windows-latest' && '.exe' || '' }}
-    - run: |
-        test -f custom-bin/pixi${{ matrix.os == 'windows-latest' && '.exe' || '' }}
-        pixi --help
-        which pixi | grep -q custom-bin/pixi
-        # which pixi should be absolute
-        which pixi | grep -q "^/"
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          cache: false
+          pixi-bin-path: custom-bin/pixi${{ matrix.os == 'windows-latest' && '.exe' || '' }}
+      - run: |
+          test -f custom-bin/pixi${{ matrix.os == 'windows-latest' && '.exe' || '' }}
+          pixi --help
+          which pixi | grep -q custom-bin/pixi
+          # which pixi should be absolute
+          which pixi | grep -q "^/"
+
+  existing-pixi-bin:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        ignore-reason: [none, version, version-latest, url, bin-path]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - name: Create pixi directory and add to PATH
+        run: |
+          mkdir -p $HOME/custom-existing-pixi
+          echo $HOME/custom-existing-pixi >> $GITHUB_PATH
+        if: matrix.os != 'windows-latest'
+      - name: Create pixi directory and add to PATH (Windows)
+        run: |
+          mkdir $env:USERPROFILE\custom-existing-pixi
+          echo $env:USERPROFILE\custom-existing-pixi >> $env:GITHUB_PATH
+        shell: pwsh
+        if: matrix.os == 'windows-latest'
+      - name: Download pixi binary (Ubuntu)
+        run: |
+          set -o pipefail
+          curl -L --output $HOME/custom-existing-pixi/pixi https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-unknown-linux-musl
+          chmod +x $HOME/custom-existing-pixi/pixi
+        if: matrix.os == 'ubuntu-latest'
+      - name: Download pixi binary (macOS)
+        run: |
+          set -o pipefail
+          curl -L --output $HOME/custom-existing-pixi/pixi https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-apple-darwin
+          chmod +x $HOME/custom-existing-pixi/pixi
+        if: matrix.os == 'macos-latest'
+      - name: Download pixi binary (Windows)
+        run: |
+          curl -L --output $HOME/custom-existing-pixi/pixi.exe https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-pc-windows-msvc.exe
+        if: matrix.os == 'windows-latest'
+      - run: |
+          echo "Path: $PATH"
+        shell: bash
+      - name: Verify pixi version (before setup-pixi)
+        run: |
+          pixi --version
+          pixi --version | grep -q "pixi 0.14.0"
+        shell: bash
+      - name: Verify pixi path (before setup-pixi)
+        run: |
+          which pixi | grep -q $HOME/custom-existing-pixi/pixi
+        shell: bash
+      - name: Run Action (should use preinstalled pixi)
+        uses: ./
+        with:
+          cache: false
+        if: matrix.ignore-reason == 'none'
+      - name: Run Action (version-latest should overwrite preinstalled pixi)
+        uses: ./
+        with:
+          cache: false
+          pixi-version: latest
+        if: matrix.ignore-reason == 'version-latest'
+      - name: Run Action (version should overwrite preinstalled pixi)
+        uses: ./
+        with:
+          cache: false
+          pixi-version: v0.16.0
+        if: matrix.ignore-reason == 'version'
+      - name: Run Action (url should overwrite preinstalled pixi)
+        uses: ./
+        with:
+          cache: false
+          pixi-url: |
+            ${{
+                matrix.os == 'ubuntu-latest' &&
+                    'https://github.com/prefix-dev/pixi/releases/download/v0.16.0/pixi-x86_64-unknown-linux-musl'
+                || matrix.os == 'macos-latest' &&
+                    'https://github.com/prefix-dev/pixi/releases/download/v0.16.0/pixi-x86_64-apple-darwin'
+                || 'https://github.com/prefix-dev/pixi/releases/download/v0.16.0/pixi-x86_64-pc-windows-msvc.exe'
+            }}
+        if: matrix.ignore-reason == 'url'
+      - name: Create custom bin directory
+        run: mkdir custom-bin
+        shell: bash
+        if: matrix.ignore-reason == 'bin-path'
+      - name: Run Action (pixi-bin-path should overwrite preinstalled pixi)
+        uses: ./
+        with:
+          cache: false
+          # this will implicitly set pixi-version to latest
+          pixi-bin-path: custom-bin/pixi${{ matrix.os == 'windows-latest' && '.exe' || '' }}
+        if: matrix.ignore-reason == 'bin-path'
+      - name: Verify pixi version (after setup-pixi) - still at 0.14.0
+        run: |
+          pixi --version
+          pixi --version | grep -q 0.14.0
+        shell: bash
+        if: matrix.ignore-reason == 'none'
+      - name: Verify pixi version (after setup-pixi) - should be 0.16.0
+        run: |
+          pixi --version
+          pixi --version | grep -q 0.16.0
+        shell: bash
+        if: matrix.ignore-reason != 'none' && matrix.ignore-reason != 'bin-path' && matrix.ignore-reason != 'version-latest'
+      - name: Verify pixi version (after setup-pixi) - should be latest
+        run: |
+          pixi --version
+          pixi --version | grep -vq 0.14.0
+          pixi --version | grep -vq 0.16.0
+        shell: bash
+        if: matrix.ignore-reason == 'bin-path' || matrix.ignore-reason == 'version-latest'
+      - name: Verify pixi path (after setup-pixi, no ignore reason)
+        run: |
+          which pixi | grep -q $HOME/custom-existing-pixi/pixi
+        shell: bash
+        if: matrix.ignore-reason == 'none'
+      - name: Verify pixi path (after setup-pixi, ignore reason)
+        run: |
+          which pixi | grep -vq $HOME/custom-existing-pixi/pixi
+        shell: bash
+        if: matrix.ignore-reason != 'none'
 
   auth-token:
     strategy:
@@ -126,17 +361,17 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
         with:
+          cache: false
           auth-host: https://custom-conda-registry.com
           auth-token: custom-token
       - run: |
-          grep -q "BearerToken" ~/.rattler/rattler_auth_store.json
-          grep -q "custom-conda-registry.com" ~/.rattler/rattler_auth_store.json
-          grep -q "custom-token" ~/.rattler/rattler_auth_store.json
+          cat ~/.rattler/credentials.json
+          [ $(jq '."*.custom-conda-registry.com".BearerToken' -r ~/.rattler/credentials.json) = "custom-token" ]
         # all other platforms have the credentials stored in the keychain
         # https://github.com/prefix-dev/pixi/issues/330
         if: matrix.os == 'ubuntu-latest'
@@ -147,19 +382,19 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
         with:
+          cache: false
           auth-host: https://custom-conda-registry.com
           auth-username: custom-username
           auth-password: custom-password
       - run: |
-          grep -q "BasicHTTP" ~/.rattler/rattler_auth_store.json
-          grep -q "custom-conda-registry.com" ~/.rattler/rattler_auth_store.json
-          grep -q "custom-username" ~/.rattler/rattler_auth_store.json
-          grep -q "custom-password" ~/.rattler/rattler_auth_store.json
+          cat ~/.rattler/credentials.json
+          [ $(jq '."*.custom-conda-registry.com".BasicHTTP.username' -r ~/.rattler/credentials.json) = "custom-username" ]
+          [ $(jq '."*.custom-conda-registry.com".BasicHTTP.password' -r ~/.rattler/credentials.json) = "custom-password" ]
         # all other platforms have the credentials stored in the keychain
         # https://github.com/prefix-dev/pixi/issues/330
         if: matrix.os == 'ubuntu-latest'
@@ -170,40 +405,101 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
         with:
+          cache: false
           auth-host: https://custom-conda-registry.com
           auth-conda-token: custom-conda-token
       - run: |
-          grep "CondaToken" ~/.rattler/rattler_auth_store.json
-          cat ~/.rattler/rattler_auth_store.json
-          grep -q "custom-conda-registry.com" ~/.rattler/rattler_auth_store.json
-          grep -q "custom-conda-token" ~/.rattler/rattler_auth_store.json
+          cat ~/.rattler/credentials.json
+          [ $(jq '."*.custom-conda-registry.com".CondaToken' -r ~/.rattler/credentials.json) = "custom-conda-token" ]
         # all other platforms have the credentials stored in the keychain
         # https://github.com/prefix-dev/pixi/issues/330
         if: matrix.os == 'ubuntu-latest'
 
+  auth-token-install:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/auth/* .
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://repo.prefix.dev
+          auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
+      - name: Ensure private-package is installed
+        run: |
+          test -f .pixi/envs/default/conda-meta/private-package-0.0.1-0.json
+
+  auth-s3-install:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/auth-s3/* .
+      - uses: ./
+        with:
+          cache: false
+          auth-host: s3://rattler-s3-testing
+          auth-s3-access-key-id: ${{ secrets.PIXI_TEST_R2_ACCESS_KEY_ID }}
+          auth-s3-secret-access-key: ${{ secrets.PIXI_TEST_R2_SECRET_ACCESS_KEY }}
+      - name: Ensure private package is installed
+        run: |
+          test -f .pixi/envs/default/conda-meta/my-webserver-0.1.0-pyh4616a5c_0.json
+
   pixi-shell:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
+        with:
+          cache: false
       - run: |
           python --version | grep -q "3.11"
-        shell: pixi run bash {0}
+        shell: pixi run bash -e {0}
       - run: |
           import sys
           print(sys.version)
           print("Hello world")
         shell: pixi run python {0}
+      - run: |
+          python --version | Select-String "3.11"
+        shell: pixi run pwsh -Command {0}
+
+  pixi-shell-exec:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./
+        with:
+          run-install: false
+      - run: |
+          python --version | grep -q "3.11"
+        shell: pixi exec --spec python=3.11.* -- bash -e {0}
+      - run: |
+          import ruamel.yaml
+        shell: pixi exec --spec python --spec ruamel.yaml -- python {0}
+      - run: |
+          python --version | Select-String "3.11"
+        shell: pixi exec --spec python=3.11.* -- pwsh -Command {0}
 
   post-cleanup-linux:
     runs-on: ubuntu-latest
@@ -211,10 +507,10 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
-      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe
+      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
         with:
           run: |
             set -euxo pipefail
@@ -224,6 +520,7 @@ jobs:
             ${{ matrix.post-cleanup == 'true' && '! ' || '' }}test -f ~/.pixi/bin/pixi
       - uses: ./
         with:
+          cache: false
           post-cleanup: ${{ matrix.post-cleanup }}
           # ~/.rattler is only created if the user has logged in
           auth-host: https://custom-conda-registry.com
@@ -235,10 +532,10 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
-      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe
+      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
         with:
           run: |
             set -euxo pipefail
@@ -248,6 +545,7 @@ jobs:
             ${{ matrix.post-cleanup == 'true' && '! ' || '' }}test -f ~/.pixi/bin/pixi
       - uses: ./
         with:
+          cache: false
           post-cleanup: ${{ matrix.post-cleanup }}
 
   post-cleanup-macos:
@@ -256,10 +554,10 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
-      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe
+      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
         with:
           run: |
             set -euxo pipefail
@@ -268,6 +566,7 @@ jobs:
             ${{ matrix.post-cleanup == 'true' && '! ' || '' }}test -f ~/.pixi/bin/pixi
       - uses: ./
         with:
+          cache: false
           post-cleanup: ${{ matrix.post-cleanup }}
 
   post-cleanup-windows:
@@ -276,10 +575,10 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/default/* .
-      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe
+      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
         with:
           run: |
             set -euxo pipefail
@@ -288,36 +587,90 @@ jobs:
             ${{ matrix.post-cleanup == 'true' && '! ' || '' }}test -f ~/.pixi/bin/pixi
       - uses: ./
         with:
+          cache: false
           post-cleanup: ${{ matrix.post-cleanup }}
-    
+
   no-lockfile:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi.toml
         run: mv test/no-lockfile/* .
       - uses: ./
+        with:
+          cache: false
       - run: |
           set -o pipefail
           pixi info
-          test -f .pixi/env/bin/python
-          ./.pixi/env/bin/python --version | grep -q 3.11
+          test -f .pixi/envs/default/bin/python
+          ./.pixi/envs/default/bin/python --version | grep -q 3.11
         shell: bash
         if: matrix.os != 'windows-latest'
       - run: |
           set -o pipefail
           pixi info
-          test -f .pixi/env/python.exe
-          ./.pixi/env/python.exe --version | grep -q 3.11
+          test -f .pixi/envs/default/python.exe
+          ./.pixi/envs/default/python.exe --version | grep -q 3.11
         shell: bash
         if: matrix.os == 'windows-latest'
       - run: |
           pixi run python --version | grep -q 3.11
           pixi run test | grep -q "Hello world"
 
+  multiple-environments:
+    name: multiple-environments (${{ matrix.os }}, cache=${{ matrix.cache }})
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        cache: ['true', 'false']
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/multiple-environments/* .
+      - uses: ./
+        with:
+          environments: py311 py312
+          cache: ${{ matrix.cache }}
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/py311/bin/python
+          test -f .pixi/envs/py312/bin/python
+          ! test -d .pixi/envs/default
+          ./.pixi/envs/py311/bin/python --version | grep -q 3.11
+          ./.pixi/envs/py312/bin/python --version | grep -q 3.12
+        shell: bash
+        if: matrix.os != 'windows-latest'
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/py311/python.exe
+          test -f .pixi/envs/py312/python.exe
+          ! test -d .pixi/envs/default
+          ./.pixi/envs/py311/python.exe --version | grep -q 3.11
+          ./.pixi/envs/py312/python.exe --version | grep -q 3.12
+        shell: bash
+        if: matrix.os == 'windows-latest'
+
+  cache-write-true:
+    timeout-minutes: 10
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi files
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          cache-write: true
+
   test-cache1:
     name: Test cache 1/2
     timeout-minutes: 10
@@ -325,9 +678,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest]
+        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -336,10 +689,10 @@ jobs:
           cache-key: test-cache-${{ github.sha }}-${{ github.run_attempt }}-
       # check the action logs to see if the cache was written
       - run: |
-          test -f .pixi/env/bin/python
+          test -f .pixi/envs/default/bin/python
         if: matrix.os != 'windows-latest'
       - run: |
-          test -f .pixi/env/python.exe
+          test -f .pixi/envs/default/python.exe
         if: matrix.os == 'windows-latest'
 
   test-cache2:
@@ -350,9 +703,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest]
+        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -361,10 +714,10 @@ jobs:
           cache-key: test-cache-${{ github.sha }}-${{ github.run_attempt }}-
       # check the action logs to see if the cache was restored
       - run: |
-          test -f .pixi/env/bin/python
+          test -f .pixi/envs/default/bin/python
         if: matrix.os != 'windows-latest'
       - run: |
-          test -f .pixi/env/python.exe
+          test -f .pixi/envs/default/python.exe
         if: matrix.os == 'windows-latest'
 
   test-cache-no-write:
@@ -374,9 +727,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest]
+        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -386,6 +739,136 @@ jobs:
           cache-key: test-cache-${{ github.sha }}-${{ github.run_attempt }}-
       # check the action logs to see if the cache write was skipped
 
+  pyproject:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi files
+        run: mv test/pyproject-manifest/* .
+      - uses: ./
+      - run: test -f .pixi/envs/default/bin/python
+      - run: pixi run test
+
+  custom-pyproject-manifest-path:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./
+        with:
+          cache: true
+          manifest-path: test/pyproject-manifest/pyproject.toml
+
+  environment-activation-unix:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          activate-environment: true
+      - run: which python | grep '.pixi/envs/default/bin/python'
+      - run: env | grep CONDA_PREFIX
+      - run: '[[ $PIXI_ENVIRONMENT_NAME = "default" ]]'
+
+  environment-activation-windows-bash:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          activate-environment: true
+      - run: which python | grep '.pixi/envs/default/python'
+      - run: env | grep CONDA_PREFIX
+      - run: '[[ $PIXI_ENVIRONMENT_NAME = "default" ]]'
+
+  environment-activation-windows-pwsh:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          activate-environment: true
+      - run: if (-Not (Get-Command python).Path -like '*\.pixi\envs\default\python') { exit 1 }
+      - run: if (!$env:CONDA_PREFIX) { exit 1 }
+      - run: if ($env:PIXI_ENVIRONMENT_NAME -ne "default") { exit 1 }
+
+  environment-activation-windows-cmd:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: cmd
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          activate-environment: true
+      - run: where python | findstr "\.pixi\\envs\\default\\python.exe"
+      - run: set | findstr CONDA_PREFIX
+      - run: |
+          if defined PIXI_ENVIRONMENT_NAME (
+            if "%PIXI_ENVIRONMENT_NAME%" NEQ "default" (
+              exit 1
+            )
+          )
+
+  environment-activation-false:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          activate-environment: false
+      - run: '[[ $PIXI_ENVIRONMENT_NAME = "" ]]'
+
+  environment-activation-explicit-env:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/multiple-environments/* .
+      - uses: ./
+        with:
+          environments: py311
+          activate-environment: true
+      - run: which python | grep '.pixi/envs/py311/bin/python'
+      - run: '[[ $PIXI_ENVIRONMENT_NAME = "py311" ]]'
+
+  environment-activation-multiple-env:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Move pixi.toml
+        run: mv test/multiple-environments/* .
+      - uses: ./
+        with:
+          environments: >-
+            py311 py312
+          activate-environment: py311
+      - run: which python | grep '.pixi/envs/py311/bin/python'
+      - run: '[[ $PIXI_ENVIRONMENT_NAME = "py311" ]]'
+
   # not properly testable
   # https://github.com/actions/runner/issues/2347
   # https://github.com/orgs/community/discussions/15452
@@ -396,7 +879,7 @@ jobs:
   #     matrix:
   #       os: [windows-latest, ubuntu-latest, macos-latest]
   #   steps:
-  #     - uses: actions/checkout@v4
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
   #     - name: Move pixi files
   #       run: mv test/no-lockfile/* .
   #     - uses: ./
@@ -405,3 +888,99 @@ jobs:
   #         cache-key: test-cache-no-lockfile-${{ github.sha }}-${{ github.run_attempt }}-
   #     - run: exit 1
   #       if: success()
+
+  # test-incorrect-version:
+  #   runs-on: ${{ matrix.os }}
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       os: [windows-latest, ubuntu-latest, macos-latest]
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #     - name: Move pixi files
+  #       run: mv test/default/* .
+  #     - uses: ./
+  #       with:
+  #         pixi-version: 0.1.0
+  #     - run: exit 1
+  #       if: success()
+
+  # test-frozen-and-locked:
+  #   runs-on: ${{ matrix.os }}
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       os: [windows-latest, ubuntu-latest, macos-latest]
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #     - name: Move pixi files
+  #       run: mv test/default/* .
+  #     - uses: ./
+  #       with:
+  #         pixi-version: v0.5.0
+  #         frozen: true
+  #         locked: true
+  #     - run: exit 1
+  #       if: success()
+
+  # test-frozen-no-lockfile:
+  #   runs-on: ${{ matrix.os }}
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       os: [windows-latest, ubuntu-latest, macos-latest]
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #     - name: Move pixi files
+  #       run: mv test/no-lockfile/* .
+  #     - uses: ./
+  #       with:
+  #         frozen: true
+  #     - run: exit 1
+  #       if: success()
+
+  # test-locked-no-lockfile:
+  #   runs-on: ${{ matrix.os }}
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       os: [windows-latest, ubuntu-latest, macos-latest]
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #     - name: Move pixi files
+  #       run: mv test/no-lockfile/* .
+  #     - uses: ./
+  #       with:
+  #         locked: true
+  #     - run: exit 1
+  #       if: success()
+
+  # test-lockfile-not-up-to-date:
+  #   runs-on: ${{ matrix.os }}
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       os: [windows-latest, ubuntu-latest, macos-latest]
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #     - name: Move pixi files
+  #       run: mv test/lockfile-not-up-to-date/* .
+  #     - uses: ./
+  #       # locked: true is implicit
+  #     - run: exit 1
+  #       if: success()
+
+  # cache-write-true-no-lockfile:
+  #   timeout-minutes: 10
+  #   runs-on: ${{ matrix.os }}
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       os: [windows-latest, ubuntu-latest, macos-latest]
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #     - name: Move pixi files
+  #       run: mv test/no-lockfile/* .
+  #     - uses: ./
+  #       with:
+  #         cache-write: true

.gitignore

@@ -97,3 +97,9 @@ Thumbs.db
 # Ignore built ts files
 __tests__/runner/*
 lib/**/*
+
+# Ignore jetbrains files
+.idea
+
+# ESBuild metafile
+metafile*.json

.prettierignore

@@ -0,0 +1,2 @@
+dist
+pnpm-lock.yaml

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "editor.defaultFormatter": "esbenp.prettier-vscode"
+}

README.md

@@ -1,15 +1,32 @@
-# setup-pixi 📦
+<h1 align="center">
 
-[![CI](https://github.com/pavelzw/setup-pixi/actions/workflows/test.yml/badge.svg)](https://github.com/pavelzw/setup-pixi/actions/workflows/test.yml)
+[![License][license-badge]][license]
+[![CI][build-badge]][build]
+[![Latest release][latest-release-badge]][releases]
+[![Project Chat][chat-badge]][chat-url]
+
+[license-badge]: https://img.shields.io/github/license/prefix-dev/setup-pixi?style=flat-square
+[license]: ./LICENSE
+[build-badge]: https://img.shields.io/github/actions/workflow/status/prefix-dev/setup-pixi/test.yml?style=flat-square
+[build]: https://github.com/prefix-dev/setup-pixi/actions/
+[latest-release-badge]: https://img.shields.io/github/v/tag/prefix-dev/setup-pixi?style=flat-square&label=latest&sort=semver
+[releases]: https://github.com/prefix-dev/setup-pixi/releases
+[chat-badge]: https://img.shields.io/discord/1082332781146800168.svg?label=&logo=discord&logoColor=ffffff&color=7389D8&labelColor=6A7EC2&style=flat-square
+[chat-url]: https://discord.gg/kKV8ZxyzY4
+
+</h1>
+
+# setup-pixi 📦
 
 GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package manager.
 
 ## Usage
 
 ```yml
-- uses: pavelzw/setup-pixi@v0.2.0
+- uses: prefix-dev/setup-pixi@v0.8.3
   with:
-    pixi-version: '0.2.0'
+    pixi-version: v0.41.4
+
     cache: true
     auth-host: prefix.dev
     auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -18,8 +35,23 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 
 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `pavelzw/setup-pixi@v0.2.0`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.8.3`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
+>
+> Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
+>
+> ```yml
+> version: 2
+> updates:
+>   - package-ecosystem: github-actions
+>     directory: /
+>     schedule:
+>       interval: monthly # or daily, weekly
+>     groups:
+>       dependencies:
+>         patterns:
+>           - '*'
+> ```
 
 ## Features
 
@@ -27,13 +59,90 @@ To see all available input arguments, see the [`action.yml`](action.yml) file.
 
 ### Caching
 
-The action supports caching of the pixi environment. To enable caching, set `cache: true`.
+The action supports caching of the pixi environment.
+By default, caching is enabled if a `pixi.lock` file is present.
 It will then use the `pixi.lock` file to generate a hash of the environment and cache it.
 If the cache is hit, the action will skip the installation and use the cached environment.
+You can specify the behavior by setting the `cache` input argument.
 
 If you need to customize your cache-key, you can use the `cache-key` input argument.
 This will be the prefix of the cache key. The full cache key will be `<cache-key><conda-arch>-<hash>`.
 
+#### Only save caches on `main`
+
+In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy) as fast, you might want to restrict when the cache is saved.
+This can be done by setting the `cache-write` argument.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.8.3
+  with:
+    cache: true
+    cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+```
+
+### Multiple environments
+
+With pixi, you can create multiple environments for different requirements.
+You can also specify which environment(s) you want to install by setting the `environments` input argument.
+This will install all environments that are specified and cache them.
+
+```toml
+[project]
+name = "my-package"
+channels = ["conda-forge"]
+platforms = ["linux-64"]
+
+[dependencies]
+python = ">=3.11"
+pip = "*"
+polars = ">=0.14.24,<0.21"
+
+[feature.py311.dependencies]
+python = "3.11.*"
+[feature.py312.dependencies]
+python = "3.12.*"
+
+[environments]
+py311 = ["py311"]
+py312 = ["py312"]
+```
+
+#### Multiple environments using a matrix
+
+The following example will install the `py311` and `py312` environments in different jobs.
+
+```yml
+test:
+  runs-on: ubuntu-latest
+  strategy:
+    matrix:
+      environment: [py311, py312]
+  steps:
+    - uses: actions/checkout@v4
+    - uses: prefix-dev/setup-pixi@v0.8.3
+      with:
+        environments: ${{ matrix.environment }}
+```
+
+#### Install multiple environments in one job
+
+The following example will install both the `py311` and the `py312` environment on the runner.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.8.3
+  with:
+    # separated by spaces
+    environments: >-
+      py311
+      py312
+- run: |
+    pixi run -e py311 test
+    pixi run -e py312 test
+```
+
+> [!WARNING]
+> If you don't specify any environment, the `default` environment will be installed and cached, even if you use other environments.
+
 ### Authentication
 
 There are currently three ways to authenticate with pixi:
@@ -41,6 +150,7 @@ There are currently three ways to authenticate with pixi:
 - using a token
 - using a username and password
 - using a conda-token
+- using an S3 key pair
 
 For more information, see the [pixi documentation](https://prefix.dev/docs/pixi/authentication).
 
@@ -55,7 +165,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).
 
 ```yml
-- uses: pavelzw/setup-pixi@v0.2.0
+- uses: prefix-dev/setup-pixi@v0.8.3
   with:
     auth-host: prefix.dev
     auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -67,7 +177,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.
 
 ```yml
-- uses: pavelzw/setup-pixi@v0.2.0
+- uses: prefix-dev/setup-pixi@v0.8.3
   with:
     auth-host: custom-artifactory.com
     auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -76,29 +186,46 @@ This form of authentication (HTTP Basic Auth) is used in some enterprise environ
 
 #### Conda-token
 
-Specify the conda-token using the `conda-token` input argument.
+Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).
 
 ```yml
-- uses: pavelzw/setup-pixi@v0.2.0
+- uses: prefix-dev/setup-pixi@v0.8.3
   with:
     auth-host: anaconda.org # or my-quetz-instance.com
-    conda-token: ${{ secrets.CONDA_TOKEN }}
+    auth-conda-token: ${{ secrets.CONDA_TOKEN }}
 ```
 
+#### S3
+
+Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-key` input arguments.
+You can also specify the session token using the `auth-session-token` input argument.
+
+```yaml
+- uses: prefix-dev/setup-pixi@v0.8.3
+  with:
+    auth-host: s3://my-s3-bucket
+    auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
+    auth-s3-secret-access-key: ${{ secrets.SECRET_ACCESS_KEY }}
+    # only needed if your key uses a session token
+    auth-s3-session-token: ${{ secrets.SESSION_TOKEN }}
+```
+
+See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.
+
 ### Custom shell wrapper
 
-`setup-pixi` allows you to run command inside of the pixi environment by specifying a custom shell wrapper with `shell: pixi run bash {0}`.
+`setup-pixi` allows you to run command inside of the pixi environment by specifying a custom shell wrapper with `shell: pixi run bash -e {0}`.
 This can be useful if you want to run commands inside of the pixi environment, but don't want to use the `pixi run` command for each command.
 
 ```yml
 - run: | # everything here will be run inside of the pixi environment
     python --version
-    pip install -e --no-deps .
-  shell: pixi run bash {0}
+    pip install --no-deps -e .
+  shell: pixi run bash -e {0}
 ```
 
-You can even run python scripts like this:
+You can even run Python scripts like this:
 
 ```yml
 - run: | # everything here will be run inside of the pixi environment
@@ -107,11 +234,80 @@ You can even run python scripts like this:
   shell: pixi run python {0}
 ```
 
+If you want to use PowerShell, you need to specify `-Command` as well.
+
+```yml
+- run: | # everything here will be run inside of the pixi environment
+    python --version | Select-String "3.11"
+  shell: pixi run pwsh -Command {0} # pwsh works on all platforms
+```
+
 > [!NOTE]
 > Under the hood, the `shell: xyz {0}` option is implemented by creating a temporary script file and calling `xyz` with that script file as an argument.
 > This file does not have the executable bit set, so you cannot use `shell: pixi run {0}` directly but instead have to use `shell: pixi run bash {0}`.
+> There are some custom shells provided by GitHub that have slightly different behavior, see [`jobs.<job_id>.steps[*].shell`](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell) in the documentation.
 > See the [official documentation](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#custom-shell) and [ADR 0277](https://github.com/actions/runner/blob/main/docs/adrs/0277-run-action-shell-options.md) for more information about how the `shell:` input works in GitHub Actions.
 
+#### One-off shell wrapper using `pixi exec`
+
+With `pixi exec`, you can also run a one-off command inside a temporary pixi environment.
+
+```yml
+- run: | # everything here will be run inside of the temporary pixi environment
+    zstd --version
+  shell: pixi exec --spec zstd -- bash -e {0}
+```
+
+```yml
+- run: | # everything here will be run inside of the temporary pixi environment
+    import ruamel.yaml
+    # ...
+  shell: pixi exec --spec python=3.11.* --spec ruamel.yaml -- python {0}
+```
+
+See [here](https://pixi.sh/latest/reference/cli#exec) for more information about `pixi exec`.
+
+### Environment activation
+
+Instead of using a custom shell wrapper, you can also make all pixi-installed binaries available to subsequent steps by "activating" the installed environment in the currently running job.
+To this end, `setup-pixi` adds all environment variables set when executing `pixi run` to `$GITHUB_ENV` and, similarly, adds all path modifications to `$GITHUB_PATH`.
+As a result, all installed binaries can be accessed without having to call `pixi run`.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.8.3
+  with:
+    activate-environment: true
+```
+
+If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.8.3
+  with:
+    environments: >-
+      py311
+      py312
+    activate-environment: py311
+```
+
+Activating an environment may be more useful than using a custom shell wrapper as it allows non-shell based steps to access binaries on the path.
+However, be aware that this option augments the environment of your job.
+
+### `--frozen` and `--locked`
+
+You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi install --locked` depending on the `frozen` or the `locked` input argument.
+See the [official documentation](https://prefix.dev/docs/pixi/cli#install) for more information about the `--frozen` and `--locked` flags.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.8.3
+  with:
+    locked: true
+    # or
+    frozen: true
+```
+
+If you don't specify anything, the default behavior is to run `pixi install --locked` if a `pixi.lock` file is present and `pixi install` otherwise.
+
 ### Debugging
 
 There are two types of debug logging that you can enable.
@@ -122,7 +318,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.
 
 ```yml
-- uses: pavelzw/setup-pixi@v0.2.0
+- uses: prefix-dev/setup-pixi@v0.8.3
   env:
     RUNNER_DEBUG: true
 ```
@@ -140,17 +336,17 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.
 
 ```yml
-- uses: pavelzw/setup-pixi@v0.2.0
+- uses: prefix-dev/setup-pixi@v0.8.3
   with:
     # one of `q`, `default`, `v`, `vv`, or `vvv`.
     log-level: vvv
 ```
 
-If nothing is specified, `setup-pixi` will default to `default` or `vv` depending on if [debug logging is enabled for the action](#debug-logging-of-the-action).
+If nothing is specified, `log-level` will default to `default` or `vv` depending on if [debug logging is enabled for the action](#debug-logging-of-the-action).
 
-### Post action cleanup
+### Self-hosted runners
 
-On self hosted runners, it may happen that some files are persisted between jobs.
+On self-hosted runners, it may happen that some files are persisted between jobs.
 This can lead to problems or secrets getting leaked between job runs.
 To avoid this, you can use the `post-cleanup` input to specify the post cleanup behavior of the action (i.e., what happens _after_ all your commands have been executed).
 
@@ -161,12 +357,30 @@ If you set `post-cleanup` to `true`, the action will delete the following files:
 - the rattler cache
 - other rattler files in `~/.rattler`
 
-If nothing is specified, `setup-pixi` will default to `true`.
+If nothing is specified, `post-cleanup` will default to `true`.
+
+On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.
 
 ```yml
-- uses: pavelzw/setup-pixi@v0.2.0
+- uses: prefix-dev/setup-pixi@v0.8.3
   with:
-    post-cleanup: false
+    post-cleanup: true
+    # ${{ runner.temp }}\Scripts\pixi.exe on Windows
+    pixi-bin-path: ${{ runner.temp }}/bin/pixi
+```
+
+You can also use a preinstalled local version of pixi on the runner by not setting any of the `pixi-version`,
+`pixi-url` or `pixi-bin-path` inputs. This action will then try to find a local version of pixi in the runner's PATH.
+
+### Using the `pyproject.toml` as a manifest file for pixi.
+
+`setup-pixi` will automatically pick up the `pyproject.toml` if it contains a `[tool.pixi.project]` section and no `pixi.toml`.
+This can be overwritten by setting the `manifest-path` input argument.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.8.3
+  with:
+    manifest-path: pyproject.toml
 ```
 
 ## More examples
@@ -176,6 +390,6 @@ If you want to see more examples, you can take a look at the [GitHub Workflows o
 ## Local Development
 
 1. Clone this repository.
-1. Run `pnpm install` inside the repository (if you don't have [`pnpm`](https://github.com/pnpm/pnpm) installed, you can install it with `npm install -g pnpm` or `brew install pnpm`).
-1. Run `pnpm dev` for live transpilation of the TypeScript source code.
-1. To test the action, you can run [`act`](https://github.com/nektos/act) (inside docker) or use :sparkles: CI driven development :sparkles:.
+2. Run `pnpm install` inside the repository (if you don't have [`pnpm`](https://github.com/pnpm/pnpm) installed, you can install it with `pixi global install pnpm`).
+3. Run `pnpm dev` for live transpilation of the TypeScript source code.
+4. To test the action, you can run [`act`](https://github.com/nektos/act) (inside docker) or use :sparkles: CI driven development :sparkles:.

action.yml

@@ -17,7 +17,19 @@ inputs:
   manifest-path:
     description: Path to the manifest file (i.e., `pixi.toml`) to use for the pixi CLI. Defaults to `pixi.toml`.
   run-install:
-    description: Whether to run `pixi install` after setting up the environment. Defaults to `true`.
+    description: Whether to run `pixi install` after installing pixi. Defaults to `true`.
+  environments:
+    description: |
+      A space-separated list of environments to install. If not specified, only the default environment is installed.
+  activate-environment:
+    description: |
+      If the installed environment should be "activated" for the current job, modifying `$GITHUB_ENV` and
+      `$GITHUB_PATH`. If more than one environment is specified in `environments`, this must be the name of the
+      environment. Defaults to `false`. Requires at least pixi v0.21.0.
+  locked:
+    description: Whether to use `pixi install --locked`. Defaults to `true` when the lockfile is present, otherwise `false`.
+  frozen:
+    description: Whether to use `pixi install --frozen`. Defaults to `false`.
   cache:
     description: Whether to cache the pixi environment. Defaults to `true`. Only works if `pixi.lock` is present.
   cache-key:
@@ -43,6 +55,12 @@ inputs:
     description: Password to use for authentication.
   auth-conda-token:
     description: Conda token to use for authentication.
+  auth-s3-access-key-id:
+    description: Access key ID to use for S3 authentication.
+  auth-s3-secret-access-key:
+    description: Secret access key to use for S3 authentication.
+  auth-s3-session-token:
+    description: Session token to use for S3 authentication.
   post-cleanup:
     description: |
       If the action should clean up after itself. Defaults to `true`.

eslint.config.mjs

@@ -0,0 +1,42 @@
+// @ts-check
+
+import eslint from '@eslint/js'
+import tseslint from 'typescript-eslint'
+
+export default tseslint.config(
+  eslint.configs.recommended,
+  ...tseslint.configs.strictTypeChecked,
+  ...tseslint.configs.stylisticTypeChecked,
+  {
+    ignores: ['dist/*']
+  },
+  {
+    languageOptions: {
+      parserOptions: {
+        project: true,
+        tsconfigRootDir: import.meta.dirname
+      }
+    }
+  },
+  {
+    rules: {
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_'
+        }
+      ],
+      '@typescript-eslint/prefer-nullish-coalescing': [
+        'error',
+        {
+          ignoreConditionalTests: true
+        }
+      ]
+    }
+  },
+  // disable type checking for config files as they aren't in the TS root
+  {
+    files: ['eslint.config.mjs', 'prettier.config.mjs', 'tsup.config.js'],
+    ...tseslint.configs.disableTypeChecked
+  }
+)

package.json

@@ -1,12 +1,14 @@
 {
   "name": "setup-pixi",
-  "version": "0.2.0",
+  "version": "0.8.3",
   "private": true,
   "description": "Action to set up the pixi package manager.",
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "lint": "eslint ./src --ext ts"
+    "eslint": "eslint .",
+    "lint": "pnpm eslint && prettier -c .",
+    "lint:fix": "eslint . --fix && prettier -w ."
   },
   "repository": {
     "type": "git",
@@ -20,27 +22,25 @@
   "author": "Pavel Zwerschke <pavelzw@gmail.com>",
   "license": "BSD-3-Clause",
   "dependencies": {
-    "@actions/cache": "^3.2.2",
-    "@actions/core": "^1.10.0",
+    "@actions/cache": "^4.0.0",
+    "@actions/core": "^1.11.1",
     "@actions/exec": "^1.1.1",
     "@actions/io": "^1.1.3",
-    "@actions/tool-cache": "^2.0.1",
+    "@actions/tool-cache": "^2.0.2",
+    "@iarna/toml": "^2.2.5",
     "untildify": "^5.0.0",
-    "zod": "^3.22.2"
+    "which": "^5.0.0",
+    "zod": "^3.24.1"
   },
   "devDependencies": {
-    "@types/node": "^20.5.9",
-    "@typescript-eslint/eslint-plugin": "^6.5.0",
-    "@typescript-eslint/parser": "^6.5.0",
-    "eslint": "^8.48.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.28.1",
-    "eslint-plugin-n": "^16.0.2",
-    "eslint-plugin-prettier": "^5.0.0",
-    "eslint-plugin-promise": "^6.1.1",
-    "prettier": "^3.0.3",
-    "tsup": "^7.2.0",
-    "typescript": "^5.2.2"
+    "@eslint/js": "^9.19.0",
+    "@types/eslint__js": "^8.42.3",
+    "@types/node": "^22.13.0",
+    "@types/which": "^3.0.4",
+    "eslint": "^9.19.0",
+    "prettier": "^3.4.2",
+    "tsup": "^8.3.6",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.22.0"
   }
 }

prettier.config.mjs

@@ -0,0 +1,9 @@
+const config = {
+  tabWidth: 2,
+  printWidth: 120,
+  singleQuote: true,
+  trailingComma: 'none',
+  semi: false
+}
+
+export default config

src/activate.ts

@@ -0,0 +1,70 @@
+import os from 'os'
+import * as osPath from 'path'
+import * as core from '@actions/core'
+import { executeGetOutput, pixiCmd } from './util'
+
+interface ShellHook {
+  environment_variables: Record<string, string>
+}
+
+const splitEnvironment = (shellHook: ShellHook): [Record<string, string>, string?] => {
+  if (os.platform() === 'win32') {
+    // On Windows, environment variables are case-insensitive but JSON isn't...
+    const pathEnvs = Object.keys(shellHook.environment_variables).filter((k) => k.toUpperCase() === 'PATH')
+    if (pathEnvs.length > 0) {
+      const caseSensitivePathName = pathEnvs[0]
+      const path = shellHook.environment_variables[caseSensitivePathName]
+      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+      delete shellHook.environment_variables[caseSensitivePathName]
+      return [shellHook.environment_variables, path]
+    }
+  } else {
+    if ('PATH' in shellHook.environment_variables) {
+      const path = shellHook.environment_variables.PATH
+      delete shellHook.environment_variables.PATH
+      return [shellHook.environment_variables, path]
+    }
+  }
+
+  // If the path cannot be found, return all other environment variables
+  return [shellHook.environment_variables]
+}
+
+const getNewPathComponents = (path: string): string[] => {
+  const currentPath = process.env.PATH
+  if (!currentPath) {
+    throw new Error('Unable to obtain current PATH from environment')
+  }
+  if (!path.endsWith(currentPath)) {
+    throw new Error('Unable to handle environment activation which does not only append to PATH')
+  }
+  core.debug(`Found current path '${currentPath}'`)
+  core.debug(`Got new path '${path}'`)
+  const newPath = path.slice(0, path.length - currentPath.length)
+  return newPath.split(osPath.delimiter).filter((p) => p.length > 0)
+}
+
+export const activateEnvironment = async (environment: string): Promise<void> => {
+  // First, obtain the environment variables that would be set by environment activation
+  const envOption = environment === 'default' ? '' : `-e ${environment}`
+  const shellHookOutput = await executeGetOutput(pixiCmd(`shell-hook ${envOption} --json`), { silent: true })
+  const shellHook = JSON.parse(shellHookOutput.stdout) as ShellHook
+
+  // Then, we split the environment variables into the special 'PATH' and all others
+  const [envVars, path] = splitEnvironment(shellHook)
+
+  // Finally, new path components are added...
+  if (path) {
+    const newComponents = getNewPathComponents(path)
+    for (const component of newComponents) {
+      core.info(`Adding path component '${component}'`)
+      core.addPath(component)
+    }
+  }
+
+  // ... as well as all remaining environment variables
+  for (const key of Object.keys(envVars)) {
+    core.info(`Exporting environment variable '${key}=${envVars[key]}'`)
+    core.exportVariable(key, envVars[key])
+  }
+}

src/cache.ts

@@ -6,10 +6,27 @@ import { options } from './options'
 import { getCondaArch, sha256 } from './util'
 
 export const generateCacheKey = async (cacheKeyPrefix: string) =>
-  fs
-    .readFile(options.pixiLockFile, 'utf-8')
-    .then((content) => `${cacheKeyPrefix}${getCondaArch()}-${sha256(content)}`)
-    .catch((err) => {
+  Promise.all([fs.readFile(options.pixiLockFile), fs.readFile(options.pixiBinPath)])
+    .then(([lockfileContent, pixiBinary]) => {
+      const lockfileSha = sha256(lockfileContent)
+      core.debug(`lockfileSha: ${lockfileSha}`)
+      const pixiSha = sha256(pixiBinary)
+      core.debug(`pixiSha: ${pixiSha}`)
+      // the path to the lock file decides where the pixi env is created (../.pixi/env)
+      // since conda envs are not relocatable, we need to include the path in the cache key
+      const lockfilePathSha = sha256(options.pixiLockFile)
+      core.debug(`lockfilePathSha: ${lockfilePathSha}`)
+      const environments = sha256(options.environments?.join(' ') ?? '')
+      core.debug(`environments: ${environments}`)
+      // since the lockfile path is not necessarily absolute, we need to include the cwd in the cache key
+      const cwdSha = sha256(process.cwd())
+      core.debug(`cwdSha: ${cwdSha}`)
+      const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
+      core.debug(`sha: ${sha}`)
+      return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
+    })
+    .catch((err: unknown) => {
+      // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Failed to generate cache key: ${err}`)
     })
 
@@ -42,7 +59,7 @@ export const tryRestoreCache = (): Promise<string | undefined> => {
 
 export const saveCache = () => {
   const cache_ = options.cache
-  if (!cache_ || !cache_.cacheWrite) {
+  if (!cache_?.cacheWrite) {
     core.debug('Skipping pixi cache save.')
     return Promise.resolve(undefined)
   }
@@ -55,10 +72,11 @@ export const saveCache = () => {
       cache
         .saveCache([cachePath], cacheKey, undefined, false)
         .then((cacheId) => {
-          core.info(`Saved cache with ID \`${cacheId}\``)
+          core.info(`Saved cache with ID "${cacheId.toString()}"`)
         })
-        .catch((err) => {
-          core.error(`Error saving cache: ${err.message}`)
+        .catch((err: unknown) => {
+          // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+          core.error(`Error saving cache: ${err}`)
         })
     )
   )

src/main.ts

@@ -1,12 +1,14 @@
 import fs from 'fs/promises'
 import os from 'os'
 import path from 'path'
+import { exit } from 'process'
 import * as core from '@actions/core'
 import { downloadTool } from '@actions/tool-cache'
 import type { PixiSource } from './options'
 import { options } from './options'
 import { execute, getPixiUrlFromVersion, pixiCmd } from './util'
 import { saveCache, tryRestoreCache } from './cache'
+import { activateEnvironment } from './activate'
 
 const downloadPixi = (source: PixiSource) => {
   const url = 'version' in source ? getPixiUrlFromVersion(source.version) : source.url
@@ -17,7 +19,9 @@ const downloadPixi = (source: PixiSource) => {
       .mkdir(path.dirname(options.pixiBinPath), { recursive: true })
       .then(() => downloadTool(url, options.pixiBinPath))
       .then((_downloadPath) => fs.chmod(options.pixiBinPath, 0o755))
-      .then(() => core.info(`Pixi installed to ${options.pixiBinPath}`))
+      .then(() => {
+        core.info(`Pixi installed to ${options.pixiBinPath}`)
+      })
   })
 }
 
@@ -27,7 +31,7 @@ const pixiLogin = () => {
     core.debug('Skipping pixi login.')
     return Promise.resolve(0)
   }
-  core.debug(`auth keys: ${Object.keys(auth)}`)
+  core.debug(`auth keys: ${Object.keys(auth).toString()}`)
   return core.group('Logging in to private channel', () => {
     // tokens get censored in the logs as long as they are a github secret
     if ('token' in auth) {
@@ -38,6 +42,13 @@ const pixiLogin = () => {
       core.debug(`Logging in to ${auth.host} with username and password`)
       return execute(pixiCmd(`auth login --username ${auth.username} --password ${auth.password} ${auth.host}`, false))
     }
+    if ('s3AccessKeyId' in auth) {
+      core.debug(`Logging in to ${auth.host} with s3 credentials`)
+      const command = auth.s3SessionToken
+        ? `auth login --s3-access-key-id ${auth.s3AccessKeyId} --s3-secret-access-key ${auth.s3SecretAccessKey} --s3-session-token ${auth.s3SessionToken} ${auth.host}`
+        : `auth login --s3-access-key-id ${auth.s3AccessKeyId} --s3-secret-access-key ${auth.s3SecretAccessKey} ${auth.host}`
+      return execute(pixiCmd(command, false))
+    }
     core.debug(`Logging in to ${auth.host} with conda token`)
     return execute(pixiCmd(`auth login --conda-token ${auth.condaToken} ${auth.host}`, false))
   })
@@ -53,20 +64,92 @@ const pixiInstall = async () => {
     return Promise.resolve()
   }
   return tryRestoreCache()
-    .then((_cacheKey) => execute(pixiCmd('install')))
+    .then(async (_cacheKey) => {
+      if (options.environments) {
+        for (const environment of options.environments) {
+          core.debug(`Installing environment ${environment}`)
+          const command = `install -e ${environment}${options.frozen ? ' --frozen' : ''}${
+            options.locked ? ' --locked' : ''
+          }`
+          await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
+        }
+      } else {
+        const command = `install${options.frozen ? ' --frozen' : ''}${options.locked ? ' --locked' : ''}`
+        return core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
+      }
+    })
     .then(saveCache)
 }
 
+const generateList = async () => {
+  if (!options.runInstall) {
+    core.debug('Skipping pixi list.')
+    return Promise.resolve()
+  }
+  if (
+    'version' in options.pixiSource &&
+    options.pixiSource.version !== 'latest' &&
+    options.pixiSource.version < 'v0.13.0'
+  ) {
+    core.warning(
+      'pixi list is not supported for pixi versions < `v0.13.0`. Please set `pixi-version` to `v0.13.0` or later.'
+    )
+    return Promise.resolve()
+  }
+  let command = 'list'
+  if (
+    'version' in options.pixiSource &&
+    options.pixiSource.version !== 'latest' &&
+    options.pixiSource.version < 'v0.14.0'
+  ) {
+    if (options.frozen) core.warning('pixi versions < `v0.14.0` do not support the --frozen option for pixi list.')
+    if (options.locked) core.warning('pixi versions < `v0.14.0` do not support the --locked option for pixi list.')
+  } else {
+    command = `${command}${options.frozen ? ' --frozen' : ''}${options.locked ? ' --locked' : ''}`
+  }
+  if (options.environments) {
+    for (const environment of options.environments) {
+      core.debug(`Listing environment ${environment}`)
+      await core.group(`pixi ${command} -e ${environment}`, () => execute(pixiCmd(`${command} -e ${environment}`)))
+    }
+    return Promise.resolve()
+  } else {
+    return core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
+  }
+}
+
 const generateInfo = () => core.group('pixi info', () => execute(pixiCmd('info')))
 
+const activateEnv = (environment: string) => core.group('Activate environment', () => activateEnvironment(environment))
+
 const run = async () => {
-  core.debug(`process.env.HOME: ${process.env.HOME}`)
+  core.debug(`process.env.HOME: ${process.env.HOME ?? '-'}`)
   core.debug(`os.homedir(): ${os.homedir()}`)
-  await downloadPixi(options.pixiSource)
+  if (options.downloadPixi) {
+    await downloadPixi(options.pixiSource)
+  }
   addPixiToPath()
   await pixiLogin()
   await pixiInstall()
   await generateInfo()
+  await generateList()
+  if (options.activatedEnvironment) {
+    await activateEnv(options.activatedEnvironment)
+  }
 }
 
-run().catch((error) => core.setFailed(error.message))
+run()
+  .then(() => exit(0)) // workaround for https://github.com/actions/toolkit/issues/1578
+  .catch((error: unknown) => {
+    if (core.isDebug()) {
+      throw error
+    }
+    if (error instanceof Error) {
+      core.setFailed(error.message)
+      exit(1)
+    } else if (typeof error === 'string') {
+      core.setFailed(error)
+      exit(1)
+    }
+    throw error
+  })

src/options.ts

@@ -1,15 +1,23 @@
 import path from 'path'
 import os from 'os'
+import { exit } from 'process'
+import { existsSync, readFileSync } from 'fs'
 import * as core from '@actions/core'
 import * as z from 'zod'
 import untildify from 'untildify'
+import { parse } from '@iarna/toml'
+import which from 'which'
 
-type Inputs = {
+type Inputs = Readonly<{
   pixiVersion?: string
   pixiUrl?: string
   logLevel?: LogLevel
   manifestPath?: string
   runInstall?: boolean
+  environments?: string[]
+  activateEnvironment?: string
+  frozen?: boolean
+  locked?: boolean
   cache?: boolean
   cacheKey?: string
   cacheWrite?: boolean
@@ -19,8 +27,11 @@ type Inputs = {
   authUsername?: string
   authPassword?: string
   authCondaToken?: string
+  authS3AccessKeyId?: string
+  authS3SecretAccessKey?: string
+  authS3SessionToken?: string
   postCleanup?: boolean
-}
+}>
 
 export type PixiSource =
   | {
@@ -43,25 +54,36 @@ type Auth = {
   | {
       condaToken: string
     }
+  | {
+      s3AccessKeyId: string
+      s3SecretAccessKey: string
+      s3SessionToken?: string
+    }
 )
 
-type Cache = {
+interface Cache {
   cacheKeyPrefix: string
   cacheWrite: boolean
 }
 
 export type Options = Readonly<{
   pixiSource: PixiSource
+  downloadPixi: boolean
   logLevel: LogLevel
   manifestPath: string
   pixiLockFile: string
   runInstall: boolean
+  environments?: string[]
+  frozen: boolean
+  locked: boolean
   cache?: Cache
   pixiBinPath: string
-  pixiRunShell: string
   auth?: Auth
   postCleanup: boolean
+  activatedEnvironment?: string
 }>
+const pixiPath = 'pixi.toml'
+const pyprojectPath = 'pyproject.toml'
 
 const logLevelSchema = z.enum(['q', 'default', 'v', 'vv', 'vvv'])
 export type LogLevel = z.infer<typeof logLevelSchema>
@@ -70,13 +92,20 @@ export const PATHS = {
   pixiBin: path.join(os.homedir(), '.pixi', 'bin', `pixi${os.platform() === 'win32' ? '.exe' : ''}`)
 }
 
-const parseOrUndefined = <T>(key: string, schema: z.ZodSchema<T>): T | undefined => {
+const parseOrUndefined = <T>(key: string, schema: z.ZodSchema<T>, errorMessage?: string): T | undefined => {
   const input = core.getInput(key)
   // GitHub actions sets empty inputs to the empty string, but we want undefined
   if (input === '') {
     return undefined
   }
-  return schema.parse(input)
+  const maybeResult = schema.safeParse(input)
+  if (!maybeResult.success) {
+    if (!errorMessage) {
+      throw new Error(`${key} is not valid: ${maybeResult.error.message}`)
+    }
+    throw new Error(errorMessage)
+  }
+  return maybeResult.data
 }
 
 const parseOrUndefinedJSON = <T>(key: string, schema: z.ZodSchema<T>): T | undefined => {
@@ -88,6 +117,18 @@ const parseOrUndefinedJSON = <T>(key: string, schema: z.ZodSchema<T>): T | undef
   return schema.parse(JSON.parse(input))
 }
 
+const parseOrUndefinedList = <T>(key: string, schema: z.ZodSchema<T>): T[] | undefined => {
+  const input = core.getInput(key)
+  // GitHub actions sets empty inputs to the empty string, but we want undefined
+  if (input === '') {
+    return undefined
+  }
+  return input
+    .split(' ')
+    .map((s) => schema.parse(s))
+    .filter((s) => s !== '')
+}
+
 const validateInputs = (inputs: Inputs): void => {
   if (inputs.pixiVersion && inputs.pixiUrl) {
     throw new Error('You need to specify either pixi-version or pixi-url')
@@ -98,29 +139,83 @@ const validateInputs = (inputs: Inputs): void => {
   if (inputs.runInstall === false && inputs.cache === true) {
     throw new Error('Cannot cache without running install')
   }
+  if (inputs.runInstall === false && inputs.frozen === true) {
+    throw new Error('Cannot use `frozen: true` when not running install')
+  }
+  if (inputs.runInstall === false && inputs.locked === true) {
+    throw new Error('Cannot use `locked: true` when not running install')
+  }
+  if (inputs.locked === true && inputs.frozen === true) {
+    throw new Error('Cannot use `locked: true` and `frozen: true` at the same time')
+  }
   if ((inputs.authUsername && !inputs.authPassword) || (!inputs.authUsername && inputs.authPassword)) {
     throw new Error('You need to specify both auth-username and auth-password')
   }
+  if (
+    (inputs.authS3AccessKeyId && !inputs.authS3SecretAccessKey) ||
+    (!inputs.authS3AccessKeyId && inputs.authS3SecretAccessKey)
+  ) {
+    throw new Error('You need to specify both auth-s3-access-key-id and auth-s3-secret-access-key')
+  }
+  if (inputs.authS3SessionToken && (!inputs.authS3AccessKeyId || !inputs.authS3SecretAccessKey)) {
+    throw new Error(
+      'You need to specify both auth-s3-access-key-id and auth-s3-secret-access-key when using auth-s3-session-token'
+    )
+  }
   // now we can assume that authUsername is defined iff authPassword is defined
   if (inputs.authHost) {
-    if (!inputs.authToken && !inputs.authUsername && !inputs.authCondaToken) {
+    if (!inputs.authToken && !inputs.authUsername && !inputs.authCondaToken && !inputs.authS3AccessKeyId) {
       throw new Error('You need to specify either auth-token or auth-username and auth-password or auth-conda-token')
     }
-    if (
-      (inputs.authToken && (inputs.authUsername || inputs.authCondaToken)) ||
-      (inputs.authUsername && inputs.authCondaToken)
-    ) {
-      throw new Error('You cannot specify two auth methods')
+    let authCount = 0
+    if (inputs.authToken) {
+      authCount++
+    }
+    if (inputs.authUsername) {
+      authCount++
+    }
+    if (inputs.authCondaToken) {
+      authCount++
+    }
+    if (inputs.authS3AccessKeyId) {
+      authCount++
+    }
+    if (authCount > 1) {
+      throw new Error('You cannot specify multiple auth methods')
     }
   }
   if (!inputs.authHost) {
-    if (inputs.authToken || inputs.authUsername || inputs.authCondaToken) {
+    if (inputs.authToken || inputs.authUsername || inputs.authCondaToken || inputs.authS3AccessKeyId) {
       throw new Error('You need to specify auth-host')
     }
   }
-  if (inputs.cacheWrite && !inputs.cacheKey && !inputs.cache) {
-    throw new Error('cache-write is only valid with cache-key or cache specified.')
+  if (inputs.runInstall === false && inputs.environments) {
+    throw new Error('Cannot specify environments without running install')
   }
+  if (inputs.activateEnvironment === 'true' && inputs.environments && inputs.environments.length > 1) {
+    throw new Error('When installing multiple environments, `activate-environment` must specify the environment name')
+  }
+}
+
+const determinePixiInstallation = (pixiUrlOrVersionSet: boolean, pixiBinPath: string | undefined) => {
+  const preinstalledPixi = which.sync('pixi', { nothrow: true })
+
+  if (pixiUrlOrVersionSet || pixiBinPath) {
+    if (preinstalledPixi) {
+      core.debug(`Local pixi found at ${preinstalledPixi} is being ignored.`)
+    }
+    return {
+      downloadPixi: true,
+      pixiBinPath: pixiBinPath ? path.resolve(untildify(pixiBinPath)) : PATHS.pixiBin
+    }
+  }
+
+  if (preinstalledPixi) {
+    core.info(`Using pre-installed pixi at ${preinstalledPixi}`)
+    return { downloadPixi: false, pixiBinPath: preinstalledPixi }
+  }
+
+  return { downloadPixi: true, pixiBinPath: PATHS.pixiBin }
 }
 
 const inferOptions = (inputs: Inputs): Options => {
@@ -128,18 +223,63 @@ const inferOptions = (inputs: Inputs): Options => {
   const pixiSource = inputs.pixiVersion
     ? { version: inputs.pixiVersion }
     : inputs.pixiUrl
-    ? { url: inputs.pixiUrl }
-    : { version: 'latest' }
+      ? { url: inputs.pixiUrl }
+      : { version: 'latest' }
+
+  const { downloadPixi, pixiBinPath } = determinePixiInstallation(
+    !!inputs.pixiVersion || !!inputs.pixiUrl,
+    inputs.pixiBinPath
+  )
   const logLevel = inputs.logLevel ?? (core.isDebug() ? 'vv' : 'default')
-  const manifestPath = inputs.manifestPath ? path.resolve(untildify(inputs.manifestPath)) : 'pixi.toml'
-  const pixiLockFile = path.join(path.dirname(manifestPath), path.basename(manifestPath).replace(/\.toml$/, '.lock'))
+  // infer manifest path from inputs or default to pixi.toml or pyproject.toml depending on what is present in the repo.
+  let manifestPath = pixiPath // default
+  if (inputs.manifestPath) {
+    manifestPath = path.resolve(untildify(inputs.manifestPath))
+  } else {
+    if (existsSync(pixiPath)) {
+      manifestPath = pixiPath
+    } else if (existsSync(pyprojectPath)) {
+      try {
+        const fileContent = readFileSync(pyprojectPath, 'utf-8')
+        const parsedContent: Record<string, unknown> = parse(fileContent)
+
+        // Test if the tool.pixi table is present in the pyproject.toml file, if so, use it as the manifest file.
+        if (parsedContent.tool && typeof parsedContent.tool === 'object' && 'pixi' in parsedContent.tool) {
+          core.debug(`The tool.pixi table found, using ${pyprojectPath} as manifest file.`)
+          manifestPath = pyprojectPath
+        }
+      } catch (error) {
+        core.error(`Error while trying to read ${pyprojectPath} file.`)
+        core.error(error as Error)
+      }
+    } else if (runInstall) {
+      core.warning(`Could not find any manifest file. Defaulting to ${pixiPath}.`)
+    }
+  }
+
+  const pixiLockFile = path.join(path.dirname(manifestPath), 'pixi.lock')
+  const lockFileAvailable = existsSync(pixiLockFile)
+  core.debug(`lockFileAvailable: ${lockFileAvailable ? 'yes' : 'no'}`)
+  if (!lockFileAvailable && inputs.cacheWrite === true) {
+    throw new Error('You cannot specify cache-write = true without a lock file present')
+  }
+  let activatedEnvironment // default is undefined
+  if (inputs.activateEnvironment === 'true') {
+    if (inputs.environments) {
+      activatedEnvironment = inputs.environments[0]
+    } else {
+      activatedEnvironment = 'default'
+    }
+  } else if (inputs.activateEnvironment && inputs.activateEnvironment !== 'false') {
+    activatedEnvironment = inputs.activateEnvironment
+  }
   const cache = inputs.cacheKey
     ? { cacheKeyPrefix: inputs.cacheKey, cacheWrite: inputs.cacheWrite ?? true }
-    : inputs.cache
-    ? { cacheKeyPrefix: 'pixi-', cacheWrite: true }
-    : undefined
-  const pixiBinPath = inputs.pixiBinPath ? path.resolve(untildify(inputs.pixiBinPath)) : PATHS.pixiBin
-  const pixiRunShell = path.join(path.dirname(pixiBinPath), 'pixi-shell')
+    : inputs.cache === true || (lockFileAvailable && inputs.cache !== false)
+      ? { cacheKeyPrefix: 'pixi-', cacheWrite: inputs.cacheWrite ?? true }
+      : undefined
+  const frozen = inputs.frozen ?? false
+  const locked = inputs.locked ?? (lockFileAvailable && !frozen)
   const auth = !inputs.authHost
     ? undefined
     : ((inputs.authToken
@@ -148,25 +288,36 @@ const inferOptions = (inputs: Inputs): Options => {
             token: inputs.authToken
           }
         : inputs.authCondaToken
-        ? {
-            host: inputs.authHost,
-            condaToken: inputs.authCondaToken
-          }
-        : {
-            host: inputs.authHost,
-            username: inputs.authUsername!,
-            password: inputs.authPassword!
-          }) as Auth)
+          ? {
+              host: inputs.authHost,
+              condaToken: inputs.authCondaToken
+            }
+          : inputs.authUsername
+            ? {
+                host: inputs.authHost,
+                username: inputs.authUsername,
+                password: inputs.authPassword
+              }
+            : {
+                host: inputs.authHost,
+                s3AccessKeyId: inputs.authS3AccessKeyId,
+                s3SecretAccessKey: inputs.authS3SecretAccessKey,
+                s3SessionToken: inputs.authS3SessionToken
+              }) as Auth)
   const postCleanup = inputs.postCleanup ?? true
   return {
     pixiSource,
+    downloadPixi,
     logLevel,
     manifestPath,
     pixiLockFile,
     runInstall,
+    environments: inputs.environments,
+    activatedEnvironment,
+    frozen,
+    locked,
     cache,
     pixiBinPath,
-    pixiRunShell,
     auth,
     postCleanup
   }
@@ -183,11 +334,23 @@ const assertOptions = (_options: Options) => {
 
 const getOptions = () => {
   const inputs: Inputs = {
-    pixiVersion: parseOrUndefined('pixi-version', z.union([z.literal('latest'), z.string().regex(/^v\d+\.\d+\.\d+$/)])),
+    pixiVersion: parseOrUndefined(
+      'pixi-version',
+      z.union([z.literal('latest'), z.string().regex(/^v\d+\.\d+\.\d+$/)]),
+      'pixi-version must either be `latest` or a version string matching `vX.Y.Z`.'
+    ),
     pixiUrl: parseOrUndefined('pixi-url', z.string().url()),
-    logLevel: parseOrUndefined('log-level', logLevelSchema),
+    logLevel: parseOrUndefined(
+      'log-level',
+      logLevelSchema,
+      'log-level must be one of `q`, `default`, `v`, `vv`, `vvv`.'
+    ),
     manifestPath: parseOrUndefined('manifest-path', z.string()),
     runInstall: parseOrUndefinedJSON('run-install', z.boolean()),
+    environments: parseOrUndefinedList('environments', z.string()),
+    activateEnvironment: parseOrUndefined('activate-environment', z.string()),
+    locked: parseOrUndefinedJSON('locked', z.boolean()),
+    frozen: parseOrUndefinedJSON('frozen', z.boolean()),
     cache: parseOrUndefinedJSON('cache', z.boolean()),
     cacheKey: parseOrUndefined('cache-key', z.string()),
     cacheWrite: parseOrUndefinedJSON('cache-write', z.boolean()),
@@ -197,6 +360,9 @@ const getOptions = () => {
     authUsername: parseOrUndefined('auth-username', z.string()),
     authPassword: parseOrUndefined('auth-password', z.string()),
     authCondaToken: parseOrUndefined('auth-conda-token', z.string()),
+    authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
+    authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
+    authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
     postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
   }
   core.debug(`Inputs: ${JSON.stringify(inputs)}`)
@@ -207,4 +373,21 @@ const getOptions = () => {
   return options
 }
 
-export const options = getOptions()
+let _options: Options
+try {
+  _options = getOptions()
+} catch (error) {
+  if (core.isDebug()) {
+    throw error
+  }
+  if (error instanceof Error) {
+    core.setFailed(error.message)
+    exit(1)
+  } else if (typeof error === 'string') {
+    core.setFailed(error)
+    exit(1)
+  }
+  throw error
+}
+
+export const options = _options

src/post.ts

@@ -1,6 +1,7 @@
 import fs from 'fs/promises'
 import path from 'path'
-import * as os from 'os'
+import os from 'os'
+import { exit } from 'process'
 import * as core from '@actions/core'
 import { options } from './options'
 
@@ -36,9 +37,10 @@ const cleanupEnv = () => {
   return fs.rm(envDir, { recursive: true })
 }
 
-const determineCacheDir = () => {
+const determineCacheDir = (): string => {
   // rattler uses dirs::cache_dir https://docs.rs/dirs/latest/dirs/fn.cache_dir.html
   if (os.platform() === 'win32') {
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
     return process.env.LOCALAPPDATA!
   }
   if (os.platform() === 'linux') {
@@ -68,3 +70,17 @@ const run = () => {
 }
 
 run()
+  .then(() => exit(0)) // workaround for https://github.com/actions/toolkit/issues/1578
+  .catch((error: unknown) => {
+    if (core.isDebug()) {
+      throw error
+    }
+    if (error instanceof Error) {
+      core.setFailed(error.message)
+      exit(1)
+    } else if (typeof error === 'string') {
+      core.setFailed(error)
+      exit(1)
+    }
+    throw error
+  })

src/util.ts

@@ -1,8 +1,9 @@
 import type { BinaryLike } from 'crypto'
 import { createHash } from 'crypto'
-import * as os from 'os'
+import os from 'os'
 import * as core from '@actions/core'
-import { exec } from '@actions/exec'
+import type { ExecOptions } from '@actions/exec'
+import { exec, getExecOutput } from '@actions/exec'
 import { options } from './options'
 
 export const getCondaArch = () => {
@@ -73,11 +74,17 @@ export const execute = (cmd: string[]) => {
   return exec(cmd[0], cmd.slice(1))
 }
 
+export const executeGetOutput = (cmd: string[], options?: ExecOptions) => {
+  core.debug(`Executing: ${cmd.join(' ')}`)
+  return getExecOutput(cmd[0], cmd.slice(1), options)
+}
+
 export const pixiCmd = (command: string, withManifestPath = true) => {
-  let commandArray = [options.pixiBinPath].concat(command.split(' '))
+  let commandArray = [options.pixiBinPath].concat(command.split(' ').filter((x) => x !== ''))
   if (withManifestPath) {
     commandArray = commandArray.concat(['--manifest-path', options.manifestPath])
   }
+  commandArray = commandArray.concat(['--color', 'always'])
   switch (options.logLevel) {
     case 'vvv':
       commandArray = commandArray.concat(['-vvv'])

test/auth-s3/pixi.toml

@@ -0,0 +1,13 @@
+[project]
+name = "test-auth-s3"
+channels = ["s3://rattler-s3-testing/channel", "conda-forge"]
+platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]
+
+[project.s3-options.rattler-s3-testing]
+endpoint-url = "https://e1a7cde76f1780ec06bac859036dbaf7.eu.r2.cloudflarestorage.com"
+force-path-style = true
+region = "auto"
+
+[dependencies]
+my-webserver = "*"
+python = "*"

test/auth/pixi.toml

@@ -0,0 +1,11 @@
+[project]
+name = "test-auth"
+channels = ["conda-forge", "https://repo.prefix.dev/setup-pixi-test"]
+platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]
+
+[tasks]
+test = "python -c 'print(\"Hello world!\")'"
+
+[dependencies]
+python = "3.9.*"
+private-package = "*"

test/default/pixi.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 description = "Add a short description here"
 authors = ["Pavel Zwerschke <pavelzw@gmail.com>"]
 channels = ["conda-forge"]
-platforms = ["linux-64", "osx-64", "win-64"]
+platforms = ["linux-64", "osx-64", "osx-arm64", "win-64"]
 
 [tasks]
 test = "python -c 'print(\"Hello world!\")'"

test/lockfile-not-up-to-date/pixi.toml

@@ -0,0 +1,14 @@
+[project]
+name = "test-default"
+version = "0.1.0"
+description = "Add a short description here"
+authors = ["Pavel Zwerschke <pavelzw@gmail.com>"]
+channels = ["conda-forge"]
+platforms = ["linux-64", "osx-64", "osx-arm64", "win-64"]
+
+[tasks]
+test = "python -c 'print(\"Hello world!\")'"
+
+[dependencies]
+# the lockfile still has python 3.10.*
+python = "3.11.*"

test/multiple-environments/pixi.toml

@@ -0,0 +1,18 @@
+[project]
+name = "test-package"
+channels = ["conda-forge"]
+platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]
+
+[dependencies]
+python = ">=3.11"
+pip = "*"
+polars = ">=0.14.24,<0.21"
+
+[feature.py311.dependencies]
+python = "3.11.*"
+[feature.py312.dependencies]
+python = "3.12.*"
+
+[environments]
+py311 = ["py311"]
+py312 = ["py312"]

test/no-lockfile/pixi.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 description = "Add a short description here"
 authors = ["Pavel Zwerschke <pavelzw@gmail.com>"]
 channels = ["conda-forge"]
-platforms = ["linux-64", "osx-64", "win-64"]
+platforms = ["linux-64", "osx-64", "osx-arm64", "win-64"]
 
 [tasks]
 test = "python -c 'print(\"Hello world!\")'"

test/old-pixi-lockfiles/pixi.toml

@@ -0,0 +1,13 @@
+[project]
+name = "test-default"
+version = "0.1.0"
+description = "Add a short description here"
+authors = ["Pavel Zwerschke <pavelzw@gmail.com>"]
+channels = ["conda-forge"]
+platforms = ["linux-64", "osx-64", "osx-arm64", "win-64"]
+
+[tasks]
+test = "python -c 'print(\"Hello world!\")'"
+
+[dependencies]
+python = "3.11.*"

test/private-package/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2023, Pavel Zwerschke
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

test/private-package/meta.yaml

@@ -0,0 +1,28 @@
+package:
+  name: private-package
+  version: 0.0.1
+
+build:
+  noarch: python
+  script: echo this is a noop
+  number: 0
+
+requirements:
+  run:
+    - python >=3.9
+
+test:
+  commands:
+    - echo this is a noop
+
+about:
+  home: http://github.com/prefix-dev/setup-pixi
+  license: BSD-3-Clause
+  license_file: LICENSE
+  description: |
+    This is a test package for setup-pixi.
+  dev_url: http://github.com/prefix-dev/setup-pixi
+
+extra:
+  recipe-maintainers:
+    - pavelzw

test/pyproject-manifest/pyproject.toml

@@ -0,0 +1,23 @@
+[project]
+name = "pyproject-manifest"
+version = "0.1.0"
+description = "Testing pyproject-manifest."
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = ["flask==2.*"]
+
+[build-system]
+requires = ["setuptools", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[tool.pixi.project]
+name = "pyproject-manifest"
+channels = ["conda-forge"]
+platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]
+
+[tool.pixi]
+# This dotted inline table fails with the `toml` parser, but works with `@iarna/toml`.
+pypi-dependencies.boltons = "*"
+
+[tool.pixi.tasks]
+test = "echo 'Running tests...'"

tsconfig.json

@@ -1,12 +1,12 @@
 {
   "compilerOptions": {
-    "target": "es6",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
-    "outDir": "./lib",                        /* Redirect output structure to the directory. */
-    "rootDir": "./src",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
-    "strict": true,                           /* Enable all strict type-checking options. */
-    "noImplicitAny": true,                    /* Raise error on expressions and declarations with an implied 'any' type. */
-    "esModuleInterop": true                   /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    "target": "ES2020" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "module": "CommonJS" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
+    "outDir": "./lib" /* Redirect output structure to the directory. */,
+    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
+    "strict": true /* Enable all strict type-checking options. */,
+    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
   },
   "exclude": ["node_modules", "**/*.test.ts"]
 }

tsup.config.js

@@ -8,9 +8,15 @@ export default defineConfig({
   dts: false,
   clean: true,
   target: 'es2020',
-  format: ['cjs'],
-  sourcemap: true,
+  format: 'cjs',
+  sourcemap: false,
+  platform: 'node',
   minify: false,
+  outExtension() {
+    return {
+      js: '.js'
+    }
+  },
   // need to bundle dependencies because they aren't available otherwise when run inside the action
   noExternal: [
     '@actions/core',
@@ -19,6 +25,8 @@ export default defineConfig({
     '@actions/io',
     '@actions/tool-cache',
     'untildify',
+    '@iarna/toml',
+    'which',
     'zod'
   ]
 })