refactor: Use smol-toml instead of js-toml (#195)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>

.gitattributes

@@ -1 +1 @@
-dist/** -diff linguist-generated=true
+dist/** merge=binary -diff linguist-generated=true

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,3 @@
 If updating documentation:
 
-- [ ] Updated documentation in https://github.com/prefix-dev/pixi/blob/main/docs/advanced/github_actions.md as well
+- [ ] Updated documentation in https://github.com/prefix-dev/pixi/blob/main/docs/integration/ci/github_actions.md as well

.github/workflows/build.yml

@@ -18,12 +18,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install pnpm
-        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.4.0
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.4.0
         with:
           version: 9
 
       - name: Install Node.js
-        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 20
           cache: pnpm
@@ -47,7 +47,7 @@ jobs:
         run: |
           set -euo pipefail
           latest_version="$(jq -r '.version' package.json)"
-          count_expected=16
+          count_expected=17
           count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
           if [ "$count_actual" -ne "$count_expected" ]; then
             echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
@@ -79,7 +79,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         if: failure() && github.ref_name == 'main'
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -93,12 +93,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install pnpm
-        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.4.0
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.4.0
         with:
           version: 9
 
       - name: Install Node.js
-        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 20
           cache: pnpm
@@ -119,7 +119,7 @@ jobs:
         id: diff
 
       # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/test.yml

@@ -247,30 +247,30 @@ jobs:
         run: mv test/default/* .
       - name: Create pixi directory and add to PATH
         run: |
-          mkdir -p $HOME/custom-existing-pixi
-          echo $HOME/custom-existing-pixi >> $GITHUB_PATH
+          mkdir -p "$HOME/custom existing pixi"
+          echo "$HOME/custom existing pixi" >> $GITHUB_PATH
         if: matrix.os != 'windows-latest'
       - name: Create pixi directory and add to PATH (Windows)
         run: |
-          mkdir $env:USERPROFILE\custom-existing-pixi
-          echo $env:USERPROFILE\custom-existing-pixi >> $env:GITHUB_PATH
+          mkdir "$env:USERPROFILE\custom existing pixi"
+          echo "$env:USERPROFILE\custom existing pixi" >> $env:GITHUB_PATH
         shell: pwsh
         if: matrix.os == 'windows-latest'
       - name: Download pixi binary (Ubuntu)
         run: |
           set -o pipefail
-          curl -L --output $HOME/custom-existing-pixi/pixi https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-unknown-linux-musl
-          chmod +x $HOME/custom-existing-pixi/pixi
+          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-unknown-linux-musl
+          chmod +x "$HOME/custom existing pixi/pixi"
         if: matrix.os == 'ubuntu-latest'
       - name: Download pixi binary (macOS)
         run: |
           set -o pipefail
-          curl -L --output $HOME/custom-existing-pixi/pixi https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-apple-darwin
-          chmod +x $HOME/custom-existing-pixi/pixi
+          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-apple-darwin
+          chmod +x "$HOME/custom existing pixi/pixi"
         if: matrix.os == 'macos-latest'
       - name: Download pixi binary (Windows)
         run: |
-          curl -L --output $HOME/custom-existing-pixi/pixi.exe https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-pc-windows-msvc.exe
+          curl -L --output "$HOME/custom existing pixi/pixi.exe" https://github.com/prefix-dev/pixi/releases/download/v0.14.0/pixi-x86_64-pc-windows-msvc.exe
         if: matrix.os == 'windows-latest'
       - run: |
           echo "Path: $PATH"
@@ -282,7 +282,7 @@ jobs:
         shell: bash
       - name: Verify pixi path (before setup-pixi)
         run: |
-          which pixi | grep -q $HOME/custom-existing-pixi/pixi
+          which pixi | grep -q "$HOME/custom existing pixi/pixi"
         shell: bash
       - name: Run Action (should use preinstalled pixi)
         uses: ./
@@ -346,12 +346,12 @@ jobs:
         if: matrix.ignore-reason == 'bin-path' || matrix.ignore-reason == 'version-latest'
       - name: Verify pixi path (after setup-pixi, no ignore reason)
         run: |
-          which pixi | grep -q $HOME/custom-existing-pixi/pixi
+          which pixi | grep -q "$HOME/custom existing pixi/pixi"
         shell: bash
         if: matrix.ignore-reason == 'none'
       - name: Verify pixi path (after setup-pixi, ignore reason)
         run: |
-          which pixi | grep -vq $HOME/custom-existing-pixi/pixi
+          which pixi | grep -vq "$HOME/custom existing pixi/pixi"
         shell: bash
         if: matrix.ignore-reason != 'none'
 
@@ -741,13 +741,21 @@ jobs:
 
   pyproject:
     timeout-minutes: 10
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        os: [windows-latest, ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Move pixi files
         run: mv test/pyproject-manifest/* .
       - uses: ./
       - run: test -f .pixi/envs/default/bin/python
+        if: matrix.os != 'windows-latest'
+        shell: bash
+      - run: test -f .pixi/envs/default/python.exe
+        if: matrix.os == 'windows-latest'
+        shell: bash
       - run: pixi run test
 
   custom-pyproject-manifest-path:

README.md

@@ -23,9 +23,9 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
-    pixi-version: v0.41.4
+    pixi-version: v0.44.0
 
     cache: true
     auth-host: prefix.dev
@@ -35,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 
 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.8.3`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.8.7`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -74,7 +74,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     cache: true
     cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -119,7 +119,7 @@ test:
       environment: [py311, py312]
   steps:
     - uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.8.3
+    - uses: prefix-dev/setup-pixi@v0.8.7
       with:
         environments: ${{ matrix.environment }}
 ```
@@ -129,7 +129,7 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     # separated by spaces
     environments: >-
@@ -165,7 +165,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     auth-host: prefix.dev
     auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -177,7 +177,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     auth-host: custom-artifactory.com
     auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -190,7 +190,7 @@ Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     auth-host: anaconda.org # or my-quetz-instance.com
     auth-conda-token: ${{ secrets.CONDA_TOKEN }}
@@ -202,7 +202,7 @@ Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-k
 You can also specify the session token using the `auth-session-token` input argument.
 
 ```yaml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     auth-host: s3://my-s3-bucket
     auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
@@ -274,7 +274,7 @@ To this end, `setup-pixi` adds all environment variables set when executing `pix
 As a result, all installed binaries can be accessed without having to call `pixi run`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     activate-environment: true
 ```
@@ -282,7 +282,7 @@ As a result, all installed binaries can be accessed without having to call `pixi
 If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     environments: >-
       py311
@@ -299,7 +299,7 @@ You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi
 See the [official documentation](https://prefix.dev/docs/pixi/cli#install) for more information about the `--frozen` and `--locked` flags.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     locked: true
     # or
@@ -318,7 +318,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   env:
     RUNNER_DEBUG: true
 ```
@@ -336,7 +336,7 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     # one of `q`, `default`, `v`, `vv`, or `vvv`.
     log-level: vvv
@@ -362,7 +362,7 @@ If nothing is specified, `post-cleanup` will default to `true`.
 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     post-cleanup: true
     # ${{ runner.temp }}\Scripts\pixi.exe on Windows
@@ -378,11 +378,21 @@ You can also use a preinstalled local version of pixi on the runner by not setti
 This can be overwritten by setting the `manifest-path` input argument.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.8.3
+- uses: prefix-dev/setup-pixi@v0.8.7
   with:
     manifest-path: pyproject.toml
 ```
 
+### Only install pixi
+
+If you only want to install pixi and not install the current project, you can use the `run-install` option.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.8.7
+  with:
+    run-install: false
+```
+
 ## More examples
 
 If you want to see more examples, you can take a look at the [GitHub Workflows of this repository](.github/workflows/test.yml).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "setup-pixi",
-  "version": "0.8.3",
+  "version": "0.8.7",
   "private": true,
   "description": "Action to set up the pixi package manager.",
   "scripts": {
@@ -22,25 +22,25 @@
   "author": "Pavel Zwerschke <pavelzw@gmail.com>",
   "license": "BSD-3-Clause",
   "dependencies": {
-    "@actions/cache": "^4.0.0",
+    "@actions/cache": "^4.0.3",
     "@actions/core": "^1.11.1",
     "@actions/exec": "^1.1.1",
     "@actions/io": "^1.1.3",
     "@actions/tool-cache": "^2.0.2",
-    "@iarna/toml": "^2.2.5",
+    "smol-toml": "^1.3.1",
     "untildify": "^5.0.0",
     "which": "^5.0.0",
-    "zod": "^3.24.1"
+    "zod": "^3.24.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.19.0",
-    "@types/eslint__js": "^8.42.3",
-    "@types/node": "^22.13.0",
+    "@eslint/js": "^9.23.0",
+    "@types/eslint__js": "^9.14.0",
+    "@types/node": "^22.13.14",
     "@types/which": "^3.0.4",
-    "eslint": "^9.19.0",
-    "prettier": "^3.4.2",
-    "tsup": "^8.3.6",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.22.0"
+    "eslint": "^9.23.0",
+    "prettier": "^3.5.3",
+    "tsup": "^8.4.0",
+    "typescript": "^5.8.2",
+    "typescript-eslint": "^8.29.0"
   }
 }

src/options.ts

@@ -5,7 +5,7 @@ import { existsSync, readFileSync } from 'fs'
 import * as core from '@actions/core'
 import * as z from 'zod'
 import untildify from 'untildify'
-import { parse } from '@iarna/toml'
+import { parse } from 'smol-toml'
 import which from 'which'
 
 type Inputs = Readonly<{

src/util.ts

@@ -70,13 +70,17 @@ export const sha256Short = (s: BinaryLike) => {
 }
 
 export const execute = (cmd: string[]) => {
-  core.debug(`Executing: ${cmd.join(' ')}`)
-  return exec(cmd[0], cmd.slice(1))
+  core.debug(`Executing: \`${cmd.toString()}\``)
+  // needs escaping if cmd[0] contains spaces
+  // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
+  return exec(`"${cmd[0]}"`, cmd.slice(1))
 }
 
 export const executeGetOutput = (cmd: string[], options?: ExecOptions) => {
-  core.debug(`Executing: ${cmd.join(' ')}`)
-  return getExecOutput(cmd[0], cmd.slice(1), options)
+  core.debug(`Executing: \`${cmd.toString()}\``)
+  // needs escaping if cmd[0] contains spaces
+  // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
+  return getExecOutput(`"${cmd[0]}"`, cmd.slice(1), options)
 }
 
 export const pixiCmd = (command: string, withManifestPath = true) => {

test/pyproject-manifest/pyproject.toml

@@ -10,6 +10,30 @@ dependencies = ["flask==2.*"]
 requires = ["setuptools", "wheel"]
 build-backend = "setuptools.build_meta"
 
+[dependency-groups]
+# inline lists with mixed types are a toml 1.0 feature
+dev = [{ include-group = "lint" }, { include-group = "docs" }, "ipython"]
+docs = ["mkdocs>=1.4"]
+lint = ["ruff>=0.1.14"]
+
+[tool.ruff]
+target-version = "py310"
+line-length = 100
+exclude = [ ".pixi", "__pycache__" ]
+# the TOML parser should also support comments in lists
+lint.select = [
+  # flake8-bugbear
+  "B",
+  # flake8-comprehensions
+  "C4",
+  # pydocstyle
+  "D",
+  # Error
+  "E",
+  # pyflakes
+  "F",
+]
+
 [tool.pixi.project]
 name = "pyproject-manifest"
 channels = ["conda-forge"]

tsup.config.js

@@ -25,7 +25,7 @@ export default defineConfig({
     '@actions/io',
     '@actions/tool-cache',
     'untildify',
-    '@iarna/toml',
+    'smol-toml',
     'which',
     'zod'
   ]