feat!: Add auth-logout input and run pixi auth status after login (#291 )

chore: bump typescript to v7 and migrate to oxlint and oxfmt (#289 )
chore(deps): bump the nodejs group across 1 directory with 7 updates (#288 )
2026-10-08 15:04:08 +03:00 · 2026-10-06 18:15:30 +02:00 · 2026-10-01 12:31:45 +02:00 · 2026-10-01 11:46:57 +02:00 · 2026-10-01 11:22:52 +02:00 · 2026-09-15 17:24:57 +02:00
42 changed files with 113438 additions and 77951 deletions
@@ -1,28 +0,0 @@
-module.exports = {
-  ignorePatterns: ['dist/**/*', 'build/**/*'],
-  extends: ['standard', 'plugin:@typescript-eslint/recommended', 'plugin:prettier/recommended'],
-  parser: '@typescript-eslint/parser',
-  parserOptions: {
-    ecmaVersion: '2020'
-  },
-  plugins: ['@typescript-eslint', 'prettier'],
-  rules: {
-    'import/order': 'error',
-    'no-use-before-define': 'off',
-    'no-unused-vars': 'off',
-    '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-    'n/no-callback-literal': 'off',
-    '@typescript-eslint/consistent-type-imports': ['error', { prefer: 'type-imports' }],
-    '@typescript-eslint/no-use-before-define': 'error',
-    'prettier/prettier': [
-      'error',
-      {
-        tabWidth: 2,
-        printWidth: 120,
-        singleQuote: true,
-        trailingComma: 'none',
-        semi: false
-      }
-    ]
-  }
-}
@@ -1 +1,2 @@
-dist/** -diff linguist-generated=true
+dist/** merge=binary -diff linguist-generated=true
+pnpm-lock.yaml merge=binary linguist-generated=true
@@ -0,0 +1,3 @@
+If updating documentation:
+
+- [ ] Updated documentation in https://github.com/prefix-dev/pixi/blob/main/docs/integration/ci/github_actions.md as well
@@ -0,0 +1,7 @@
+:8080 {
+    @unauthorized not header Authorization "Bearer s3cr3tT0k3nABC123"
+    respond @unauthorized "Unauthorized: Invalid token" 401
+
+    root * ./assets
+    file_server
+}
@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json
+issuer: https://token.actions.githubusercontent.com
+subject: repo:prefix-dev/setup-pixi:ref:refs/heads/main
+
+permissions:
+  contents: write
+  pull_requests: write
@@ -5,14 +5,18 @@ updates:
    schedule:
      interval: monthly
    groups:
-      dependencies:
+      gh-actions:
        patterns:
-          - "*"
+          - '*'
+    cooldown:
+      default-days: 7
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: monthly
    groups:
-      dependencies:
+      nodejs:
        patterns:
-          - "*"
+          - '*'
+    cooldown:
+      default-days: 7
@@ -23,4 +23,4 @@ changelog:
        - dependencies
    - title: 🤷🏻 Other changes
      labels:
-        - "*"
+        - '*'
@@ -7,21 +7,23 @@ on:
    branches: [main]
  merge_group:
  schedule:
-    - cron: 0 6 * * MON
+    # every 3 months
+    - cron: 0 0 1 */3 *
+  workflow_dispatch:

 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
-          version: 8
+          version: 10

      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -33,19 +35,22 @@ jobs:
        run: pnpm build

      - name: Lint
-        run: pnpm lint
+        run: pnpm lint:check
+
+      - name: Format
+        run: pnpm fmt:check

  reference-latest-version-in-readme:
    name: Reference latest version in README
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Assert latest setup-pixi version is mentioned in README
        run: |
          set -euo pipefail
          latest_version="$(jq -r '.version' package.json)"
-          count_expected=12
+          count_expected=24
          count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
          if [ "$count_actual" -ne "$count_expected" ]; then
            echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
@@ -54,12 +59,13 @@ jobs:

  reference-latest-pixi-version-in-readme:
    name: Reference latest Pixi version in README
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
-      contents: write
-      pull-requests: write
+      contents: read
+      id-token: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Assert latest pixi version is mentioned in README
        run: |
@@ -75,27 +81,33 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          identity: write
+
      - name: Create pull request
-        uses: peter-evans/create-pull-request@b1ddad2c994a25fbc81a28b3ec0e368bb2021c50
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        if: failure() && github.ref_name == 'main'
        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
          commit-message: Reference latest Pixi version in README
          title: Reference latest Pixi version in README
-          labels: documentation
+          labels: ignore for release

  check-dist:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
-          version: 8
+          version: 10

      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -116,7 +128,7 @@ jobs:
        id: diff

      # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
        with:
          name: dist
@@ -12,8 +12,8 @@ jobs:
  release:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - uses: Quantco/ui-actions/version-metadata@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: Quantco/ui-actions/version-metadata@5bfb8cebf0801e07c6a1c208a35b41637a3ff7fa # v1.0.20
        id: version-metadata
        with:
          file: ./package.json
@@ -24,7 +24,7 @@ jobs:
          TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
      - name: Create release
        if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          generate_release_notes: true
          tag_name: v${{ steps.version-metadata.outputs.newVersion }}
@@ -97,3 +97,9 @@ Thumbs.db
 # Ignore built ts files
 __tests__/runner/*
 lib/**/*
+
+# Ignore jetbrains files
+.idea
+
+# ESBuild metafile
+metafile*.json
@@ -0,0 +1,10 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "tabWidth": 2,
+  "printWidth": 120,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "semi": false,
+  "sortPackageJson": false,
+  "ignorePatterns": ["dist", "pnpm-lock.yaml", "pixi.lock", "**/*.toml"]
+}
@@ -0,0 +1,23 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["eslint", "typescript", "unicorn", "oxc", "node"],
+  "categories": {
+    "correctness": "error"
+  },
+  "options": {
+    "typeAware": true,
+    "typeCheck": true,
+    "denyWarnings": true
+  },
+  "ignorePatterns": ["dist"],
+  "rules": {
+    "no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
+    "typescript/no-explicit-any": "error",
+    "typescript/no-unsafe-argument": "error",
+    "typescript/no-unsafe-assignment": "error",
+    "typescript/no-unsafe-call": "error",
+    "typescript/no-unsafe-member-access": "error",
+    "typescript/no-unsafe-return": "error",
+    "typescript/prefer-nullish-coalescing": ["error", { "ignoreConditionalTests": true }]
+  }
+}
@@ -0,0 +1,3 @@
+{
+  "editor.defaultFormatter": "oxc.oxc-vscode"
+}
@@ -23,9 +23,10 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
-    pixi-version: v0.13.0
+    pixi-version: v0.66.0
+
    cache: true
    auth-host: prefix.dev
    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -34,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m

 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.5.0`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.11.0`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -49,7 +50,9 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 >     groups:
 >       dependencies:
 >         patterns:
->           - "*"
+>           - '*'
+>     cooldown:
+>       default-days: 7
 > ```

 ## Features
@@ -58,14 +61,17 @@ To see all available input arguments, see the [`action.yml`](action.yml) file.

 ### Caching

-The action supports caching of the pixi environment.
-By default, caching is enabled if a `pixi.lock` file is present.
+The action supports caching of the project and global pixi environments.
+By default, project environment caching is enabled if a `pixi.lock` file is present.
 It will then use the `pixi.lock` file to generate a hash of the environment and cache it.
 If the cache is hit, the action will skip the installation and use the cached environment.
 You can specify the behavior by setting the `cache` input argument.

-If you need to customize your cache-key, you can use the `cache-key` input argument.
-This will be the prefix of the cache key. The full cache key will be `<cache-key><conda-arch>-<hash>`.
+Global environment caching is disabled by default and can be enabled by setting the `global-cache` input to `true`.
+As there is no lockfile for global environments, the cache will expire at the end of every month to ensure it does not go stale.
+
+If you need to customize your cache-key, you can use the `cache-key` and `global-cache-key` input arguments.
+These will be the prefixes of the cache keys. The full cache keys will be `<cache-key><conda-arch>-<hash>` and `<global-cache-key><conda-arch>-<YYYY-MM>-<hash>` respectively.

 #### Only save caches on `main`

@@ -73,7 +79,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    cache: true
    cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -117,10 +123,10 @@ test:
    matrix:
      environment: [py311, py312]
  steps:
-  - uses: actions/checkout@v4
-  - uses: prefix-dev/setup-pixi@v0.5.0
-    with:
-      environments: ${{ matrix.environment }}
+    - uses: actions/checkout@v4
+    - uses: prefix-dev/setup-pixi@v0.11.0
+      with:
+        environments: ${{ matrix.environment }}
 ```

 #### Install multiple environments in one job
@@ -128,23 +134,50 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    # separated by spaces
    environments: >-
      py311
      py312
+- run: |
+    pixi run -e py311 test
+    pixi run -e py312 test
+```
+
+> [!WARNING]
+> If you don't specify any environment, the `default` environment will be installed and cached, even if you use other environments.
+
+### Global Environments
+
+You can specify `pixi global install` commands by setting the `global-environments` input argument.
+This will create one environment per line, and install them.
+This is useful in particular to install executables that are needed for `pixi install` to work properly.
+For instance, the `keyring`, or `gcloud` executables. The following example shows how to install both in separate global environments.
+By default, global environments are not cached. You can enable caching by setting the `global-cache` input to `true`.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    global-environments: |
+      google-cloud-sdk
+      keyring --with keyrings.google-artifactregistry-auth
+- run: |
+    gcloud --version
+    keyring --list-backends
 ```

 ### Authentication

-There are currently three ways to authenticate with pixi:
+There are currently five ways to authenticate with pixi:

 - using a token
 - using a username and password
 - using a conda-token
+- using an S3 key pair
+- using keyring for PyPI registries

-For more information, see the [pixi documentation](https://prefix.dev/docs/pixi/authentication).
+For more information, see the [pixi documentation](https://pixi.sh/latest/deployment/authentication/).

 > [!WARNING]
 > Please only store sensitive information using [GitHub secrets](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions). Do not store them in your repository.
@@ -157,7 +190,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: prefix.dev
    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -169,7 +202,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: custom-artifactory.com
    auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -178,29 +211,82 @@ This form of authentication (HTTP Basic Auth) is used in some enterprise environ

 #### Conda-token

-Specify the conda-token using the `conda-token` input argument.
+Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: anaconda.org # or my-quetz-instance.com
-    conda-token: ${{ secrets.CONDA_TOKEN }}
+    auth-conda-token: ${{ secrets.CONDA_TOKEN }}
 ```

+#### S3
+
+Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-key` input arguments.
+You can also specify the session token using the `auth-session-token` input argument.
+
+```yaml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    auth-host: s3://my-s3-bucket
+    auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
+    auth-s3-secret-access-key: ${{ secrets.SECRET_ACCESS_KEY }}
+    # only needed if your key uses a session token
+    auth-s3-session-token: ${{ secrets.SESSION_TOKEN }}
+```
+
+See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.
+
+#### Logging out
+
+By default, the credentials stay available to all subsequent steps of the job and the action runs
+`pixi auth logout <auth-host>` in its post step at the end of the job.
+You can change this behavior with the `auth-logout` input:
+
+- `post` (default): log out in the post step at the end of the job.
+- `after-install`: log out at the end of the action, after `pixi install` has completed.
+  Use this if you only want pixi to use the authenticated remote channel during the action's own install step,
+  so that later steps cannot reach the private channel anymore.
+- `never`: never log out, for example on self-hosted runners where the credentials should persist between jobs.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    auth-host: prefix.dev
+    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
+    auth-logout: after-install
+```
+
+> [!NOTE]
+> `auth-logout` replaces the removed `persist-credentials` input.
+> Use `auth-logout: after-install` instead of `persist-credentials: false` and `auth-logout: never` instead of `persist-credentials: true`.
+
+#### PyPI keyring provider
+
+You can specify whether to use keyring to look up credentials for PyPI.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    pypi-keyring-provider: subprocess # one of 'subprocess', 'disabled'
+```
+
+You can use the [`global-environments`](#global-environments) input to install `keyring` and its backends.
+
 ### Custom shell wrapper

-`setup-pixi` allows you to run command inside of the pixi environment by specifying a custom shell wrapper with `shell: pixi run bash {0}`.
+`setup-pixi` allows you to run command inside of the pixi environment by specifying a custom shell wrapper with `shell: pixi run bash -e {0}`.
 This can be useful if you want to run commands inside of the pixi environment, but don't want to use the `pixi run` command for each command.

 ```yml
 - run: | # everything here will be run inside of the pixi environment
    python --version
-    pip install -e --no-deps .
-  shell: pixi run bash {0}
+    pip install --no-deps -e .
+  shell: pixi run bash -e {0}
 ```

-You can even run python scripts like this:
+You can even run Python scripts like this:

 ```yml
 - run: | # everything here will be run inside of the pixi environment
@@ -209,18 +295,72 @@ You can even run python scripts like this:
  shell: pixi run python {0}
 ```

+If you want to use PowerShell, you need to specify `-Command` as well.
+
+```yml
+- run: | # everything here will be run inside of the pixi environment
+    python --version | Select-String "3.11"
+  shell: pixi run pwsh -Command {0} # pwsh works on all platforms
+```
+
 > [!NOTE]
 > Under the hood, the `shell: xyz {0}` option is implemented by creating a temporary script file and calling `xyz` with that script file as an argument.
 > This file does not have the executable bit set, so you cannot use `shell: pixi run {0}` directly but instead have to use `shell: pixi run bash {0}`.
+> There are some custom shells provided by GitHub that have slightly different behavior, see [`jobs.<job_id>.steps[*].shell`](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell) in the documentation.
 > See the [official documentation](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#custom-shell) and [ADR 0277](https://github.com/actions/runner/blob/main/docs/adrs/0277-run-action-shell-options.md) for more information about how the `shell:` input works in GitHub Actions.

+#### One-off shell wrapper using `pixi exec`
+
+With `pixi exec`, you can also run a one-off command inside a temporary pixi environment.
+
+```yml
+- run: | # everything here will be run inside of the temporary pixi environment
+    zstd --version
+  shell: pixi exec --spec zstd -- bash -e {0}
+```
+
+```yml
+- run: | # everything here will be run inside of the temporary pixi environment
+    import ruamel.yaml
+    # ...
+  shell: pixi exec --spec python=3.11.* --spec ruamel.yaml -- python {0}
+```
+
+See [here](https://pixi.sh/latest/reference/cli#exec) for more information about `pixi exec`.
+
+### Environment activation
+
+Instead of using a custom shell wrapper, you can also make all pixi-installed binaries available to subsequent steps by "activating" the installed environment in the currently running job.
+To this end, `setup-pixi` adds all environment variables set when executing `pixi run` to `$GITHUB_ENV` and, similarly, adds all path modifications to `$GITHUB_PATH`.
+As a result, all installed binaries can be accessed without having to call `pixi run`.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    activate-environment: true
+```
+
+If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    environments: >-
+      py311
+      py312
+    activate-environment: py311
+```
+
+Activating an environment may be more useful than using a custom shell wrapper as it allows non-shell based steps to access binaries on the path.
+However, be aware that this option augments the environment of your job.
+
 ### `--frozen` and `--locked`

 You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi install --locked` depending on the `frozen` or the `locked` input argument.
-See the [official documentation](https://prefix.dev/docs/pixi/cli#install) for more information about the `--frozen` and `--locked` flags.
+See the [official documentation](https://pixi.sh/latest/reference/cli/pixi/install/#update-options) for more information about the `--frozen` and `--locked` flags.

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    locked: true
    # or
@@ -239,7 +379,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  env:
    RUNNER_DEBUG: true
 ```
@@ -257,13 +397,13 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    # one of `q`, `default`, `v`, `vv`, or `vvv`.
    log-level: vvv
 ```

-If nothing is specified, `setup-pixi` will default to `default` or `vv` depending on if [debug logging is enabled for the action](#debug-logging-of-the-action).
+If nothing is specified, `log-level` will default to `default` or `vv` depending on if [debug logging is enabled for the action](#debug-logging-of-the-action).

 ### Self-hosted runners

@@ -278,18 +418,115 @@ If you set `post-cleanup` to `true`, the action will delete the following files:
 - the rattler cache
 - other rattler files in `~/.rattler`

-If nothing is specified, `setup-pixi` will default to `true`.
+If nothing is specified, `post-cleanup` will default to `false`.

 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.

 ```yml
- uses: prefix-dev/setup-pixi@v0.5.0
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    post-cleanup: true
    # ${{ runner.temp }}\Scripts\pixi.exe on Windows
    pixi-bin-path: ${{ runner.temp }}/bin/pixi
 ```

+You can also use a preinstalled local version of pixi on the runner by not setting any of the `pixi-version`,
+`pixi-url` or `pixi-bin-path` inputs. This action will then try to find a local version of pixi in the runner's PATH.
+
+### Using the `pyproject.toml` as a manifest file for pixi
+
+`setup-pixi` will automatically pick up the `pyproject.toml` if it contains a `[tool.pixi.project]` section and no `pixi.toml`.
+This can be overwritten by setting the `manifest-path` input argument.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    manifest-path: pyproject.toml
+```
+
+### Working directory for monorepos
+
+If you're working with a monorepo where your pixi project is in a subdirectory, you can use the `working-directory` input to specify where pixi should look for manifest files (`pixi.toml` or `pyproject.toml`).
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    working-directory: ./packages/my-project
+```
+
+This will make pixi look for `pixi.toml` or `pyproject.toml` in the `./packages/my-project` directory instead of the repository root. All pixi commands will be executed from this working directory.
+
+> [!NOTE]
+> The `working-directory` input only affects commands run by `setup-pixi` itself.
+> For subsequent `run:` steps, you need to set the working directory separately:
+>
+> ```yml
+> - run: pixi run test
+>   working-directory: ./packages/my-project
+> ```
+
+You can combine `working-directory` with `manifest-path` if needed:
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    working-directory: ./packages/my-project
+    manifest-path: custom-pixi.toml
+```
+
+### Only install pixi
+
+If you only want to install pixi and not install the current project, you can use the `run-install` option.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    run-install: false
+```
+
+### Download pixi from a custom URL
+
+You can also download pixi from a custom URL by setting the `pixi-url` input argument.
+Optionally, you can combine this with the `pixi-url-headers` input argument to supply additional headers for the download request, such as a bearer token.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    pixi-url: https://pixi-mirror.example.com/releases/download/v0.48.0/pixi-x86_64-unknown-linux-musl
+    pixi-url-headers: '{"Authorization": "Bearer ${{ secrets.PIXI_MIRROR_BEARER_TOKEN }}"}'
+```
+
+The `pixi-url` input argument can also be a [Handlebars](https://handlebarsjs.com/) template string.
+It will be rendered with the following variables:
+
+- `version`: The version of pixi that is being installed (`latest` or a version like `v0.48.0`).
+- `latest`: A boolean indicating if the version is `latest`.
+- `pixiFile`: The name of the pixi binary to download, as determined by the system of the runner (e.g., `pixi-x86_64-unknown-linux-musl`).
+
+By default, `pixi-url` is equivalent to the following template:
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    pixi-url: |
+      {{#if latest~}}
+      https://github.com/prefix-dev/pixi/releases/latest/download/{{pixiFile}}
+      {{~else~}}
+      https://github.com/prefix-dev/pixi/releases/download/{{version}}/{{pixiFile}}
+      {{~/if}}
+```
+
+### Setting inputs from environment variables
+
+Alternatively to setting the inputs in the `with` section, you can also set each of them using environment variables.
+The corresponding environment variable names are derived from the input names by converting them to uppercase, replacing hyphens with underscores, and prefixing them with `SETUP_PIXI_`.
+
+For example, the `pixi-bin-path` input can be set using the `SETUP_PIXI_PIXI_BIN_PATH` environment variable.
+
+This is particularly useful if executing the action on a self-hosted runner.
+
+Inputs always take precedence over environment variables.
+
 ## More examples

 If you want to see more examples, you can take a look at the [GitHub Workflows of this repository](.github/workflows/test.yml).
@@ -297,6 +534,6 @@ If you want to see more examples, you can take a look at the [GitHub Workflows o
 ## Local Development

 1. Clone this repository.
-1. Run `pnpm install` inside the repository (if you don't have [`pnpm`](https://github.com/pnpm/pnpm) installed, you can install it with `npm install -g pnpm` or `brew install pnpm`).
-1. Run `pnpm dev` for live transpilation of the TypeScript source code.
-1. To test the action, you can run [`act`](https://github.com/nektos/act) (inside docker) or use :sparkles: CI driven development :sparkles:.
+2. Run `pnpm install` inside the repository (if you don't have [`pnpm`](https://github.com/pnpm/pnpm) installed, you can install it with `pixi global install pnpm`).
+3. Run `pnpm dev` for live transpilation of the TypeScript source code.
+4. To test the action, you can run [`act`](https://github.com/nektos/act) (inside docker) or use :sparkles: CI driven development :sparkles:.
@@ -0,0 +1,7 @@
+# Reporting Security Issues
+
+We take security bugs in our projects seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
+
+To report a security issue, please use the GitHub Security Advisory ["Report a Vulnerability"](https://github.com/prefix-dev/setup-pixi/security/advisories/new) tab.
+
+We will send a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.
@@ -9,31 +9,53 @@ inputs:
  pixi-version:
    description: Version of pixi to install
  pixi-url:
-    description: URL of pixi to install
+    description: URL of pixi to install. Can be a Handlebars template receiving `version`, `latest`, and `pixiFile` as variables.
+  pixi-url-headers:
+    description: Headers to use when fetching the pixi binary from `pixi-url`. Should be a JSON string.
  log-level:
    description: |
      Log level for the pixi CLI.
      One of `q`, `default`, `v`, `vv`, or `vvv`.
  manifest-path:
    description: Path to the manifest file (i.e., `pixi.toml`) to use for the pixi CLI. Defaults to `pixi.toml`.
+  working-directory:
+    description: |
+      Working directory to use for pixi commands. If specified, pixi will look for manifest files (pixi.toml or pyproject.toml) 
+      in this directory instead of the repository root. Useful for monorepos where pixi projects are in subdirectories.
  run-install:
-    description: Whether to run `pixi install` after setting up the environment. Defaults to `true`.
+    description: Whether to run `pixi install` after installing pixi. Defaults to `true`.
  environments:
    description: |
      A space-separated list of environments to install. If not specified, only the default environment is installed.
+  global-environments:
+    description: |
+      A newline-separated list of packages to install globally with `pixi global install`.
+  activate-environment:
+    description: |
+      If the installed environment should be "activated" for the current job, modifying `$GITHUB_ENV` and
+      `$GITHUB_PATH`. If more than one environment is specified in `environments`, this must be the name of the
+      environment. Defaults to `false`. Requires at least pixi v0.21.0.
  locked:
    description: Whether to use `pixi install --locked`. Defaults to `true` when the lockfile is present, otherwise `false`.
  frozen:
    description: Whether to use `pixi install --frozen`. Defaults to `false`.
  cache:
    description: Whether to cache the pixi environment. Defaults to `true`. Only works if `pixi.lock` is present.
+  global-cache:
+    description: |
+      Whether to cache the global environment(s). Defaults to `false`. As there is no lockfile for global environment,
+      the global cache will expire at the end of every month, to ensure it does not go stale.
  cache-key:
    description: |
      Cache key prefix to use for caching the pixi environment.
      Defaults to `pixi-`. The full cache key is `<cache-key><conda-arch>-<sha-256-of-pixi-lock>`.
+  global-cache-key:
+    description: |
+      Cache key prefix to use for caching the global environments.
+      Defaults to `pixi-global-`. The full cache key is `<global-cache-key><conda-arch>-<sha-256-of-global-environments>`.
  cache-write:
    description: |
-      Whether to write to the cache or only read from it. Defaults to `true`.
+      Whether to write to the cache or only read from it. Defaults to `true`. Applies to both project and global caches as the case may be.
  pixi-bin-path:
    description: |
      Path to the pixi binary to use. Defaults to `~/.pixi/bin/pixi`.
@@ -41,7 +63,7 @@ inputs:
    description: |
      Host to use for authentication. If not set, pixi is not authenticating.
      Requires `auth-token` or `auth-conda-token` or `auth-username` and `auth-password` to be set.
-      See https://prefix.dev/docs/pixi/authentication
+      See https://pixi.prefix.dev/latest/deployment/authentication/
  auth-token:
    description: Token to use for authentication.
  auth-username:
@@ -50,12 +72,32 @@ inputs:
    description: Password to use for authentication.
  auth-conda-token:
    description: Conda token to use for authentication.
+  auth-s3-access-key-id:
+    description: Access key ID to use for S3 authentication.
+  auth-s3-secret-access-key:
+    description: Secret access key to use for S3 authentication.
+  auth-s3-session-token:
+    description: Session token to use for S3 authentication.
+  auth-logout:
+    description: |
+      When to run `pixi auth logout <auth-host>`. Requires `auth-host`.
+      options: post, after-install, never
+      - `post` (default): The credentials stay available to all subsequent steps and are removed in the post step at the end of the job.
+      - `after-install`: The credentials are removed at the end of this action, so that later steps cannot reach the private channel anymore.
+      - `never`: The credentials are never removed.
+  persist-credentials:
+    description: Removed, use `auth-logout` instead.
+    deprecationMessage: '`persist-credentials` has been removed, use `auth-logout: after-install` (instead of `false`) or `auth-logout: never` (instead of `true`).'
+  pypi-keyring-provider:
+    description: |
+      Specifies whether to use keyring to look up credentials for PyPI.
+      options: disabled, subprocess
  post-cleanup:
    description: |
-      If the action should clean up after itself. Defaults to `true`.
+      If the action should clean up after itself. Defaults to `false`.
      If `true`, the pixi environment, the pixi binary and the rattler files in ~/.rattler and ~/.cache/rattler are removed.

 runs:
-  using: node20
+  using: node24
  main: dist/index.js
  post: dist/post.js
@@ -1,13 +1,15 @@
 {
  "name": "setup-pixi",
-  "version": "0.5.0",
+  "version": "0.11.0",
  "private": true,
  "description": "Action to set up the pixi package manager.",
  "scripts": {
    "build": "tsup",
    "dev": "tsup --watch",
-    "lint": "eslint ./src --ext ts",
-    "lint:fix": "eslint ./src --ext ts --fix"
+    "lint": "oxlint --fix",
+    "lint:check": "oxlint",
+    "fmt": "oxfmt",
+    "fmt:check": "oxfmt --check"
  },
  "repository": {
    "type": "git",
@@ -21,27 +23,24 @@
  "author": "Pavel Zwerschke <pavelzw@gmail.com>",
  "license": "BSD-3-Clause",
  "dependencies": {
-    "@actions/cache": "^3.2.3",
-    "@actions/core": "^1.10.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/io": "^1.1.3",
-    "@actions/tool-cache": "^2.0.1",
-    "untildify": "^5.0.0",
-    "zod": "^3.22.4"
+    "@actions/cache": "^6.2.0",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/io": "^3.0.2",
+    "@actions/tool-cache": "^4.0.0",
+    "handlebars": "^4.7.9",
+    "smol-toml": "^1.9.0",
+    "untildify": "^6.0.0",
+    "which": "^7.0.0",
+    "zod": "^4.6.5"
  },
  "devDependencies": {
-    "@types/node": "^20.11.14",
-    "@typescript-eslint/eslint-plugin": "^6.20.0",
-    "@typescript-eslint/parser": "^6.20.0",
-    "eslint": "^8.56.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-n": "^16.6.2",
-    "eslint-plugin-prettier": "^5.1.3",
-    "eslint-plugin-promise": "^6.1.1",
-    "prettier": "^3.2.4",
-    "tsup": "^8.0.1",
-    "typescript": "^5.3.3"
+    "@types/node": "^26.6.2",
+    "@types/which": "^3.0.4",
+    "oxfmt": "^0.71.0",
+    "oxlint": "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
+    "tsup": "^8.5.1",
+    "typescript": "^7.0.2"
  }
 }
@@ -0,0 +1,9 @@
+allowBuilds:
+  esbuild: true
+
+overrides:
+  undici: ^6.28.0
+  rollup: ^4.59.0
+  fast-xml-parser: ^5.10.1
+  minimatch@3>brace-expansion: ^1.1.18
+  minimatch@10>brace-expansion: ^5.0.9
@@ -0,0 +1,69 @@
+import os from 'os'
+import * as osPath from 'path'
+import * as core from '@actions/core'
+import { executeGetOutput, pixiCmd } from './util'
+
+interface ShellHook {
+  environment_variables: Record<string, string>
+}
+
+const splitEnvironment = (shellHook: ShellHook): [Record<string, string>, string?] => {
+  if (os.platform() === 'win32') {
+    // On Windows, environment variables are case-insensitive but JSON isn't...
+    const pathEnvs = Object.keys(shellHook.environment_variables).filter((k) => k.toUpperCase() === 'PATH')
+    if (pathEnvs.length > 0) {
+      const caseSensitivePathName = pathEnvs[0]
+      const path = shellHook.environment_variables[caseSensitivePathName]
+      delete shellHook.environment_variables[caseSensitivePathName]
+      return [shellHook.environment_variables, path]
+    }
+  } else {
+    if ('PATH' in shellHook.environment_variables) {
+      const path = shellHook.environment_variables.PATH
+      delete shellHook.environment_variables.PATH
+      return [shellHook.environment_variables, path]
+    }
+  }
+
+  // If the path cannot be found, return all other environment variables
+  return [shellHook.environment_variables]
+}
+
+const getNewPathComponents = (path: string): string[] => {
+  const currentPath = process.env.PATH
+  if (!currentPath) {
+    throw new Error('Unable to obtain current PATH from environment')
+  }
+  if (!path.endsWith(currentPath)) {
+    throw new Error('Unable to handle environment activation which does not only append to PATH')
+  }
+  core.debug(`Found current path '${currentPath}'`)
+  core.debug(`Got new path '${path}'`)
+  const newPath = path.slice(0, path.length - currentPath.length)
+  return newPath.split(osPath.delimiter).filter((p) => p.length > 0)
+}
+
+export const activateEnvironment = async (environment: string): Promise<void> => {
+  // First, obtain the environment variables that would be set by environment activation
+  const envOption = environment === 'default' ? '' : `-e ${environment}`
+  const shellHookOutput = await executeGetOutput(pixiCmd(`shell-hook ${envOption} --json`), { silent: true })
+  const shellHook = JSON.parse(shellHookOutput.stdout) as ShellHook
+
+  // Then, we split the environment variables into the special 'PATH' and all others
+  const [envVars, path] = splitEnvironment(shellHook)
+
+  // Finally, new path components are added...
+  if (path) {
+    const newComponents = getNewPathComponents(path)
+    for (const component of newComponents) {
+      core.info(`Adding path component '${component}'`)
+      core.addPath(component)
+    }
+  }
+
+  // ... as well as all remaining environment variables
+  for (const key of Object.keys(envVars)) {
+    core.info(`Exporting environment variable '${key}=${envVars[key]}'`)
+    core.exportVariable(key, envVars[key])
+  }
+}
@@ -5,77 +5,159 @@ import * as cache from '@actions/cache'
 import { options } from './options'
 import { getCondaArch, sha256 } from './util'

-export const generateCacheKey = async (cacheKeyPrefix: string) =>
-  Promise.all([fs.readFile(options.pixiLockFile), fs.readFile(options.pixiBinPath)])
-    .then(([lockfileContent, pixiBinary]) => {
-      const lockfileSha = sha256(lockfileContent)
-      core.debug(`lockfileSha: ${lockfileSha}`)
-      const pixiSha = sha256(pixiBinary)
-      core.debug(`pixiSha: ${pixiSha}`)
-      // the path to the lock file decides where the pixi env is created (../.pixi/env)
-      // since conda envs are not relocatable, we need to include the path in the cache key
-      const lockfilePathSha = sha256(options.pixiLockFile)
-      core.debug(`lockfilePathSha: ${lockfilePathSha}`)
-      const environments = sha256(options.environments?.join(' ') ?? '')
-      core.debug(`environments: ${environments}`)
-      // since the lockfile path is not necessarily absolute, we need to include the cwd in the cache key
-      const cwdSha = sha256(process.cwd())
-      core.debug(`cwdSha: ${cwdSha}`)
-      const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
-      core.debug(`sha: ${sha}`)
-      return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
-    })
-    .catch((err) => {
-      throw new Error(`Failed to generate cache key: ${err}`)
-    })
+const getYearMonth = () => {
+  // this gets us the current month formatted as YYYY-MM
+  return new Date().toLocaleDateString('en-CA', { year: 'numeric', month: '2-digit' })
+}

-const cachePath = path.join(path.dirname(options.pixiLockFile), '.pixi')
+let pixiSha: string | undefined
+const getPixiSha = async () => {
+  if (pixiSha) {
+    return pixiSha
+  }
+  const pixiBinary = await fs.readFile(options.pixiBinPath)
+  pixiSha = sha256(pixiBinary)
+  return pixiSha
+}

-let cacheHit = false
+export const generateProjectCacheKey = async (cacheKeyPrefix: string) => {
+  try {
+    const [lockfileContent, pixiSha] = await Promise.all([fs.readFile(options.pixiLockFile), getPixiSha()])
+    const lockfileSha = sha256(lockfileContent)
+    core.debug(`lockfileSha: ${lockfileSha}`)
+    core.debug(`pixiSha: ${pixiSha}`)
+    // the path to the lock file decides where the pixi env is created (../.pixi/env)
+    // since conda envs are not relocatable, we need to include the path in the cache key
+    const lockfilePathSha = sha256(options.pixiLockFile)
+    core.debug(`lockfilePathSha: ${lockfilePathSha}`)
+    const environments = sha256(options.environments?.join(' ') ?? '')
+    core.debug(`environments: ${environments}`)
+    // since the lockfile path is not necessarily absolute, we need to include the working directory in the cache key
+    const cwdSha = sha256(options.workingDirectory)
+    core.debug(`cwdSha: ${cwdSha}`)
+    const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
+    core.debug(`sha: ${sha}`)
+    return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
+  } catch (err: unknown) {
+    throw new Error(`Failed to generate cache key`, { cause: err })
+  }
+}

-export const tryRestoreCache = (): Promise<string | undefined> => {
+export const generateGlobalCacheKey = async (cacheKeyPrefix: string) => {
+  try {
+    const pixiSha = await getPixiSha()
+    core.debug(`pixiSha: ${pixiSha}`)
+    const globalEnvironments = sha256(options.globalEnvironments?.join(' ') ?? '')
+    core.debug(`globalEnvironments: ${globalEnvironments}`)
+    const sha = sha256(globalEnvironments + pixiSha + getGlobalCachePath())
+    core.debug(`sha: ${sha}`)
+    return `${cacheKeyPrefix}${getCondaArch()}-${getYearMonth()}-${sha}`
+  } catch (err: unknown) {
+    throw new Error(`Failed to generate cache key`, { cause: err })
+  }
+}
+
+const projectCachePath = path.join(path.dirname(options.pixiLockFile), '.pixi')
+
+const getGlobalCachePath = () => {
+  const pixiHome = process.env.PIXI_HOME
+  if (pixiHome) {
+    return path.join(pixiHome, 'envs')
+  }
+
+  const home = process.env.HOME
+  if (home) {
+    return path.join(home, '.pixi', 'envs')
+  }
+
+  throw new Error('Neither PIXI_HOME nor HOME environment variables are set.')
+}
+
+let projectCacheHit = false
+let globalCacheHit = false
+
+async function _tryRestoreCache(
+  type: 'project' | 'global',
+  keyPrefix: string,
+  generateKey: (prefix: string) => Promise<string>,
+  cachePath: string,
+  onHit: () => void
+): Promise<string | undefined> {
+  return core.group(`Restoring ${type} cache`, async () => {
+    const cacheKey = await generateKey(keyPrefix)
+    core.debug(`Cache key: ${cacheKey}`)
+    core.debug(`Cache path: ${cachePath}`)
+    const key = await cache.restoreCache([cachePath], cacheKey, undefined, undefined, false)
+    if (key) {
+      core.info(`Restored cache with key \`${key}\``)
+      onHit()
+    } else {
+      core.info(`Cache miss`)
+    }
+    return key
+  })
+}
+
+async function _saveCache(
+  type: 'project' | 'global',
+  wasHit: boolean,
+  keyPrefix: string,
+  generateKey: (prefix: string) => Promise<string>,
+  cachePath: string
+) {
+  if (wasHit) {
+    core.debug(`Skipping ${type} cache save because cache was restored.`)
+    return
+  }
+
+  await core.group(`Saving ${type.toLowerCase()} cache`, async () => {
+    const cacheKey = await generateKey(keyPrefix)
+    try {
+      const cacheId = await cache.saveCache([cachePath], cacheKey, undefined, false)
+      core.info(`Saved cache with ID "${cacheId.toString()}"`)
+    } catch (err: unknown) {
+      // oxlint-disable-next-line typescript/restrict-template-expressions
+      core.error(`Error saving ${type} cache: ${err}`)
+    }
+  })
+}
+
+export const tryRestoreProjectCache = async (): Promise<string | undefined> => {
  const cache_ = options.cache
  if (!cache_) {
-    core.debug('Skipping pixi cache restore.')
-    return Promise.resolve(undefined)
+    core.debug('Skipping project cache restore.')
+    return undefined
  }
-  return core.group('Restoring pixi cache', () =>
-    generateCacheKey(cache_.cacheKeyPrefix).then((cacheKey) => {
-      core.debug(`Cache key: ${cacheKey}`)
-      core.debug(`Cache path: ${cachePath}`)
-      return cache.restoreCache([cachePath], cacheKey, undefined, undefined, false).then((key) => {
-        if (key) {
-          core.info(`Restored cache with key \`${key}\``)
-          cacheHit = true
-        } else {
-          core.info(`Cache miss`)
-        }
-        return key
-      })
-    })
-  )
+  return _tryRestoreCache('project', cache_.cacheKeyPrefix, generateProjectCacheKey, projectCachePath, () => {
+    projectCacheHit = true
+  })
 }

-export const saveCache = () => {
-  const cache_ = options.cache
-  if (!cache_ || !cache_.cacheWrite) {
-    core.debug('Skipping pixi cache save.')
-    return Promise.resolve(undefined)
+export const tryRestoreGlobalCache = async (): Promise<string | undefined> => {
+  const cache_ = options.globalCache
+  if (!cache_ || !options.globalEnvironments || options.globalEnvironments.length === 0) {
+    core.debug('Skipping global cache restore.')
+    return undefined
  }
-  if (cacheHit) {
-    core.debug('Skipping pixi cache save because cache was restored.')
-    return Promise.resolve(undefined)
+  return _tryRestoreCache('global', cache_.cacheKeyPrefix, generateGlobalCacheKey, getGlobalCachePath(), () => {
+    globalCacheHit = true
+  })
+}
+
+export const saveProjectCache = async () => {
+  const cache_ = options.cache
+  if (!cache_?.cacheWrite || !options.runInstall) {
+    core.debug('Skipping project cache save.')
+    return
  }
-  return core.group('Saving pixi cache', () =>
-    generateCacheKey(cache_.cacheKeyPrefix).then((cacheKey) =>
-      cache
-        .saveCache([cachePath], cacheKey, undefined, false)
-        .then((cacheId) => {
-          core.info(`Saved cache with ID \`${cacheId}\``)
-        })
-        .catch((err) => {
-          core.error(`Error saving cache: ${err.message}`)
-        })
-    )
-  )
+  await _saveCache('project', projectCacheHit, cache_.cacheKeyPrefix, generateProjectCacheKey, projectCachePath)
+}
+
+export const saveGlobalCache = async () => {
+  const cache_ = options.globalCache
+  if (!cache_?.cacheWrite || !options.globalEnvironments || options.globalEnvironments.length === 0) {
+    core.debug('Skipping global cache save.')
+    return
+  }
+  await _saveCache('global', globalCacheHit, cache_.cacheKeyPrefix, generateGlobalCacheKey, getGlobalCachePath())
 }
@@ -6,41 +6,61 @@ import * as core from '@actions/core'
 import { downloadTool } from '@actions/tool-cache'
 import type { PixiSource } from './options'
 import { options } from './options'
-import { execute, getPixiUrlFromVersion, pixiCmd } from './util'
-import { saveCache, tryRestoreCache } from './cache'
+import { execute, pixiCmd, renderPixiUrl } from './util'
+import { tryRestoreGlobalCache, tryRestoreProjectCache, saveGlobalCache, saveProjectCache } from './cache'
+import { activateEnvironment } from './activate'

-const downloadPixi = (source: PixiSource) => {
-  const url = 'version' in source ? getPixiUrlFromVersion(source.version) : source.url
-  return core.group('Downloading Pixi', () => {
+const downloadPixi = async (source: PixiSource) => {
+  const url = renderPixiUrl(source.urlTemplate, source.version)
+  await core.group('Downloading Pixi', async () => {
    core.debug('Installing pixi')
    core.debug(`Downloading pixi from ${url}`)
-    return fs
-      .mkdir(path.dirname(options.pixiBinPath), { recursive: true })
-      .then(() => downloadTool(url, options.pixiBinPath))
-      .then((_downloadPath) => fs.chmod(options.pixiBinPath, 0o755))
-      .then(() => core.info(`Pixi installed to ${options.pixiBinPath}`))
+    core.debug(`Using headers: ${JSON.stringify(source.headers)}`)
+    await fs.mkdir(path.dirname(options.pixiBinPath), { recursive: true })
+    await downloadTool(url, options.pixiBinPath, undefined, source.headers)
+    await fs.chmod(options.pixiBinPath, 0o755)
+    core.info(`Pixi installed to ${options.pixiBinPath}`)
  })
 }

-const pixiLogin = () => {
+const pixiLogin = async () => {
  const auth = options.auth
  if (!auth) {
    core.debug('Skipping pixi login.')
-    return Promise.resolve(0)
+    return
  }
-  core.debug(`auth keys: ${Object.keys(auth)}`)
-  return core.group('Logging in to private channel', () => {
+  core.debug(`auth keys: ${Object.keys(auth).toString()}`)
+  await core.group('Logging in to private channel', async () => {
    // tokens get censored in the logs as long as they are a github secret
    if ('token' in auth) {
      core.debug(`Logging in to ${auth.host} with token`)
-      return execute(pixiCmd(`auth login --token ${auth.token} ${auth.host}`, false))
-    }
-    if ('username' in auth) {
+      await execute(pixiCmd(`auth login --token ${auth.token} ${auth.host}`, false))
+    } else if ('username' in auth) {
      core.debug(`Logging in to ${auth.host} with username and password`)
-      return execute(pixiCmd(`auth login --username ${auth.username} --password ${auth.password} ${auth.host}`, false))
+      await execute(pixiCmd(`auth login --username ${auth.username} --password ${auth.password} ${auth.host}`, false))
+    } else if ('s3AccessKeyId' in auth) {
+      core.debug(`Logging in to ${auth.host} with s3 credentials`)
+      const command = auth.s3SessionToken
+        ? `auth login --s3-access-key-id ${auth.s3AccessKeyId} --s3-secret-access-key ${auth.s3SecretAccessKey} --s3-session-token ${auth.s3SessionToken} ${auth.host}`
+        : `auth login --s3-access-key-id ${auth.s3AccessKeyId} --s3-secret-access-key ${auth.s3SecretAccessKey} ${auth.host}`
+      await execute(pixiCmd(command, false))
+    } else if ('condaToken' in auth) {
+      core.debug(`Logging in to ${auth.host} with conda token`)
+      await execute(pixiCmd(`auth login --conda-token ${auth.condaToken} ${auth.host}`, false))
    }
-    core.debug(`Logging in to ${auth.host} with conda token`)
-    return execute(pixiCmd(`auth login --conda-token ${auth.condaToken} ${auth.host}`, false))
+    await execute(pixiCmd('auth status', false))
+  })
+}
+
+const pixiLogout = async () => {
+  const auth = options.auth
+  if (auth?.logout !== 'after-install') {
+    core.debug('Skipping pixi logout.')
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
  })
 }

@@ -48,33 +68,58 @@ const addPixiToPath = () => {
  core.addPath(path.dirname(options.pixiBinPath))
 }

+const pixiGlobalInstall = async () => {
+  const { globalEnvironments } = options
+  if (!globalEnvironments) {
+    core.debug('Skipping pixi global install.')
+    return
+  }
+
+  await tryRestoreGlobalCache()
+
+  core.debug('Installing global environments')
+  for (const env of globalEnvironments) {
+    const command = `global install ${env}`
+    await core.group(`pixi ${command}`, () => execute(pixiCmd(command, false)))
+  }
+
+  await saveGlobalCache()
+}
+
 const pixiInstall = async () => {
  if (!options.runInstall) {
    core.debug('Skipping pixi install.')
-    return Promise.resolve()
+    return
  }
-  return tryRestoreCache()
-    .then(async (_cacheKey) => {
-      if (options.environments) {
-        for (const environment of options.environments) {
-          core.debug(`Installing environment ${environment}`)
-          const command = `install -e ${environment}${options.frozen ? ' --frozen' : ''}${
-            options.locked ? ' --locked' : ''
-          }`
-          await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
-        }
-      } else {
-        const command = `install${options.frozen ? ' --frozen' : ''}${options.locked ? ' --locked' : ''}`
-        return core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
-      }
-    })
-    .then(saveCache)
+
+  await tryRestoreProjectCache()
+
+  const environments = options.environments ?? [undefined]
+  for (const environment of environments) {
+    core.debug(`Installing environment ${environment ?? 'default'}`)
+    let command = `install`
+    if (environment) {
+      command += ` -e ${environment}`
+    }
+    if (options.frozen) {
+      command += ' --frozen'
+    }
+    if (options.locked) {
+      command += ' --locked'
+    }
+    if (options.pypiKeyringProvider) {
+      command += ` --pypi-keyring-provider ${options.pypiKeyringProvider}`
+    }
+    await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
+  }
+
+  await saveProjectCache()
 }

 const generateList = async () => {
  if (!options.runInstall) {
    core.debug('Skipping pixi list.')
-    return Promise.resolve()
+    return
  }
  if (
    'version' in options.pixiSource &&
@@ -84,42 +129,75 @@ const generateList = async () => {
    core.warning(
      'pixi list is not supported for pixi versions < `v0.13.0`. Please set `pixi-version` to `v0.13.0` or later.'
    )
-    return Promise.resolve()
+    return
+  }
+  let command = 'list'
+  if (
+    'version' in options.pixiSource &&
+    options.pixiSource.version !== 'latest' &&
+    options.pixiSource.version < 'v0.14.0'
+  ) {
+    if (options.frozen) core.warning('pixi versions < `v0.14.0` do not support the --frozen option for pixi list.')
+    if (options.locked) core.warning('pixi versions < `v0.14.0` do not support the --locked option for pixi list.')
+  } else {
+    command = `${command}${options.frozen ? ' --frozen' : ''}${options.locked ? ' --locked' : ''}`
  }
  if (options.environments) {
    for (const environment of options.environments) {
      core.debug(`Listing environment ${environment}`)
-      await core.group(`pixi list -e ${environment}`, () => execute(pixiCmd(`list -e ${environment}`)))
+      const cmd = `${command} -e ${environment}`
+      await core.group(`pixi ${cmd}`, () => execute(pixiCmd(cmd)))
    }
-    return Promise.resolve()
  } else {
-    return core.group('pixi list', () => execute(pixiCmd('list')))
+    await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
  }
 }

-const generateInfo = () => core.group('pixi info', () => execute(pixiCmd('info')))
+const generateInfo = async () => {
+  await core.group('pixi info', () => execute(pixiCmd('info')))
+}
+
+const activateEnv = async (environment: string) => {
+  await core.group('Activate environment', () => activateEnvironment(environment))
+}

 const run = async () => {
-  core.debug(`process.env.HOME: ${process.env.HOME}`)
+  core.debug(`process.env.HOME: ${process.env.HOME ?? '-'}`)
  core.debug(`os.homedir(): ${os.homedir()}`)
-  await downloadPixi(options.pixiSource)
+  if (options.downloadPixi) {
+    await downloadPixi(options.pixiSource)
+  }
  addPixiToPath()
  await pixiLogin()
-  await pixiInstall()
+  await pixiGlobalInstall()
  await generateInfo()
+  await pixiInstall()
  await generateList()
+  if (options.activatedEnvironment) {
+    await activateEnv(options.activatedEnvironment)
+  }
+  await pixiLogout()
 }

-run().catch((error) => {
-  if (core.isDebug()) {
-    throw error
+const main = async () => {
+  try {
+    await run()
+    // workaround for https://github.com/actions/toolkit/issues/1578
+    exit(0)
+  } catch (error: unknown) {
+    if (core.isDebug()) {
+      throw error
+    }
+    if (error instanceof Error) {
+      core.setFailed(error.message)
+      exit(1)
+    } else if (typeof error === 'string') {
+      core.setFailed(error)
+      exit(1)
+    } else {
+      throw error
+    }
  }
-  if (error instanceof Error) {
-    core.setFailed(error.message)
-    exit(1)
-  } else if (typeof error === 'string') {
-    core.setFailed(error)
-    exit(1)
-  }
-  throw error
-})
+}
+
+void main()
@@ -1,22 +1,30 @@
 import path from 'path'
 import os from 'os'
 import { exit } from 'process'
-import { existsSync } from 'fs'
+import { existsSync, readFileSync } from 'fs'
 import * as core from '@actions/core'
 import * as z from 'zod'
 import untildify from 'untildify'
+import { parse } from 'smol-toml'
+import which from 'which'
+import { DEFAULT_PIXI_URL_TEMPLATE } from './util'

 type Inputs = Readonly<{
  pixiVersion?: string
  pixiUrl?: string
+  pixiUrlHeaders?: NodeJS.Dict<string>
  logLevel?: LogLevel
  manifestPath?: string
+  workingDirectory?: string
  runInstall?: boolean
  environments?: string[]
+  activateEnvironment?: string
  frozen?: boolean
  locked?: boolean
  cache?: boolean
+  globalCache?: boolean
  cacheKey?: string
+  globalCacheKey?: string
  cacheWrite?: boolean
  pixiBinPath?: string
  authHost?: string
@@ -24,19 +32,24 @@ type Inputs = Readonly<{
  authUsername?: string
  authPassword?: string
  authCondaToken?: string
+  authS3AccessKeyId?: string
+  authS3SecretAccessKey?: string
+  authS3SessionToken?: string
+  authLogout?: AuthLogout
+  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup?: boolean
+  globalEnvironments?: string[]
 }>

-export type PixiSource =
-  | {
-      version: string
-    }
-  | {
-      url: string
-    }
+export interface PixiSource {
+  urlTemplate: string
+  headers?: NodeJS.Dict<string>
+  version: string
+}

 type Auth = {
  host: string
+  logout: AuthLogout
 } & (
  | {
      token: string
@@ -48,39 +61,83 @@ type Auth = {
  | {
      condaToken: string
    }
+  | {
+      s3AccessKeyId: string
+      s3SecretAccessKey: string
+      s3SessionToken?: string
+    }
 )

-type Cache = {
+interface Cache {
+  cacheKeyPrefix: string
+  cacheWrite: boolean
+}
+
+interface GlobalCache {
  cacheKeyPrefix: string
  cacheWrite: boolean
 }

 export type Options = Readonly<{
  pixiSource: PixiSource
+  downloadPixi: boolean
  logLevel: LogLevel
  manifestPath: string
+  workingDirectory: string
  pixiLockFile: string
  runInstall: boolean
  environments?: string[]
  frozen: boolean
  locked: boolean
  cache?: Cache
+  globalCache?: GlobalCache
  pixiBinPath: string
  auth?: Auth
+  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup: boolean
+  activatedEnvironment?: string
+  globalEnvironments?: string[]
 }>
+const pixiPath = 'pixi.toml'
+const pyprojectPath = 'pyproject.toml'

 const logLevelSchema = z.enum(['q', 'default', 'v', 'vv', 'vvv'])
 export type LogLevel = z.infer<typeof logLevelSchema>

+const authLogoutSchema = z.enum(['post', 'after-install', 'never'])
+export type AuthLogout = z.infer<typeof authLogoutSchema>
+
+const pypiKeyringProviderSchema = z.enum(['disabled', 'subprocess'])
+export type PypiKeyringProvider = z.infer<typeof pypiKeyringProviderSchema>
+
 export const PATHS = {
  pixiBin: path.join(os.homedir(), '.pixi', 'bin', `pixi${os.platform() === 'win32' ? '.exe' : ''}`)
 }

-const parseOrUndefined = <T>(key: string, schema: z.ZodSchema<T>, errorMessage?: string): T | undefined => {
-  const input = core.getInput(key)
-  // GitHub actions sets empty inputs to the empty string, but we want undefined
-  if (input === '') {
+const getEnvironmentVariableName = (key: string): string => {
+  return `SETUP_PIXI_${key.toUpperCase().replace(/-/g, '_')}`
+}
+
+const inputOrEnvironmentVariable = (key: string): string | undefined => {
+  const inputValue = core.getInput(key)
+  // GitHub actions sets empty inputs to the empty string
+  if (inputValue !== '') {
+    return inputValue
+  }
+
+  const envVarName = getEnvironmentVariableName(key)
+  const envVarValue = process.env[envVarName]
+  // Empty environment variables are treated as undefined
+  if (envVarValue !== undefined && envVarValue !== '') {
+    core.debug(`Using environment variable ${envVarName} with value: ${envVarValue}`)
+    return envVarValue
+  }
+  return undefined
+}
+
+const parseOrUndefined = <T>(key: string, schema: z.ZodType<T>, errorMessage?: string): T | undefined => {
+  const input = inputOrEnvironmentVariable(key)
+  if (input === undefined) {
    return undefined
  }
  const maybeResult = schema.safeParse(input)
@@ -93,19 +150,17 @@ const parseOrUndefined = <T>(key: string, schema: z.ZodSchema<T>, errorMessage?:
  return maybeResult.data
 }

-const parseOrUndefinedJSON = <T>(key: string, schema: z.ZodSchema<T>): T | undefined => {
-  const input = core.getInput(key)
-  // GitHub actions sets empty inputs to the empty string, but we want undefined
-  if (input === '') {
+const parseOrUndefinedJSON = <T>(key: string, schema: z.ZodType<T>): T | undefined => {
+  const input = inputOrEnvironmentVariable(key)
+  if (input === undefined) {
    return undefined
  }
  return schema.parse(JSON.parse(input))
 }

-const parseOrUndefinedList = <T>(key: string, schema: z.ZodSchema<T>): T[] | undefined => {
-  const input = core.getInput(key)
-  // GitHub actions sets empty inputs to the empty string, but we want undefined
-  if (input === '') {
+const parseOrUndefinedList = <T>(key: string, schema: z.ZodType<T>): T[] | undefined => {
+  const input = inputOrEnvironmentVariable(key)
+  if (input === undefined) {
    return undefined
  }
  return input
@@ -114,16 +169,33 @@ const parseOrUndefinedList = <T>(key: string, schema: z.ZodSchema<T>): T[] | und
    .filter((s) => s !== '')
 }

+const parseOrUndefinedMultilineList = <T>(key: string, schema: z.ZodType<T>): T[] | undefined => {
+  const input = inputOrEnvironmentVariable(key)
+  if (input === undefined) {
+    return undefined
+  }
+  return input
+    .split('\n')
+    .map((s) => schema.parse(s.trim()))
+    .filter((s) => s !== '')
+}
+
 const validateInputs = (inputs: Inputs): void => {
-  if (inputs.pixiVersion && inputs.pixiUrl) {
-    throw new Error('You need to specify either pixi-version or pixi-url')
+  if (inputs.pixiUrlHeaders && !inputs.pixiUrl) {
+    throw new Error('You need to specify pixi-url when using pixi-url-headers')
  }
  if (inputs.cacheKey !== undefined && inputs.cache === false) {
-    throw new Error('Cannot specify cache key without caching')
+    throw new Error('Cannot specify project cache key without project caching')
+  }
+  if (inputs.globalCacheKey !== undefined && inputs.globalCache === false) {
+    throw new Error('Cannot specify global cache key without global caching')
  }
  if (inputs.runInstall === false && inputs.cache === true) {
    throw new Error('Cannot cache without running install')
  }
+  if (inputs.globalCache === true && (!inputs.globalEnvironments || inputs.globalEnvironments.length === 0)) {
+    throw new Error('Cannot use global-cache without specifying global-environments')
+  }
  if (inputs.runInstall === false && inputs.frozen === true) {
    throw new Error('Cannot use `frozen: true` when not running install')
  }
@@ -136,79 +208,208 @@ const validateInputs = (inputs: Inputs): void => {
  if ((inputs.authUsername && !inputs.authPassword) || (!inputs.authUsername && inputs.authPassword)) {
    throw new Error('You need to specify both auth-username and auth-password')
  }
+  if (
+    (inputs.authS3AccessKeyId && !inputs.authS3SecretAccessKey) ||
+    (!inputs.authS3AccessKeyId && inputs.authS3SecretAccessKey)
+  ) {
+    throw new Error('You need to specify both auth-s3-access-key-id and auth-s3-secret-access-key')
+  }
+  if (inputs.authS3SessionToken && (!inputs.authS3AccessKeyId || !inputs.authS3SecretAccessKey)) {
+    throw new Error(
+      'You need to specify both auth-s3-access-key-id and auth-s3-secret-access-key when using auth-s3-session-token'
+    )
+  }
  // now we can assume that authUsername is defined iff authPassword is defined
  if (inputs.authHost) {
-    if (!inputs.authToken && !inputs.authUsername && !inputs.authCondaToken) {
+    if (!inputs.authToken && !inputs.authUsername && !inputs.authCondaToken && !inputs.authS3AccessKeyId) {
      throw new Error('You need to specify either auth-token or auth-username and auth-password or auth-conda-token')
    }
-    if (
-      (inputs.authToken && (inputs.authUsername || inputs.authCondaToken)) ||
-      (inputs.authUsername && inputs.authCondaToken)
-    ) {
-      throw new Error('You cannot specify two auth methods')
+    let authCount = 0
+    if (inputs.authToken) {
+      authCount++
+    }
+    if (inputs.authUsername) {
+      authCount++
+    }
+    if (inputs.authCondaToken) {
+      authCount++
+    }
+    if (inputs.authS3AccessKeyId) {
+      authCount++
+    }
+    if (authCount > 1) {
+      throw new Error('You cannot specify multiple auth methods')
    }
  }
  if (!inputs.authHost) {
-    if (inputs.authToken || inputs.authUsername || inputs.authCondaToken) {
+    if (inputs.authToken || inputs.authUsername || inputs.authCondaToken || inputs.authS3AccessKeyId) {
      throw new Error('You need to specify auth-host')
    }
-  }
-  if (inputs.cacheWrite && !inputs.cacheKey && !inputs.cache) {
-    throw new Error('cache-write is only valid with cache-key or cache specified.')
+    if (inputs.authLogout) {
+      throw new Error('Cannot use auth-logout without specifying auth-host')
+    }
  }
  if (inputs.runInstall === false && inputs.environments) {
    throw new Error('Cannot specify environments without running install')
  }
+  if (inputs.activateEnvironment === 'true' && inputs.environments && inputs.environments.length > 1) {
+    throw new Error('When installing multiple environments, `activate-environment` must specify the environment name')
+  }
+}
+
+const determinePixiInstallation = (pixiUrlOrVersionSet: boolean, pixiBinPath: string | undefined) => {
+  const preinstalledPixi = which.sync('pixi', { nothrow: true })
+
+  if (pixiUrlOrVersionSet || pixiBinPath) {
+    if (preinstalledPixi) {
+      core.debug(`Local pixi found at ${preinstalledPixi} is being ignored.`)
+    }
+    return {
+      downloadPixi: true,
+      pixiBinPath: pixiBinPath ? path.resolve(untildify(pixiBinPath)) : PATHS.pixiBin
+    }
+  }
+
+  if (preinstalledPixi) {
+    core.info(`Using pre-installed pixi at ${preinstalledPixi}`)
+    return { downloadPixi: false, pixiBinPath: preinstalledPixi }
+  }
+
+  return { downloadPixi: true, pixiBinPath: PATHS.pixiBin }
 }

 const inferOptions = (inputs: Inputs): Options => {
  const runInstall = inputs.runInstall ?? true
-  const pixiSource = inputs.pixiVersion
-    ? { version: inputs.pixiVersion }
-    : inputs.pixiUrl
-      ? { url: inputs.pixiUrl }
-      : { version: 'latest' }
+  const pixiSource: PixiSource = {
+    urlTemplate: inputs.pixiUrl ?? DEFAULT_PIXI_URL_TEMPLATE,
+    headers: inputs.pixiUrlHeaders,
+    version: inputs.pixiVersion ?? 'latest'
+  }
+
+  const { downloadPixi, pixiBinPath } = determinePixiInstallation(
+    !!inputs.pixiVersion || !!inputs.pixiUrl,
+    inputs.pixiBinPath
+  )
  const logLevel = inputs.logLevel ?? (core.isDebug() ? 'vv' : 'default')
-  const manifestPath = inputs.manifestPath ? path.resolve(untildify(inputs.manifestPath)) : 'pixi.toml'
-  const pixiLockFile = path.join(path.dirname(manifestPath), path.basename(manifestPath).replace(/\.toml$/, '.lock'))
+
+  // Determine the working directory - resolve to absolute path if provided
+  const workingDirectory = inputs.workingDirectory ? path.resolve(untildify(inputs.workingDirectory)) : process.cwd()
+  core.debug(`Working directory: ${workingDirectory}`)
+
+  // infer manifest path from inputs or default to pixi.toml or pyproject.toml depending on what is present in the working directory.
+  const pixiTomlPathInWorkingDir = path.join(workingDirectory, pixiPath)
+  const pyprojectTomlPathInWorkingDir = path.join(workingDirectory, pyprojectPath)
+
+  let manifestPath = pixiTomlPathInWorkingDir // default
+  if (inputs.manifestPath) {
+    // If manifest path is provided, resolve it relative to working directory if it's not absolute
+    manifestPath = path.isAbsolute(inputs.manifestPath)
+      ? path.resolve(untildify(inputs.manifestPath))
+      : path.resolve(workingDirectory, inputs.manifestPath)
+  } else {
+    if (existsSync(pixiTomlPathInWorkingDir)) {
+      manifestPath = pixiTomlPathInWorkingDir
+      core.debug(`Found pixi.toml at: ${manifestPath}`)
+    } else if (existsSync(pyprojectTomlPathInWorkingDir)) {
+      try {
+        const fileContent = readFileSync(pyprojectTomlPathInWorkingDir, 'utf-8')
+        const parsedContent: Record<string, unknown> = parse(fileContent)
+
+        // Test if the tool.pixi table is present in the pyproject.toml file, if so, use it as the manifest file.
+        if (parsedContent.tool && typeof parsedContent.tool === 'object' && 'pixi' in parsedContent.tool) {
+          core.debug(`The tool.pixi table found, using ${pyprojectTomlPathInWorkingDir} as manifest file.`)
+          manifestPath = pyprojectTomlPathInWorkingDir
+        }
+      } catch (error) {
+        core.error(`Error while trying to read ${pyprojectTomlPathInWorkingDir} file.`)
+        core.error(error as Error)
+      }
+    } else if (runInstall) {
+      core.warning(
+        `Could not find any manifest file in ${workingDirectory}. Defaulting to ${pixiTomlPathInWorkingDir}.`
+      )
+    }
+  }
+
+  const pixiLockFile = path.join(path.dirname(manifestPath), 'pixi.lock')
  const lockFileAvailable = existsSync(pixiLockFile)
-  core.debug(`lockFileAvailable: ${lockFileAvailable}`)
-  const cache = inputs.cacheKey
-    ? { cacheKeyPrefix: inputs.cacheKey, cacheWrite: inputs.cacheWrite ?? true }
-    : inputs.cache === true || (lockFileAvailable && inputs.cache !== false)
-      ? { cacheKeyPrefix: 'pixi-', cacheWrite: true }
+  core.debug(`lockFileAvailable: ${lockFileAvailable ? 'yes' : 'no'}`)
+  if (!lockFileAvailable && inputs.cacheWrite === true) {
+    throw new Error('You cannot specify cache-write = true without a lock file present')
+  }
+  let activatedEnvironment // default is undefined
+  if (inputs.activateEnvironment === 'true') {
+    if (inputs.environments) {
+      activatedEnvironment = inputs.environments[0]
+    } else {
+      activatedEnvironment = 'default'
+    }
+  } else if (inputs.activateEnvironment && inputs.activateEnvironment !== 'false') {
+    activatedEnvironment = inputs.activateEnvironment
+  }
+  const cache =
+    inputs.cache === true || (lockFileAvailable && inputs.cache !== false)
+      ? {
+          cacheKeyPrefix: inputs.cacheKey ?? 'pixi-',
+          cacheWrite: inputs.cacheWrite ?? true
+        }
+      : undefined
+  const globalCache =
+    inputs.globalCache === true && inputs.globalEnvironments && inputs.globalEnvironments.length > 0
+      ? {
+          cacheKeyPrefix: inputs.globalCacheKey ?? 'pixi-global-',
+          cacheWrite: inputs.cacheWrite ?? true
+        }
      : undefined
-  const pixiBinPath = inputs.pixiBinPath ? path.resolve(untildify(inputs.pixiBinPath)) : PATHS.pixiBin
  const frozen = inputs.frozen ?? false
  const locked = inputs.locked ?? (lockFileAvailable && !frozen)
+  const authLogout = inputs.authLogout ?? 'post'
  const auth = !inputs.authHost
    ? undefined
    : ((inputs.authToken
        ? {
            host: inputs.authHost,
-            token: inputs.authToken
+            token: inputs.authToken,
+            logout: authLogout
          }
        : inputs.authCondaToken
          ? {
              host: inputs.authHost,
-              condaToken: inputs.authCondaToken
+              condaToken: inputs.authCondaToken,
+              logout: authLogout
            }
-          : {
-              host: inputs.authHost,
-              username: inputs.authUsername!,
-              password: inputs.authPassword!
-            }) as Auth)
-  const postCleanup = inputs.postCleanup ?? true
+          : inputs.authUsername
+            ? {
+                host: inputs.authHost,
+                username: inputs.authUsername,
+                password: inputs.authPassword,
+                logout: authLogout
+              }
+            : {
+                host: inputs.authHost,
+                s3AccessKeyId: inputs.authS3AccessKeyId,
+                s3SecretAccessKey: inputs.authS3SecretAccessKey,
+                s3SessionToken: inputs.authS3SessionToken,
+                logout: authLogout
+              }) as Auth)
+  const postCleanup = inputs.postCleanup ?? false
+  const pypiKeyringProvider = inputs.pypiKeyringProvider
  return {
+    globalEnvironments: inputs.globalEnvironments,
    pixiSource,
+    pypiKeyringProvider,
+    downloadPixi,
    logLevel,
    manifestPath,
+    workingDirectory,
    pixiLockFile,
    runInstall,
    environments: inputs.environments,
+    activatedEnvironment,
    frozen,
    locked,
    cache,
+    globalCache,
    pixiBinPath,
    auth,
    postCleanup
@@ -225,25 +426,35 @@ const assertOptions = (_options: Options) => {
 }

 const getOptions = () => {
+  if (inputOrEnvironmentVariable('persist-credentials') !== undefined) {
+    throw new Error(
+      '`persist-credentials` has been removed, use `auth-logout: after-install` (instead of `false`) or `auth-logout: never` (instead of `true`).'
+    )
+  }
  const inputs: Inputs = {
    pixiVersion: parseOrUndefined(
      'pixi-version',
      z.union([z.literal('latest'), z.string().regex(/^v\d+\.\d+\.\d+$/)]),
      'pixi-version must either be `latest` or a version string matching `vX.Y.Z`.'
    ),
-    pixiUrl: parseOrUndefined('pixi-url', z.string().url()),
+    pixiUrl: parseOrUndefined('pixi-url', z.string()),
+    pixiUrlHeaders: parseOrUndefinedJSON('pixi-url-headers', z.record(z.string(), z.string())),
    logLevel: parseOrUndefined(
      'log-level',
      logLevelSchema,
      'log-level must be one of `q`, `default`, `v`, `vv`, `vvv`.'
    ),
    manifestPath: parseOrUndefined('manifest-path', z.string()),
+    workingDirectory: parseOrUndefined('working-directory', z.string()),
    runInstall: parseOrUndefinedJSON('run-install', z.boolean()),
    environments: parseOrUndefinedList('environments', z.string()),
+    activateEnvironment: parseOrUndefined('activate-environment', z.string()),
    locked: parseOrUndefinedJSON('locked', z.boolean()),
    frozen: parseOrUndefinedJSON('frozen', z.boolean()),
    cache: parseOrUndefinedJSON('cache', z.boolean()),
+    globalCache: parseOrUndefinedJSON('global-cache', z.boolean()),
    cacheKey: parseOrUndefined('cache-key', z.string()),
+    globalCacheKey: parseOrUndefined('global-cache-key', z.string()),
    cacheWrite: parseOrUndefinedJSON('cache-write', z.boolean()),
    pixiBinPath: parseOrUndefined('pixi-bin-path', z.string()),
    authHost: parseOrUndefined('auth-host', z.string()),
@@ -251,6 +462,16 @@ const getOptions = () => {
    authUsername: parseOrUndefined('auth-username', z.string()),
    authPassword: parseOrUndefined('auth-password', z.string()),
    authCondaToken: parseOrUndefined('auth-conda-token', z.string()),
+    authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
+    authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
+    authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
+    authLogout: parseOrUndefined(
+      'auth-logout',
+      authLogoutSchema,
+      'auth-logout must be one of `post`, `after-install`, `never`.'
+    ),
+    pypiKeyringProvider: parseOrUndefined('pypi-keyring-provider', pypiKeyringProviderSchema),
+    globalEnvironments: parseOrUndefinedMultilineList('global-environments', z.string()),
    postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
  }
  core.debug(`Inputs: ${JSON.stringify(inputs)}`)
@@ -279,3 +500,10 @@ try {
 }

 export const options = _options
+export const assertAuth = () => {
+  const auth = options.auth
+  if (!auth) {
+    throw new Error('Authentication configuration is missing.')
+  }
+  return auth
+}
@@ -1,30 +1,38 @@
 import fs from 'fs/promises'
+import { existsSync } from 'fs'
 import path from 'path'
-import * as os from 'os'
+import os from 'os'
 import { exit } from 'process'
 import * as core from '@actions/core'
 import { options } from './options'
+import { execute, pixiCmd } from './util'

 const removeEmptyParentDirs = (dirPath: string): Promise<void> => {
-  return fs.readdir(dirPath).then((files) => {
-    if (files.length === 0) {
-      core.debug(`Removing empty directory ${dirPath}.`)
-      return fs.rm(dirPath, { recursive: true }).then(() => {
-        const parentDir = path.dirname(dirPath)
-        if (parentDir !== dirPath) {
-          return removeEmptyParentDirs(parentDir)
-        }
-      })
-    }
-    return Promise.resolve()
-  })
+  if (existsSync(dirPath)) {
+    return fs.readdir(dirPath).then((files) => {
+      if (files.length === 0) {
+        core.debug(`Removing empty directory ${dirPath}.`)
+        return fs.rm(dirPath, { recursive: true, force: true }).then(() => {
+          const parentDir = path.dirname(dirPath)
+          if (parentDir !== dirPath) {
+            return removeEmptyParentDirs(parentDir)
+          }
+        })
+      }
+    })
+  }
+  return Promise.resolve()
 }

 const cleanupPixiBin = () => {
  const pixiBinPath = options.pixiBinPath
  const pixiBinDir = path.dirname(pixiBinPath)
  core.debug(`Cleaning up pixi binary ${pixiBinPath}.`)
-  return fs.rm(pixiBinPath).then(() => removeEmptyParentDirs(pixiBinDir))
+  if (existsSync(pixiBinPath)) {
+    return fs.rm(pixiBinPath).then(() => removeEmptyParentDirs(pixiBinDir))
+  } else {
+    return removeEmptyParentDirs(pixiBinDir)
+  }
 }

 const cleanupEnv = () => {
@@ -34,10 +42,15 @@ const cleanupEnv = () => {
  }
  const envDir = path.join(path.dirname(options.manifestPath), '.pixi')
  core.debug(`Cleaning up .pixi directory ${envDir}.`)
-  return fs.rm(envDir, { recursive: true })
+  return fs.rm(envDir, {
+    recursive: true,
+    // Ignore exceptions if environment does not exist anymore,
+    // to avoid errors if setup-pixi is used multiple times within the same workflow.
+    force: true
+  })
 }

-const determineCacheDir = () => {
+const determineCacheDir = (): string => {
  // rattler uses dirs::cache_dir https://docs.rs/dirs/latest/dirs/fn.cache_dir.html
  if (os.platform() === 'win32') {
    return process.env.LOCALAPPDATA!
@@ -59,25 +72,45 @@ const cleanupRattler = () => {
  ])
 }

-const run = () => {
-  const postCleanup = options.postCleanup
-  if (postCleanup) {
-    return Promise.all([cleanupPixiBin(), cleanupEnv(), cleanupRattler()])
+const pixiLogout = async () => {
+  const auth = options.auth
+  if (auth?.logout !== 'post') {
+    core.debug('Skipping pixi logout.')
+    return
  }
-  core.debug('Skipping post-cleanup.')
-  return Promise.resolve()
+  if (!existsSync(options.pixiBinPath)) {
+    core.debug(`Skipping pixi logout, pixi binary ${options.pixiBinPath} does not exist.`)
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
+  })
 }

-run().catch((error) => {
-  if (core.isDebug()) {
+const run = async () => {
+  // needs to happen before the cleanup since that removes the pixi binary
+  await pixiLogout()
+  const postCleanup = options.postCleanup
+  if (postCleanup) {
+    await Promise.all([cleanupPixiBin(), cleanupEnv(), cleanupRattler()])
+    return
+  }
+  core.debug('Skipping post-cleanup.')
+}
+
+run()
+  .then(() => exit(0)) // workaround for https://github.com/actions/toolkit/issues/1578
+  .catch((error: unknown) => {
+    if (core.isDebug()) {
+      throw error
+    }
+    if (error instanceof Error) {
+      core.setFailed(error.message)
+      exit(1)
+    } else if (typeof error === 'string') {
+      core.setFailed(error)
+      exit(1)
+    }
    throw error
-  }
-  if (error instanceof Error) {
-    core.setFailed(error.message)
-    exit(1)
-  } else if (typeof error === 'string') {
-    core.setFailed(error)
-    exit(1)
-  }
-  throw error
-})
+  })
@@ -1,9 +1,17 @@
-import type { BinaryLike } from 'crypto'
 import { createHash } from 'crypto'
-import * as os from 'os'
+import os from 'os'
 import * as core from '@actions/core'
-import { exec } from '@actions/exec'
+import type { ExecOptions } from '@actions/exec'
+import { exec, getExecOutput } from '@actions/exec'
 import { options } from './options'
+import Handlebars from 'handlebars'
+
+export const DEFAULT_PIXI_URL_TEMPLATE = `\
+{{#if latest~}}
+https://github.com/prefix-dev/pixi/releases/latest/download/{{pixiFile}}
+{{~else~}}
+https://github.com/prefix-dev/pixi/releases/download/{{version}}/{{pixiFile}}
+{{~/if}}`

 export const getCondaArch = () => {
  const archDict: Record<string, string> = {
@@ -12,7 +20,9 @@ export const getCondaArch = () => {
    'linux-x64': 'linux-64',
    'linux-arm64': 'linux-aarch64',
    'linux-ppc64': 'linux-ppc64le',
-    'win32-x64': 'win-64'
+    'linux-riscv64': 'linux-riscv64',
+    'win32-x64': 'win-64',
+    'win32-arm64': 'win-arm64'
  }
  const arch = archDict[`${os.platform()}-${os.arch()}`]
  if (!arch) {
@@ -23,15 +33,21 @@ export const getCondaArch = () => {

 const getPlatform = () => {
  const platform = os.platform()
+  const arch = os.arch()
+
  switch (platform) {
    case 'darwin':
      return 'apple-darwin'
    case 'linux':
+      if (arch == 'riscv64') {
+        // https://github.com/prefix-dev/pixi/issues/6903
+        return 'unknown-linux-gnu'
+      }
      return 'unknown-linux-musl'
    case 'win32':
      return 'pc-windows-msvc'
    default:
-      throw new Error(`Unsupported architecture: ${platform}`)
+      throw new Error(`Unsupported platform: ${platform}`)
  }
 }

@@ -42,39 +58,51 @@ const getArch = () => {
      return 'x86_64'
    case 'arm64':
      return 'aarch64'
+    case 'riscv64':
+      return 'riscv64gc'
    default:
      throw new Error(`Unsupported architecture: ${arch}`)
  }
 }

-export const getPixiUrlFromVersion = (version: string) => {
+export const renderPixiUrl = (urlTemplate: string, version: string) => {
+  const latest = version == 'latest'
  const arch = getArch()
  const platform = getPlatform()
  const pixiFile = `pixi-${arch}-${platform}${platform === 'pc-windows-msvc' ? '.exe' : ''}`
-  if (arch === 'aarch64' && platform === 'pc-windows-msvc') {
-    throw new Error('Windows on ARM is currently not supported')
-  }
-  if (version === 'latest') {
-    return `https://github.com/prefix-dev/pixi/releases/latest/download/${pixiFile}`
-  }
-  return `https://github.com/prefix-dev/pixi/releases/download/${version}/${pixiFile}`
+  const template = Handlebars.compile(urlTemplate)
+  return template({
+    version,
+    latest,
+    pixiFile
+  })
 }

-export const sha256 = (s: BinaryLike) => {
+export const sha256 = (s: string | NodeJS.ArrayBufferView) => {
  return createHash('sha256').update(s).digest('hex')
 }

-export const sha256Short = (s: BinaryLike) => {
+export const sha256Short = (s: string | NodeJS.ArrayBufferView) => {
  return sha256(s).slice(0, 7)
 }

 export const execute = (cmd: string[]) => {
-  core.debug(`Executing: ${cmd.join(' ')}`)
-  return exec(cmd[0], cmd.slice(1))
+  core.debug(`Executing: \`${cmd.toString()}\``)
+  // needs escaping if cmd[0] contains spaces
+  // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
+  return exec(`"${cmd[0]}"`, cmd.slice(1), { cwd: options.workingDirectory })
+}
+
+export const executeGetOutput = (cmd: string[], execOptions: ExecOptions) => {
+  core.debug(`Executing: \`${cmd.toString()}\``)
+  // needs escaping if cmd[0] contains spaces
+  // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
+  const defaultOptions = { cwd: options.workingDirectory }
+  return getExecOutput(`"${cmd[0]}"`, cmd.slice(1), { ...defaultOptions, ...execOptions })
 }

 export const pixiCmd = (command: string, withManifestPath = true) => {
-  let commandArray = [options.pixiBinPath].concat(command.split(' '))
+  let commandArray = [options.pixiBinPath].concat(command.split(' ').filter((x) => x !== ''))
  if (withManifestPath) {
    commandArray = commandArray.concat(['--manifest-path', options.manifestPath])
  }
@@ -0,0 +1,13 @@
+[workspace]
+name = "test-auth-s3"
+channels = ["s3://rattler-s3-testing/channel", "conda-forge"]
+platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]
+
+[workspace.s3-options.rattler-s3-testing]
+endpoint-url = "https://e1a7cde76f1780ec06bac859036dbaf7.eu.r2.cloudflarestorage.com"
+force-path-style = true
+region = "auto"
+
+[dependencies]
+my-webserver = "*"
+python = "*"
@@ -1,8 +1,5 @@
-[project]
+[workspace]
 name = "test-auth"
-version = "0.1.0"
-description = "Add a short description here"
-authors = ["Pavel"]
 channels = ["conda-forge", "https://repo.prefix.dev/setup-pixi-test"]
 platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]

@@ -0,0 +1,229 @@
+version: 6
+environments:
+  default:
+    channels:
+    - url: https://conda.anaconda.org/conda-forge/
+    packages:
+      linux-64:
+      - conda: https://conda.anaconda.org/conda-forge/linux-64/_libgcc_mutex-0.1-conda_forge.tar.bz2
+      - conda: https://conda.anaconda.org/conda-forge/linux-64/_openmp_mutex-4.5-2_gnu.tar.bz2
+      - conda: https://conda.anaconda.org/conda-forge/linux-64/bzip2-1.0.8-h4bc722e_7.conda
+      - conda: https://conda.anaconda.org/conda-forge/linux-64/libgcc-14.2.0-h767d61c_2.conda
+      - conda: https://conda.anaconda.org/conda-forge/linux-64/libgcc-ng-14.2.0-h69a702a_2.conda
+      - conda: https://conda.anaconda.org/conda-forge/linux-64/libgomp-14.2.0-h767d61c_2.conda
+      linux-aarch64:
+      - conda: https://conda.anaconda.org/conda-forge/linux-aarch64/_openmp_mutex-4.5-2_gnu.tar.bz2
+      - conda: https://conda.anaconda.org/conda-forge/linux-aarch64/bzip2-1.0.8-h68df207_7.conda
+      - conda: https://conda.anaconda.org/conda-forge/linux-aarch64/libgcc-14.2.0-he277a41_2.conda
+      - conda: https://conda.anaconda.org/conda-forge/linux-aarch64/libgcc-ng-14.2.0-he9431aa_2.conda
+      - conda: https://conda.anaconda.org/conda-forge/linux-aarch64/libgomp-14.2.0-he277a41_2.conda
+      osx-64:
+      - conda: https://conda.anaconda.org/conda-forge/osx-64/bzip2-1.0.8-hfdf4475_7.conda
+      osx-arm64:
+      - conda: https://conda.anaconda.org/conda-forge/osx-arm64/bzip2-1.0.8-h99b78c6_7.conda
+      win-64:
+      - conda: https://conda.anaconda.org/conda-forge/win-64/bzip2-1.0.8-h2466b09_7.conda
+      - conda: https://conda.anaconda.org/conda-forge/win-64/ucrt-10.0.22621.0-h57928b3_1.conda
+      - conda: https://conda.anaconda.org/conda-forge/win-64/vc-14.3-h2b53caa_26.conda
+      - conda: https://conda.anaconda.org/conda-forge/win-64/vc14_runtime-14.42.34438-hfd919c2_26.conda
+      win-arm64:
+      - conda: https://conda.anaconda.org/conda-forge/win-arm64/bzip2-1.0.8-hfbbf558_7.conda
+      - conda: https://conda.anaconda.org/conda-forge/win-arm64/vc-14.3-hfe6595e_26.conda
+      - conda: https://conda.anaconda.org/conda-forge/win-arm64/vc14_runtime-14.42.34438-hfe4e545_26.conda
+packages:
+- conda: https://conda.anaconda.org/conda-forge/linux-64/_libgcc_mutex-0.1-conda_forge.tar.bz2
+  sha256: fe51de6107f9edc7aa4f786a70f4a883943bc9d39b3bb7307c04c41410990726
+  md5: d7c89558ba9fa0495403155b64376d81
+  license: None
+  size: 2562
+  timestamp: 1578324546067
+- conda: https://conda.anaconda.org/conda-forge/linux-64/_openmp_mutex-4.5-2_gnu.tar.bz2
+  build_number: 16
+  sha256: fbe2c5e56a653bebb982eda4876a9178aedfc2b545f25d0ce9c4c0b508253d22
+  md5: 73aaf86a425cc6e73fcf236a5a46396d
+  depends:
+  - _libgcc_mutex 0.1 conda_forge
+  - libgomp >=7.5.0
+  constrains:
+  - openmp_impl 9999
+  license: BSD-3-Clause
+  license_family: BSD
+  size: 23621
+  timestamp: 1650670423406
+- conda: https://conda.anaconda.org/conda-forge/linux-aarch64/_openmp_mutex-4.5-2_gnu.tar.bz2
+  build_number: 16
+  sha256: 3702bef2f0a4d38bd8288bbe54aace623602a1343c2cfbefd3fa188e015bebf0
+  md5: 6168d71addc746e8f2b8d57dfd2edcea
+  depends:
+  - libgomp >=7.5.0
+  constrains:
+  - openmp_impl 9999
+  license: BSD-3-Clause
+  license_family: BSD
+  size: 23712
+  timestamp: 1650670790230
+- conda: https://conda.anaconda.org/conda-forge/linux-64/bzip2-1.0.8-h4bc722e_7.conda
+  sha256: 5ced96500d945fb286c9c838e54fa759aa04a7129c59800f0846b4335cee770d
+  md5: 62ee74e96c5ebb0af99386de58cf9553
+  depends:
+  - __glibc >=2.17,<3.0.a0
+  - libgcc-ng >=12
+  license: bzip2-1.0.6
+  license_family: BSD
+  size: 252783
+  timestamp: 1720974456583
+- conda: https://conda.anaconda.org/conda-forge/linux-aarch64/bzip2-1.0.8-h68df207_7.conda
+  sha256: 2258b0b33e1cb3a9852d47557984abb6e7ea58e3d7f92706ec1f8e879290c4cb
+  md5: 56398c28220513b9ea13d7b450acfb20
+  depends:
+  - libgcc-ng >=12
+  license: bzip2-1.0.6
+  license_family: BSD
+  size: 189884
+  timestamp: 1720974504976
+- conda: https://conda.anaconda.org/conda-forge/osx-64/bzip2-1.0.8-hfdf4475_7.conda
+  sha256: cad153608b81fb24fc8c509357daa9ae4e49dfc535b2cb49b91e23dbd68fc3c5
+  md5: 7ed4301d437b59045be7e051a0308211
+  depends:
+  - __osx >=10.13
+  license: bzip2-1.0.6
+  license_family: BSD
+  size: 134188
+  timestamp: 1720974491916
+- conda: https://conda.anaconda.org/conda-forge/osx-arm64/bzip2-1.0.8-h99b78c6_7.conda
+  sha256: adfa71f158cbd872a36394c56c3568e6034aa55c623634b37a4836bd036e6b91
+  md5: fc6948412dbbbe9a4c9ddbbcfe0a79ab
+  depends:
+  - __osx >=11.0
+  license: bzip2-1.0.6
+  license_family: BSD
+  size: 122909
+  timestamp: 1720974522888
+- conda: https://conda.anaconda.org/conda-forge/win-64/bzip2-1.0.8-h2466b09_7.conda
+  sha256: 35a5dad92e88fdd7fc405e864ec239486f4f31eec229e31686e61a140a8e573b
+  md5: 276e7ffe9ffe39688abc665ef0f45596
+  depends:
+  - ucrt >=10.0.20348.0
+  - vc >=14.2,<15
+  - vc14_runtime >=14.29.30139
+  license: bzip2-1.0.6
+  license_family: BSD
+  size: 54927
+  timestamp: 1720974860185
+- conda: https://conda.anaconda.org/conda-forge/win-arm64/bzip2-1.0.8-hfbbf558_7.conda
+  sha256: f6b3f14c17f7aebe0ac88e74957644da17288b1b78f8776ed4f04a4e6e4a7d9c
+  md5: 86d73707c1a3db358fb0b42fb6e33add
+  depends:
+  - vc >=14.3,<15
+  - vc14_runtime >=14.40.33810
+  license: bzip2-1.0.6
+  license_family: BSD
+  size: 54629
+  timestamp: 1720974690059
+- conda: https://conda.anaconda.org/conda-forge/linux-64/libgcc-14.2.0-h767d61c_2.conda
+  sha256: 3a572d031cb86deb541d15c1875aaa097baefc0c580b54dc61f5edab99215792
+  md5: ef504d1acbd74b7cc6849ef8af47dd03
+  depends:
+  - __glibc >=2.17,<3.0.a0
+  - _openmp_mutex >=4.5
+  constrains:
+  - libgomp 14.2.0 h767d61c_2
+  - libgcc-ng ==14.2.0=*_2
+  license: GPL-3.0-only WITH GCC-exception-3.1
+  license_family: GPL
+  size: 847885
+  timestamp: 1740240653082
+- conda: https://conda.anaconda.org/conda-forge/linux-aarch64/libgcc-14.2.0-he277a41_2.conda
+  sha256: a57f7f9ba2a12f56eafdcd25b6d75f7be10b8fc1a802a58b76a77ca8c66f4503
+  md5: 6b4268a60b10f29257b51b9b67ff8d76
+  depends:
+  - _openmp_mutex >=4.5
+  constrains:
+  - libgcc-ng ==14.2.0=*_2
+  - libgomp 14.2.0 he277a41_2
+  license: GPL-3.0-only WITH GCC-exception-3.1
+  license_family: GPL
+  size: 535507
+  timestamp: 1740241069780
+- conda: https://conda.anaconda.org/conda-forge/linux-64/libgcc-ng-14.2.0-h69a702a_2.conda
+  sha256: fb7558c328b38b2f9d2e412c48da7890e7721ba018d733ebdfea57280df01904
+  md5: a2222a6ada71fb478682efe483ce0f92
+  depends:
+  - libgcc 14.2.0 h767d61c_2
+  license: GPL-3.0-only WITH GCC-exception-3.1
+  license_family: GPL
+  size: 53758
+  timestamp: 1740240660904
+- conda: https://conda.anaconda.org/conda-forge/linux-aarch64/libgcc-ng-14.2.0-he9431aa_2.conda
+  sha256: 9647f75cddc18b07eebe6e1f21500eed50a6af2c43c84e831b4c7a597e10d226
+  md5: 692c2bb75f32cfafb6799cf6d1c5d0e0
+  depends:
+  - libgcc 14.2.0 he277a41_2
+  license: GPL-3.0-only WITH GCC-exception-3.1
+  license_family: GPL
+  size: 53622
+  timestamp: 1740241074834
+- conda: https://conda.anaconda.org/conda-forge/linux-64/libgomp-14.2.0-h767d61c_2.conda
+  sha256: 1a3130e0b9267e781b89399580f3163632d59fe5b0142900d63052ab1a53490e
+  md5: 06d02030237f4d5b3d9a7e7d348fe3c6
+  depends:
+  - __glibc >=2.17,<3.0.a0
+  license: GPL-3.0-only WITH GCC-exception-3.1
+  license_family: GPL
+  size: 459862
+  timestamp: 1740240588123
+- conda: https://conda.anaconda.org/conda-forge/linux-aarch64/libgomp-14.2.0-he277a41_2.conda
+  sha256: 4e303711fb7413bf98995beac58e731073099d7a669a3b81e49330ca8da05174
+  md5: b11c09d9463daf4cae492d29806b1889
+  license: GPL-3.0-only WITH GCC-exception-3.1
+  license_family: GPL
+  size: 462783
+  timestamp: 1740241005079
+- conda: https://conda.anaconda.org/conda-forge/win-64/ucrt-10.0.22621.0-h57928b3_1.conda
+  sha256: db8dead3dd30fb1a032737554ce91e2819b43496a0db09927edf01c32b577450
+  md5: 6797b005cd0f439c4c5c9ac565783700
+  constrains:
+  - vs2015_runtime >=14.29.30037
+  license: LicenseRef-MicrosoftWindowsSDK10
+  size: 559710
+  timestamp: 1728377334097
+- conda: https://conda.anaconda.org/conda-forge/win-64/vc-14.3-h2b53caa_26.conda
+  sha256: 7a685b5c37e9713fa314a0d26b8b1d7a2e6de5ab758698199b5d5b6dba2e3ce1
+  md5: d3f0381e38093bde620a8d85f266ae55
+  depends:
+  - vc14_runtime >=14.42.34433
+  track_features:
+  - vc14
+  license: BSD-3-Clause
+  license_family: BSD
+  size: 17893
+  timestamp: 1743195261486
+- conda: https://conda.anaconda.org/conda-forge/win-arm64/vc-14.3-hfe6595e_26.conda
+  sha256: dc8f1cbbfd91e267a05cdf9bb0a04e983f9df6b02885446dfe0d796c99e67e0a
+  md5: a57c01b43b14be7d028c84bad0bc1599
+  depends:
+  - vc14_runtime >=14.42.34438
+  track_features:
+  - vc14
+  license: BSD-3-Clause
+  license_family: BSD
+  size: 17394
+  timestamp: 1743194837327
+- conda: https://conda.anaconda.org/conda-forge/win-64/vc14_runtime-14.42.34438-hfd919c2_26.conda
+  sha256: 30dcb71bb166e351aadbdc18f1718757c32cdaa0e1e5d9368469ee44f6bf4709
+  md5: 91651a36d31aa20c7ba36299fb7068f4
+  depends:
+  - ucrt >=10.0.20348.0
+  constrains:
+  - vs2015_runtime 14.42.34438.* *_26
+  license: LicenseRef-MicrosoftVisualCpp2015-2022Runtime
+  license_family: Proprietary
+  size: 750733
+  timestamp: 1743195092905
+- conda: https://conda.anaconda.org/conda-forge/win-arm64/vc14_runtime-14.42.34438-hfe4e545_26.conda
+  sha256: 37cf20eb09cf77e261d61ba40b322e010a7043b4247f01420f8241bd68a683ba
+  md5: 1995ed932d07efb2fe632778484f9fbb
+  license: LicenseRef-MicrosoftVisualCpp2015-2022Runtime
+  license_family: Proprietary
+  size: 15480436
+  timestamp: 1743194808631
@@ -0,0 +1,14 @@
+[workspace]
+name = "test-win-arm64"
+channels = ["conda-forge"]
+platforms = [
+  "linux-64",
+  "linux-aarch64",
+  "osx-64",
+  "osx-arm64",
+  "win-64",
+  "win-arm64",
+]
+
+[dependencies]
+bzip2 = "*"
@@ -1,13 +1,19 @@
-[project]
+[workspace]
 name = "test-default"
-version = "0.1.0"
-description = "Add a short description here"
-authors = ["Pavel Zwerschke <pavelzw@gmail.com>"]
 channels = ["conda-forge"]
-platforms = ["linux-64", "osx-64", "osx-arm64", "win-64"]
+platforms = [
+  "linux-64",
+  "linux-aarch64",
+  "linux-riscv64",
+  "linux-ppc64le",
+  "osx-64",
+  "osx-arm64",
+  "win-64",
+  "win-arm64",
+]

 [tasks]
 test = "python -c 'print(\"Hello world!\")'"

 [dependencies]
-python = "3.11.*"
+python = "3.14.*"
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-default"
 version = "0.1.0"
 description = "Add a short description here"
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-package"
 channels = ["conda-forge"]
 platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]
@@ -1,10 +1,7 @@
-[project]
+[workspace]
 name = "test-no-lockfile"
-version = "0.1.0"
-description = "Add a short description here"
-authors = ["Pavel Zwerschke <pavelzw@gmail.com>"]
 channels = ["conda-forge"]
-platforms = ["linux-64", "osx-64", "win-64"]
+platforms = ["linux-64", "linux-aarch64", "osx-64", "osx-arm64", "win-64"]

 [tasks]
 test = "python -c 'print(\"Hello world!\")'"
@@ -0,0 +1,47 @@
+[project]
+name = "pyproject-manifest"
+version = "0.1.0"
+description = "Testing pyproject-manifest."
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = ["flask==2.*"]
+
+[build-system]
+requires = ["setuptools", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[dependency-groups]
+# inline lists with mixed types are a toml 1.0 feature
+dev = [{ include-group = "lint" }, { include-group = "docs" }, "ipython"]
+docs = ["mkdocs>=1.4"]
+lint = ["ruff>=0.1.14"]
+
+[tool.ruff]
+target-version = "py310"
+line-length = 100
+exclude = [".pixi", "__pycache__"]
+# the TOML parser should also support comments in lists
+lint.select = [
+  # flake8-bugbear
+  "B",
+  # flake8-comprehensions
+  "C4",
+  # pydocstyle
+  "D",
+  # Error
+  "E",
+  # pyflakes
+  "F",
+]
+
+[tool.pixi.workspace]
+name = "pyproject-manifest"
+channels = ["conda-forge"]
+platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]
+
+[tool.pixi]
+# This dotted inline table fails with the `toml` parser, but works with `@iarna/toml`.
+pypi-dependencies.boltons = "*"
+
+[tool.pixi.tasks]
+test = "echo 'Running tests...'"
@@ -1,12 +1,14 @@
 {
  "compilerOptions": {
-    "target": "es6",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
-    "outDir": "./lib",                        /* Redirect output structure to the directory. */
-    "rootDir": "./src",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
-    "strict": true,                           /* Enable all strict type-checking options. */
-    "noImplicitAny": true,                    /* Raise error on expressions and declarations with an implied 'any' type. */
-    "esModuleInterop": true                   /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "module": "CommonJS" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
+    "outDir": "./lib" /* Redirect output structure to the directory. */,
+    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
+    "strict": true /* Enable all strict type-checking options. */,
+    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
+    "types": ["node"],
+    "skipLibCheck": true
  },
  "exclude": ["node_modules", "**/*.test.ts"]
 }
@@ -8,9 +8,17 @@ export default defineConfig({
  dts: false,
  clean: true,
  target: 'es2020',
-  format: ['cjs'],
-  sourcemap: true,
+  format: 'cjs',
+  sourcemap: false,
+  platform: 'node',
  minify: false,
+  // shim `import.meta.url` in CJS output; some deps (e.g. @azure/storage-common) rely on it
+  shims: true,
+  outExtension() {
+    return {
+      js: '.js'
+    }
+  },
  // need to bundle dependencies because they aren't available otherwise when run inside the action
  noExternal: [
    '@actions/core',
@@ -18,7 +26,10 @@ export default defineConfig({
    '@actions/cache',
    '@actions/io',
    '@actions/tool-cache',
+    'handlebars',
    'untildify',
+    'smol-toml',
+    'which',
    'zod'
  ]
 })