feat: Switch order of pixi info and pixi install (#234 )

chore(deps): bump the nodejs group across 1 directory with 9 updates (#233 )
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>
2026-10-08 15:04:08 +03:00 · 2025-11-03 11:25:42 +01:00 · 2025-11-03 10:33:38 +01:00 · 2025-11-01 06:47:05 +01:00 · 2025-10-20 06:26:01 +00:00 · 2025-10-19 17:30:41 +02:00
20 changed files with 22855 additions and 15899 deletions
@@ -15,15 +15,15 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Install pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.4.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
        with:
          version: 9

      - name: Install Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -41,13 +41,13 @@ jobs:
    name: Reference latest version in README
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Assert latest setup-pixi version is mentioned in README
        run: |
          set -euo pipefail
          latest_version="$(jq -r '.version' package.json)"
-          count_expected=19
+          count_expected=21
          count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
          if [ "$count_actual" -ne "$count_expected" ]; then
            echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
@@ -62,7 +62,7 @@ jobs:
      contents: write
      pull-requests: write
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Assert latest pixi version is mentioned in README
        run: |
@@ -90,15 +90,15 @@ jobs:
  check-dist:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Install pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.4.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
        with:
          version: 9

      - name: Install Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -119,7 +119,7 @@ jobs:
        id: diff

      # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
        with:
          name: dist
@@ -12,7 +12,7 @@ jobs:
  release:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: Quantco/ui-actions/version-metadata@cd71d2a0e30b25569f6d723e57acca83347e58fc # v1.0.18
        id: version-metadata
        with:
@@ -24,7 +24,7 @@ jobs:
          TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
      - name: Create release
        if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
        with:
          generate_release_notes: true
          tag_name: v${{ steps.version-metadata.outputs.newVersion }}
@@ -22,7 +22,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    name: default ${{ matrix.cache == true && 'with' || 'without' }} cache (${{ matrix.os }})
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -47,13 +47,62 @@ jobs:
          pixi run python --version | grep -q 3.11
          pixi run test | grep -q "Hello world"

+  global-environments:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      - uses: ./
+        with:
+          global-environments: |
+            cowpy
+      - run: |
+          cowpy hello world
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }}
+          ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }} --version | grep -q 3.11
+        shell: bash
+      - run: |
+          pixi run python --version | grep -q 3.11
+          pixi run test | grep -q "Hello world"
+
+  global-environments-with-project-install:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: ./
+        with:
+          run-install: false
+          global-environments: |
+            cowpy
+            keyring --with keyrings.google-artifactregistry-auth
+      - run: |
+          set -o pipefail
+          cowpy hello world
+          keyring --list-backends | grep "keyrings.gauth.GooglePythonAuth"
+        shell: bash
+        if: matrix.os != 'windows-latest'
+      - run: |
+          cowpy hello world
+          keyring --list-backends | findstr "keyrings.gauth.GooglePythonAuth"
+        if: matrix.os == 'windows-latest'
+
  no-run-install:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -70,7 +119,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          run-install: false
@@ -85,7 +134,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -103,7 +152,7 @@ jobs:
        locked: [true, false]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -122,7 +171,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          run-install: false
@@ -135,7 +184,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          run-install: false
@@ -154,7 +203,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -169,7 +218,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -181,7 +230,7 @@ jobs:
  custom-pixi-url:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -193,7 +242,7 @@ jobs:
  pixi-url-headers-bearer:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - name: Setup caddy
@@ -234,7 +283,7 @@ jobs:
  pixi-url-custom-template-no-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          pixi-url: |
@@ -249,7 +298,7 @@ jobs:
  pixi-url-custom-template-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          pixi-url: |
@@ -265,7 +314,7 @@ jobs:
  pixi-url-custom-template-version-latest:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          pixi-url: |
@@ -284,7 +333,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          cache: false
@@ -296,7 +345,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -310,7 +359,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -331,7 +380,7 @@ jobs:
        ignore-reason: [none, version, version-latest, url, bin-path]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - name: Create pixi directory and add to PATH
@@ -450,7 +499,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -471,7 +520,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -494,7 +543,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -516,7 +565,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/auth/* .
      - uses: ./
@@ -535,7 +584,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/auth-s3/* .
      - uses: ./
@@ -555,7 +604,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -582,7 +631,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          run-install: false
@@ -604,7 +653,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -629,7 +678,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -651,7 +700,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -672,7 +721,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -693,7 +742,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -725,7 +774,7 @@ jobs:
        cache: ['true', 'false']
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -761,7 +810,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -777,7 +826,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -802,7 +851,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -826,7 +875,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -843,7 +892,7 @@ jobs:
        os: [windows-latest, ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/pyproject-manifest/* .
      - uses: ./
@@ -861,7 +910,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: ./
        with:
          cache: true
@@ -873,7 +922,7 @@ jobs:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -889,7 +938,7 @@ jobs:
      run:
        shell: bash
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -905,7 +954,7 @@ jobs:
      run:
        shell: pwsh
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -921,7 +970,7 @@ jobs:
      run:
        shell: cmd
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -939,7 +988,7 @@ jobs:
  environment-activation-false:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -950,7 +999,7 @@ jobs:
  environment-activation-explicit-env:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -963,7 +1012,7 @@ jobs:
  environment-activation-multiple-env:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -980,7 +1029,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -998,7 +1047,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1016,7 +1065,7 @@ jobs:
  env-variable-input-custom-pixi-url:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -1029,7 +1078,7 @@ jobs:
  env-variable-input-precendence:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -1047,7 +1096,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1069,7 +1118,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -1090,7 +1139,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -1113,7 +1162,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1134,7 +1183,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1155,7 +1204,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/lockfile-not-up-to-date/* .
      - uses: ./
@@ -1176,7 +1225,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -23,9 +23,9 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
-    pixi-version: v0.49.0
+    pixi-version: v0.59.0

    cache: true
    auth-host: prefix.dev
@@ -35,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m

 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.9.0`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.9.3`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -59,14 +59,17 @@ To see all available input arguments, see the [`action.yml`](action.yml) file.

 ### Caching

-The action supports caching of the pixi environment.
-By default, caching is enabled if a `pixi.lock` file is present.
+The action supports caching of the project and global pixi environments.
+By default, project environment caching is enabled if a `pixi.lock` file is present.
 It will then use the `pixi.lock` file to generate a hash of the environment and cache it.
 If the cache is hit, the action will skip the installation and use the cached environment.
 You can specify the behavior by setting the `cache` input argument.

-If you need to customize your cache-key, you can use the `cache-key` input argument.
-This will be the prefix of the cache key. The full cache key will be `<cache-key><conda-arch>-<hash>`.
+Global environment caching is disabled by default and can be enabled by setting the `global-cache` input to `true`.
+As there is no lockfile for global environments, the cache will expire at the end of every month to ensure it does not go stale.
+
+If you need to customize your cache-key, you can use the `cache-key` and `global-cache-key` input arguments.
+These will be the prefixes of the cache keys. The full cache keys will be `<cache-key><conda-arch>-<hash>` and `<global-cache-key><conda-arch>-<YYYY-MM>-<hash>` respectively.

 #### Only save caches on `main`

@@ -74,7 +77,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    cache: true
    cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -119,7 +122,7 @@ test:
      environment: [py311, py312]
  steps:
    - uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.9.0
+    - uses: prefix-dev/setup-pixi@v0.9.3
      with:
        environments: ${{ matrix.environment }}
 ```
@@ -129,7 +132,7 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    # separated by spaces
    environments: >-
@@ -143,16 +146,36 @@ The following example will install both the `py311` and the `py312` environment
 > [!WARNING]
 > If you don't specify any environment, the `default` environment will be installed and cached, even if you use other environments.

+### Global Environments
+
+You can specify `pixi global install` commands by setting the `global-environments` input argument.
+This will create one environment per line, and install them.
+This is useful in particular to install executables that are needed for `pixi install` to work properly.
+For instance, the `keyring`, or `gcloud` executables. The following example shows how to install both in separate global environments.
+By default, global environments are not cached. You can enable caching by setting the `global-cache` input to `true`.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.9.3
+  with:
+    global-environments: |
+      google-cloud-sdk
+      keyring --with keyrings.google-artifactregistry-auth
+- run: |
+    gcloud --version
+    keyring --list-backends
+```
+
 ### Authentication

-There are currently three ways to authenticate with pixi:
+There are currently five ways to authenticate with pixi:

 - using a token
 - using a username and password
 - using a conda-token
 - using an S3 key pair
+- using keyring for PyPI registries

-For more information, see the [pixi documentation](https://prefix.dev/docs/pixi/authentication).
+For more information, see the [pixi documentation](https://pixi.sh/latest/deployment/authentication/).

 > [!WARNING]
 > Please only store sensitive information using [GitHub secrets](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions). Do not store them in your repository.
@@ -165,7 +188,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    auth-host: prefix.dev
    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -177,7 +200,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    auth-host: custom-artifactory.com
    auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -190,7 +213,7 @@ Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    auth-host: anaconda.org # or my-quetz-instance.com
    auth-conda-token: ${{ secrets.CONDA_TOKEN }}
@@ -202,7 +225,7 @@ Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-k
 You can also specify the session token using the `auth-session-token` input argument.

 ```yaml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    auth-host: s3://my-s3-bucket
    auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
@@ -213,6 +236,18 @@ You can also specify the session token using the `auth-session-token` input argu

 See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.

+#### PyPI keyring provider
+
+You can specify whether to use keyring to look up credentials for PyPI.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.9.3
+  with:
+    pypi-keyring-provider: subprocess # one of 'subprocess', 'disabled'
+```
+
+You can use the [`global-environments`](#global-environments) input to install `keyring` and its backends.
+
 ### Custom shell wrapper

 `setup-pixi` allows you to run command inside of the pixi environment by specifying a custom shell wrapper with `shell: pixi run bash -e {0}`.
@@ -274,7 +309,7 @@ To this end, `setup-pixi` adds all environment variables set when executing `pix
 As a result, all installed binaries can be accessed without having to call `pixi run`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    activate-environment: true
 ```
@@ -282,7 +317,7 @@ As a result, all installed binaries can be accessed without having to call `pixi
 If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    environments: >-
      py311
@@ -296,10 +331,10 @@ However, be aware that this option augments the environment of your job.
 ### `--frozen` and `--locked`

 You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi install --locked` depending on the `frozen` or the `locked` input argument.
-See the [official documentation](https://prefix.dev/docs/pixi/cli#install) for more information about the `--frozen` and `--locked` flags.
+See the [official documentation](https://pixi.sh/latest/reference/cli/pixi/install/#update-options) for more information about the `--frozen` and `--locked` flags.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    locked: true
    # or
@@ -318,7 +353,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  env:
    RUNNER_DEBUG: true
 ```
@@ -336,7 +371,7 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    # one of `q`, `default`, `v`, `vv`, or `vvv`.
    log-level: vvv
@@ -362,7 +397,7 @@ If nothing is specified, `post-cleanup` will default to `true`.
 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    post-cleanup: true
    # ${{ runner.temp }}\Scripts\pixi.exe on Windows
@@ -378,7 +413,7 @@ You can also use a preinstalled local version of pixi on the runner by not setti
 This can be overwritten by setting the `manifest-path` input argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    manifest-path: pyproject.toml
 ```
@@ -388,7 +423,7 @@ This can be overwritten by setting the `manifest-path` input argument.
 If you only want to install pixi and not install the current project, you can use the `run-install` option.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    run-install: false
 ```
@@ -399,7 +434,7 @@ You can also download pixi from a custom URL by setting the `pixi-url` input arg
 Optionally, you can combine this with the `pixi-url-headers` input argument to supply additional headers for the download request, such as a bearer token.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    pixi-url: https://pixi-mirror.example.com/releases/download/v0.48.0/pixi-x86_64-unknown-linux-musl
    pixi-url-headers: '{"Authorization": "Bearer ${{ secrets.PIXI_MIRROR_BEARER_TOKEN }}"}'
@@ -415,7 +450,7 @@ It will be rendered with the following variables:
 By default, `pixi-url` is equivalent to the following template:

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.0
+- uses: prefix-dev/setup-pixi@v0.9.3
  with:
    pixi-url: |
      {{#if latest~}}
@@ -23,6 +23,9 @@ inputs:
  environments:
    description: |
      A space-separated list of environments to install. If not specified, only the default environment is installed.
+  global-environments:
+    description: |
+      A newline-separated list of packages to install globally with `pixi global install`.
  activate-environment:
    description: |
      If the installed environment should be "activated" for the current job, modifying `$GITHUB_ENV` and
@@ -34,13 +37,21 @@ inputs:
    description: Whether to use `pixi install --frozen`. Defaults to `false`.
  cache:
    description: Whether to cache the pixi environment. Defaults to `true`. Only works if `pixi.lock` is present.
+  global-cache:
+    description: |
+      Whether to cache the global environment(s). Defaults to `false`. As there is no lockfile for global environment,
+      the global cache will expire at the end of every month, to ensure it does not go stale.
  cache-key:
    description: |
      Cache key prefix to use for caching the pixi environment.
      Defaults to `pixi-`. The full cache key is `<cache-key><conda-arch>-<sha-256-of-pixi-lock>`.
+  global-cache-key:
+    description: |
+      Cache key prefix to use for caching the global environments.
+      Defaults to `pixi-global-`. The full cache key is `<global-cache-key><conda-arch>-<sha-256-of-global-environments>`.
  cache-write:
    description: |
-      Whether to write to the cache or only read from it. Defaults to `true`.
+      Whether to write to the cache or only read from it. Defaults to `true`. Applies to both project and global caches as the case may be.
  pixi-bin-path:
    description: |
      Path to the pixi binary to use. Defaults to `~/.pixi/bin/pixi`.
@@ -63,6 +74,10 @@ inputs:
    description: Secret access key to use for S3 authentication.
  auth-s3-session-token:
    description: Session token to use for S3 authentication.
+  pypi-keyring-provider:
+    description: |
+      Specifies whether to use keyring to look up credentials for PyPI.
+      options: disabled, subprocess
  post-cleanup:
    description: |
      If the action should clean up after itself. Defaults to `true`.
@@ -14393,7 +14393,7 @@ var require_util4 = __commonJS({
    var { serializeAMimeType, parseMIMEType } = require_dataURL();
    var { types } = require("util");
    var { StringDecoder } = require("string_decoder");
-    var { btoa } = require("buffer");
+    var { btoa: btoa2 } = require("buffer");
    var staticPropertyDescriptors = {
      enumerable: true,
      writable: false,
@@ -14485,9 +14485,9 @@ var require_util4 = __commonJS({
          dataURL += ";base64,";
          const decoder = new StringDecoder("latin1");
          for (const chunk of bytes) {
-            dataURL += btoa(decoder.write(chunk));
+            dataURL += btoa2(decoder.write(chunk));
          }
-          dataURL += btoa(decoder.end());
+          dataURL += btoa2(decoder.end());
          return dataURL;
        }
        case "Text": {
@@ -14504,7 +14504,7 @@ var require_util4 = __commonJS({
          if (encoding === "failure") {
            encoding = "UTF-8";
          }
-          return decode(bytes, encoding);
+          return decode2(bytes, encoding);
        }
        case "ArrayBuffer": {
          const sequence = combineByteSequences(bytes);
@@ -14521,7 +14521,7 @@ var require_util4 = __commonJS({
        }
      }
    }
-    function decode(ioQueue, encoding) {
+    function decode2(ioQueue, encoding) {
      const bytes = combineByteSequences(ioQueue);
      const BOMEncoding = BOMSniffing(bytes);
      let slice = 0;
@@ -21554,7 +21554,7 @@ var require_parser = __commonJS({
        parseError: function parseError(str, hash) {
          throw new Error(str);
        },
-        parse: function parse3(input) {
+        parse: function parse4(input) {
          var self = this, stack = [0], vstack = [null], lstack = [], table = this.table, yytext = "", yylineno = 0, yyleng = 0, recovering = 0, TERROR = 2, EOF = 1;
          this.lexer.setInput(input);
          this.lexer.yy = this.yy;
@@ -22467,7 +22467,7 @@ var require_base2 = __commonJS({
    "use strict";
    exports2.__esModule = true;
    exports2.parseWithoutProcessing = parseWithoutProcessing;
-    exports2.parse = parse3;
+    exports2.parse = parse4;
    function _interopRequireWildcard(obj) {
      if (obj && obj.__esModule) {
        return obj;
@@ -22506,7 +22506,7 @@ var require_base2 = __commonJS({
      var ast = _parser2["default"].parse(input);
      return ast;
    }
-    function parse3(input, options2) {
+    function parse4(input, options2) {
      var ast = parseWithoutProcessing(input, options2);
      var strip = new _whitespaceControl2["default"](options2);
      return strip.accept(ast);
@@ -25975,7 +25975,7 @@ var import_process = require("process");
 var import_fs = require("fs");
 var core2 = __toESM(require_core());

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/core.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({
  status: "aborted"
 });
@@ -26028,6 +26028,12 @@ var $ZodAsyncError = class extends Error {
    super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
  }
 };
+var $ZodEncodeError = class extends Error {
+  constructor(name) {
+    super(`Encountered unidirectional transform during encode: ${name}`);
+    this.name = "ZodEncodeError";
+  }
+};
 var globalConfig = {};
 function config(newConfig) {
  if (newConfig)
@@ -26035,7 +26041,7 @@ function config(newConfig) {
  return globalConfig;
 }

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/util.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/util.js
 var util_exports = {};
 __export(util_exports, {
  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
@@ -26049,6 +26055,8 @@ __export(util_exports, {
  assertNever: () => assertNever,
  assertNotEqual: () => assertNotEqual,
  assignProp: () => assignProp,
+  base64ToUint8Array: () => base64ToUint8Array,
+  base64urlToUint8Array: () => base64urlToUint8Array,
  cached: () => cached,
  captureStackTrace: () => captureStackTrace,
  cleanEnum: () => cleanEnum,
@@ -26067,6 +26075,7 @@ __export(util_exports, {
  getLengthableOrigin: () => getLengthableOrigin,
  getParsedType: () => getParsedType,
  getSizableOrigin: () => getSizableOrigin,
+  hexToUint8Array: () => hexToUint8Array,
  isObject: () => isObject,
  isPlainObject: () => isPlainObject,
  issue: () => issue,
@@ -26077,6 +26086,7 @@ __export(util_exports, {
  normalizeParams: () => normalizeParams,
  nullish: () => nullish,
  numKeys: () => numKeys,
+  objectClone: () => objectClone,
  omit: () => omit,
  optionalKeys: () => optionalKeys,
  partial: () => partial,
@@ -26087,7 +26097,12 @@ __export(util_exports, {
  propertyKeyTypes: () => propertyKeyTypes,
  randomString: () => randomString,
  required: () => required,
+  safeExtend: () => safeExtend,
+  shallowClone: () => shallowClone,
  stringifyPrimitive: () => stringifyPrimitive,
+  uint8ArrayToBase64: () => uint8ArrayToBase64,
+  uint8ArrayToBase64url: () => uint8ArrayToBase64url,
+  uint8ArrayToHex: () => uint8ArrayToHex,
  unwrapMessage: () => unwrapMessage
 });
 function assertEqual(val) {
@@ -26175,6 +26190,9 @@ function defineLazy(object, key, getter) {
    configurable: true
  });
 }
+function objectClone(obj) {
+  return Object.create(Object.getPrototypeOf(obj), Object.getOwnPropertyDescriptors(obj));
+}
 function assignProp(target, prop, value) {
  Object.defineProperty(target, prop, {
    value,
@@ -26252,6 +26270,13 @@ function isPlainObject(o) {
  }
  return true;
 }
+function shallowClone(o) {
+  if (isPlainObject(o))
+    return { ...o };
+  if (Array.isArray(o))
+    return [...o];
+  return o;
+}
 function numKeys(data) {
  let keyCount = 0;
  for (const key in data) {
@@ -26432,6 +26457,11 @@ function extend(schema, shape) {
  if (!isPlainObject(shape)) {
    throw new Error("Invalid input to extend: expected a plain object");
  }
+  const checks = schema._zod.def.checks;
+  const hasChecks = checks && checks.length > 0;
+  if (hasChecks) {
+    throw new Error("Object schemas containing refinements cannot be extended. Use `.safeExtend()` instead.");
+  }
  const def = mergeDefs(schema._zod.def, {
    get shape() {
      const _shape = { ...schema._zod.def.shape, ...shape };
@@ -26442,6 +26472,21 @@ function extend(schema, shape) {
  });
  return clone(schema, def);
 }
+function safeExtend(schema, shape) {
+  if (!isPlainObject(shape)) {
+    throw new Error("Invalid input to safeExtend: expected a plain object");
+  }
+  const def = {
+    ...schema._zod.def,
+    get shape() {
+      const _shape = { ...schema._zod.def.shape, ...shape };
+      assignProp(this, "shape", _shape);
+      return _shape;
+    },
+    checks: schema._zod.def.checks
+  };
+  return clone(schema, def);
+}
 function merge(a, b) {
  const def = mergeDefs(a._zod.def, {
    get shape() {
@@ -26522,6 +26567,8 @@ function required(Class2, schema, mask) {
  return clone(schema, def);
 }
 function aborted(x, startIndex = 0) {
+  if (x.aborted === true)
+    return true;
  for (let i = startIndex; i < x.issues.length; i++) {
    if (x.issues[i]?.continue !== true) {
      return true;
@@ -26586,12 +26633,49 @@ function cleanEnum(obj) {
    return Number.isNaN(Number.parseInt(k, 10));
  }).map((el) => el[1]);
 }
+function base64ToUint8Array(base642) {
+  const binaryString = atob(base642);
+  const bytes = new Uint8Array(binaryString.length);
+  for (let i = 0; i < binaryString.length; i++) {
+    bytes[i] = binaryString.charCodeAt(i);
+  }
+  return bytes;
+}
+function uint8ArrayToBase64(bytes) {
+  let binaryString = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binaryString += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binaryString);
+}
+function base64urlToUint8Array(base64url2) {
+  const base642 = base64url2.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - base642.length % 4) % 4);
+  return base64ToUint8Array(base642 + padding);
+}
+function uint8ArrayToBase64url(bytes) {
+  return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function hexToUint8Array(hex) {
+  const cleanHex = hex.replace(/^0x/, "");
+  if (cleanHex.length % 2 !== 0) {
+    throw new Error("Invalid hex string length");
+  }
+  const bytes = new Uint8Array(cleanHex.length / 2);
+  for (let i = 0; i < cleanHex.length; i += 2) {
+    bytes[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+  }
+  return bytes;
+}
+function uint8ArrayToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 var Class = class {
  constructor(..._args) {
  }
 };

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/errors.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/errors.js
 var initializer = (inst, def) => {
  inst.name = "$ZodError";
  Object.defineProperty(inst, "_zod", {
@@ -26623,10 +26707,7 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
  }
  return { formErrors, fieldErrors };
 }
-function formatError(error2, _mapper) {
-  const mapper = _mapper || function(issue2) {
-    return issue2.message;
-  };
+function formatError(error2, mapper = (issue2) => issue2.message) {
  const fieldErrors = { _errors: [] };
  const processError = (error3) => {
    for (const issue2 of error3.issues) {
@@ -26660,7 +26741,7 @@ function formatError(error2, _mapper) {
  return fieldErrors;
 }

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/parse.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/parse.js
 var _parse = (_Err) => (schema, value, _ctx, _params) => {
  const ctx = _ctx ? Object.assign(_ctx, { async: false }) : { async: false };
  const result = schema._zod.run({ value, issues: [] }, ctx);
@@ -26709,8 +26790,36 @@ var _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
  } : { success: true, data: result.value };
 };
 var safeParseAsync = /* @__PURE__ */ _safeParseAsync($ZodRealError);
+var _encode = (_Err) => (schema, value, _ctx) => {
+  const ctx = _ctx ? Object.assign(_ctx, { direction: "backward" }) : { direction: "backward" };
+  return _parse(_Err)(schema, value, ctx);
+};
+var _decode = (_Err) => (schema, value, _ctx) => {
+  return _parse(_Err)(schema, value, _ctx);
+};
+var _encodeAsync = (_Err) => async (schema, value, _ctx) => {
+  const ctx = _ctx ? Object.assign(_ctx, { direction: "backward" }) : { direction: "backward" };
+  return _parseAsync(_Err)(schema, value, ctx);
+};
+var _decodeAsync = (_Err) => async (schema, value, _ctx) => {
+  return _parseAsync(_Err)(schema, value, _ctx);
+};
+var _safeEncode = (_Err) => (schema, value, _ctx) => {
+  const ctx = _ctx ? Object.assign(_ctx, { direction: "backward" }) : { direction: "backward" };
+  return _safeParse(_Err)(schema, value, ctx);
+};
+var _safeDecode = (_Err) => (schema, value, _ctx) => {
+  return _safeParse(_Err)(schema, value, _ctx);
+};
+var _safeEncodeAsync = (_Err) => async (schema, value, _ctx) => {
+  const ctx = _ctx ? Object.assign(_ctx, { direction: "backward" }) : { direction: "backward" };
+  return _safeParseAsync(_Err)(schema, value, ctx);
+};
+var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
+  return _safeParseAsync(_Err)(schema, value, _ctx);
+};

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/regexes.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/regexes.js
 var cuid = /^[cC][^\s-]{8,}$/;
 var cuid2 = /^[0-9a-z]+$/;
 var ulid = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;
@@ -26721,7 +26830,7 @@ var duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)
 var guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
 var uuid = (version2) => {
  if (!version2)
-    return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000)$/;
+    return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
 var email = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
@@ -26730,7 +26839,7 @@ function emoji() {
  return new RegExp(_emoji, "u");
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
-var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})$/;
+var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
@@ -26761,11 +26870,11 @@ var string = (params) => {
  const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
  return new RegExp(`^${regex}$`);
 };
-var boolean = /true|false/i;
+var boolean = /^(?:true|false)$/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/checks.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
  var _a;
  inst._zod ?? (inst._zod = {});
@@ -26993,14 +27102,14 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
  };
 });

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/versions.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/versions.js
 var version = {
  major: 4,
-  minor: 0,
-  patch: 14
+  minor: 1,
+  patch: 12
 };

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/schemas.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
  var _a;
  inst ?? (inst = {});
@@ -27062,7 +27171,32 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
      }
      return payload;
    };
+    const handleCanaryResult = (canary, payload, ctx) => {
+      if (aborted(canary)) {
+        canary.aborted = true;
+        return canary;
+      }
+      const checkResult = runChecks(payload, checks, ctx);
+      if (checkResult instanceof Promise) {
+        if (ctx.async === false)
+          throw new $ZodAsyncError();
+        return checkResult.then((checkResult2) => inst._zod.parse(checkResult2, ctx));
+      }
+      return inst._zod.parse(checkResult, ctx);
+    };
    inst._zod.run = (payload, ctx) => {
+      if (ctx.skipChecks) {
+        return inst._zod.parse(payload, ctx);
+      }
+      if (ctx.direction === "backward") {
+        const canary = inst._zod.parse({ value: payload.value, issues: [] }, { ...ctx, skipChecks: true });
+        if (canary instanceof Promise) {
+          return canary.then((canary2) => {
+            return handleCanaryResult(canary2, payload, ctx);
+          });
+        }
+        return handleCanaryResult(canary, payload, ctx);
+      }
      const result = inst._zod.parse(payload, ctx);
      if (result instanceof Promise) {
        if (ctx.async === false)
@@ -27269,8 +27403,11 @@ var $ZodCIDRv6 = /* @__PURE__ */ $constructor("$ZodCIDRv6", (inst, def) => {
  def.pattern ?? (def.pattern = cidrv6);
  $ZodStringFormat.init(inst, def);
  inst._zod.check = (payload) => {
-    const [address, prefix] = payload.value.split("/");
+    const parts = payload.value.split("/");
    try {
+      if (parts.length !== 2)
+        throw new Error();
+      const [address, prefix] = parts;
      if (!prefix)
        throw new Error();
      const prefixNum = Number(prefix);
@@ -27720,9 +27857,12 @@ var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
 });
 var $ZodTransform = /* @__PURE__ */ $constructor("$ZodTransform", (inst, def) => {
  $ZodType.init(inst, def);
-  inst._zod.parse = (payload, _ctx) => {
+  inst._zod.parse = (payload, ctx) => {
+    if (ctx.direction === "backward") {
+      throw new $ZodEncodeError(inst.constructor.name);
+    }
    const _out = def.transform(payload.value, payload);
-    if (_ctx.async) {
+    if (ctx.async) {
      const output = _out instanceof Promise ? _out : Promise.resolve(_out);
      return output.then((output2) => {
        payload.value = output2;
@@ -27788,6 +27928,9 @@ var $ZodDefault = /* @__PURE__ */ $constructor("$ZodDefault", (inst, def) => {
  inst._zod.optin = "optional";
  defineLazy(inst._zod, "values", () => def.innerType._zod.values);
  inst._zod.parse = (payload, ctx) => {
+    if (ctx.direction === "backward") {
+      return def.innerType._zod.run(payload, ctx);
+    }
    if (payload.value === void 0) {
      payload.value = def.defaultValue;
      return payload;
@@ -27810,6 +27953,9 @@ var $ZodPrefault = /* @__PURE__ */ $constructor("$ZodPrefault", (inst, def) => {
  inst._zod.optin = "optional";
  defineLazy(inst._zod, "values", () => def.innerType._zod.values);
  inst._zod.parse = (payload, ctx) => {
+    if (ctx.direction === "backward") {
+      return def.innerType._zod.run(payload, ctx);
+    }
    if (payload.value === void 0) {
      payload.value = def.defaultValue;
    }
@@ -27847,6 +27993,9 @@ var $ZodCatch = /* @__PURE__ */ $constructor("$ZodCatch", (inst, def) => {
  defineLazy(inst._zod, "optout", () => def.innerType._zod.optout);
  defineLazy(inst._zod, "values", () => def.innerType._zod.values);
  inst._zod.parse = (payload, ctx) => {
+    if (ctx.direction === "backward") {
+      return def.innerType._zod.run(payload, ctx);
+    }
    const result = def.innerType._zod.run(payload, ctx);
    if (result instanceof Promise) {
      return result.then((result2) => {
@@ -27885,18 +28034,26 @@ var $ZodPipe = /* @__PURE__ */ $constructor("$ZodPipe", (inst, def) => {
  defineLazy(inst._zod, "optout", () => def.out._zod.optout);
  defineLazy(inst._zod, "propValues", () => def.in._zod.propValues);
  inst._zod.parse = (payload, ctx) => {
+    if (ctx.direction === "backward") {
+      const right = def.out._zod.run(payload, ctx);
+      if (right instanceof Promise) {
+        return right.then((right2) => handlePipeResult(right2, def.in, ctx));
+      }
+      return handlePipeResult(right, def.in, ctx);
+    }
    const left = def.in._zod.run(payload, ctx);
    if (left instanceof Promise) {
-      return left.then((left2) => handlePipeResult(left2, def, ctx));
+      return left.then((left2) => handlePipeResult(left2, def.out, ctx));
    }
-    return handlePipeResult(left, def, ctx);
+    return handlePipeResult(left, def.out, ctx);
  };
 });
-function handlePipeResult(left, def, ctx) {
+function handlePipeResult(left, next, ctx) {
  if (left.issues.length) {
+    left.aborted = true;
    return left;
  }
-  return def.out._zod.run({ value: left.value, issues: left.issues }, ctx);
+  return next._zod.run({ value: left.value, issues: left.issues }, ctx);
 }
 var $ZodReadonly = /* @__PURE__ */ $constructor("$ZodReadonly", (inst, def) => {
  $ZodType.init(inst, def);
@@ -27905,6 +28062,9 @@ var $ZodReadonly = /* @__PURE__ */ $constructor("$ZodReadonly", (inst, def) => {
  defineLazy(inst._zod, "optin", () => def.innerType._zod.optin);
  defineLazy(inst._zod, "optout", () => def.innerType._zod.optout);
  inst._zod.parse = (payload, ctx) => {
+    if (ctx.direction === "backward") {
+      return def.innerType._zod.run(payload, ctx);
+    }
    const result = def.innerType._zod.run(payload, ctx);
    if (result instanceof Promise) {
      return result.then(handleReadonlyResult);
@@ -27950,12 +28110,12 @@ function handleRefineResult(result, payload, input, inst) {
  }
 }

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/registries.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/registries.js
 var $output = Symbol("ZodOutput");
 var $input = Symbol("ZodInput");
 var $ZodRegistry = class {
  constructor() {
-    this._map = /* @__PURE__ */ new Map();
+    this._map = /* @__PURE__ */ new WeakMap();
    this._idmap = /* @__PURE__ */ new Map();
  }
  add(schema, ..._meta) {
@@ -27970,7 +28130,7 @@ var $ZodRegistry = class {
    return this;
  }
  clear() {
-    this._map = /* @__PURE__ */ new Map();
+    this._map = /* @__PURE__ */ new WeakMap();
    this._idmap = /* @__PURE__ */ new Map();
    return this;
  }
@@ -28001,7 +28161,7 @@ function registry() {
 }
 var globalRegistry = /* @__PURE__ */ registry();

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/core/api.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/core/api.js
 function _string(Class2, params) {
  return new Class2({
    type: "string",
@@ -28385,7 +28545,7 @@ function _check(fn, params) {
  return ch;
 }

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/classic/iso.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/classic/iso.js
 var ZodISODateTime = /* @__PURE__ */ $constructor("ZodISODateTime", (inst, def) => {
  $ZodISODateTime.init(inst, def);
  ZodStringFormat.init(inst, def);
@@ -28415,7 +28575,7 @@ function duration2(params) {
  return _isoDuration(ZodISODuration, params);
 }

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/classic/errors.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/classic/errors.js
 var initializer2 = (inst, issues) => {
  $ZodError.init(inst, issues);
  inst.name = "ZodError";
@@ -28455,28 +28615,33 @@ var ZodRealError = $constructor("ZodError", initializer2, {
  Parent: Error
 });

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/classic/parse.js
-var parse = /* @__PURE__ */ _parse(ZodRealError);
-var parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/classic/parse.js
+var parse2 = /* @__PURE__ */ _parse(ZodRealError);
+var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
+var encode = /* @__PURE__ */ _encode(ZodRealError);
+var decode = /* @__PURE__ */ _decode(ZodRealError);
+var encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
+var decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);
+var safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);
+var safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);
+var safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
+var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);

-// node_modules/.pnpm/zod@4.0.14/node_modules/zod/v4/classic/schemas.js
+// node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/classic/schemas.js
 var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
  $ZodType.init(inst, def);
  inst.def = def;
+  inst.type = def.type;
  Object.defineProperty(inst, "_def", { value: def });
  inst.check = (...checks) => {
-    return inst.clone(
-      {
-        ...def,
-        checks: [
-          ...def.checks ?? [],
-          ...checks.map((ch) => typeof ch === "function" ? { _zod: { check: ch, def: { check: "custom" }, onattach: [] } } : ch)
-        ]
-      }
-      // { parent: true }
-    );
+    return inst.clone(util_exports.mergeDefs(def, {
+      checks: [
+        ...def.checks ?? [],
+        ...checks.map((ch) => typeof ch === "function" ? { _zod: { check: ch, def: { check: "custom" }, onattach: [] } } : ch)
+      ]
+    }));
  };
  inst.clone = (def2, params) => clone(inst, def2, params);
  inst.brand = () => inst;
@@ -28484,11 +28649,19 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
    reg.add(inst, meta);
    return inst;
  };
-  inst.parse = (data, params) => parse(inst, data, params, { callee: inst.parse });
+  inst.parse = (data, params) => parse2(inst, data, params, { callee: inst.parse });
  inst.safeParse = (data, params) => safeParse2(inst, data, params);
-  inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });
+  inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
  inst.safeParseAsync = async (data, params) => safeParseAsync2(inst, data, params);
  inst.spa = inst.safeParseAsync;
+  inst.encode = (data, params) => encode(inst, data, params);
+  inst.decode = (data, params) => decode(inst, data, params);
+  inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);
+  inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);
+  inst.safeEncode = (data, params) => safeEncode(inst, data, params);
+  inst.safeDecode = (data, params) => safeDecode(inst, data, params);
+  inst.safeEncodeAsync = async (data, params) => safeEncodeAsync(inst, data, params);
+  inst.safeDecodeAsync = async (data, params) => safeDecodeAsync(inst, data, params);
  inst.refine = (check, params) => inst.check(refine(check, params));
  inst.superRefine = (refinement) => inst.check(superRefine(refinement));
  inst.overwrite = (fn) => inst.check(_overwrite(fn));
@@ -28790,6 +28963,9 @@ var ZodTransform = /* @__PURE__ */ $constructor("ZodTransform", (inst, def) => {
  $ZodTransform.init(inst, def);
  ZodType.init(inst, def);
  inst._zod.parse = (payload, _ctx) => {
+    if (_ctx.direction === "backward") {
+      throw new $ZodEncodeError(inst.constructor.name);
+    }
    payload.addIssue = (issue2) => {
      if (typeof issue2 === "string") {
        payload.issues.push(util_exports.issue(issue2, payload.value, def));
@@ -28853,7 +29029,7 @@ function _default(innerType, defaultValue) {
    type: "default",
    innerType,
    get defaultValue() {
-      return typeof defaultValue === "function" ? defaultValue() : defaultValue;
+      return typeof defaultValue === "function" ? defaultValue() : util_exports.shallowClone(defaultValue);
    }
  });
 }
@@ -28867,7 +29043,7 @@ function prefault(innerType, defaultValue) {
    type: "prefault",
    innerType,
    get defaultValue() {
-      return typeof defaultValue === "function" ? defaultValue() : defaultValue;
+      return typeof defaultValue === "function" ? defaultValue() : util_exports.shallowClone(defaultValue);
    }
  });
 }
@@ -28932,17 +29108,37 @@ function superRefine(fn) {
  return _superRefine(fn);
 }

-// node_modules/.pnpm/untildify@5.0.0/node_modules/untildify/index.js
+// node_modules/.pnpm/untildify@6.0.0/node_modules/untildify/index.js
 var import_node_os = __toESM(require("os"), 1);
-var homeDirectory = import_node_os.default.homedir();
+var homeDirectory;
+var currentUser;
 function untildify(pathWithTilde) {
  if (typeof pathWithTilde !== "string") {
    throw new TypeError(`Expected a string, got ${typeof pathWithTilde}`);
  }
-  return homeDirectory ? pathWithTilde.replace(/^~(?=$|\/|\\)/, homeDirectory) : pathWithTilde;
+  if (homeDirectory === void 0) {
+    homeDirectory = import_node_os.default.homedir();
+  }
+  if (homeDirectory && /^~(?=$|\/|\\)/.test(pathWithTilde)) {
+    return pathWithTilde.replace(/^~/, homeDirectory);
+  }
+  const userMatch = pathWithTilde.match(/^~([^/\\]+)(.*)/);
+  if (userMatch) {
+    if (currentUser === void 0) {
+      currentUser = import_node_os.default.userInfo().username;
+    }
+    if (currentUser) {
+      const username = userMatch[1];
+      const rest = userMatch[2];
+      if (username === currentUser) {
+        return homeDirectory + rest;
+      }
+    }
+  }
+  return pathWithTilde;
 }

-// node_modules/.pnpm/smol-toml@1.4.1/node_modules/smol-toml/dist/error.js
+// node_modules/.pnpm/smol-toml@1.4.2/node_modules/smol-toml/dist/error.js
 function getLineColFromPtr(string3, ptr) {
  let lines = string3.slice(0, ptr).split(/\r\n|\n|\r/g);
  return [lines.length, lines.pop().length + 1];
@@ -28982,7 +29178,13 @@ ${codeblock}`, options2);
  }
 };

-// node_modules/.pnpm/smol-toml@1.4.1/node_modules/smol-toml/dist/util.js
+// node_modules/.pnpm/smol-toml@1.4.2/node_modules/smol-toml/dist/util.js
+function isEscaped(str, ptr) {
+  let i = 0;
+  while (str[ptr - ++i] === "\\")
+    ;
+  return --i && i % 2;
+}
 function indexOfNewline(str, start = 0, end = str.length) {
  let idx = str.indexOf("\n", start);
  if (str[idx - 1] === "\r")
@@ -29037,7 +29239,7 @@ function getStringEnd(str, seek) {
  seek += target.length - 1;
  do
    seek = str.indexOf(target, ++seek);
-  while (seek > -1 && first !== "'" && str[seek - 1] === "\\" && (str[seek - 2] !== "\\" || str[seek - 3] === "\\"));
+  while (seek > -1 && first !== "'" && isEscaped(str, seek));
  if (seek > -1) {
    seek += target.length;
    if (target.length > 1) {
@@ -29050,7 +29252,7 @@ function getStringEnd(str, seek) {
  return seek;
 }

-// node_modules/.pnpm/smol-toml@1.4.1/node_modules/smol-toml/dist/date.js
+// node_modules/.pnpm/smol-toml@1.4.2/node_modules/smol-toml/dist/date.js
 var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}:\d{2}(?:\.\d+)?)?(Z|[-+]\d{2}:\d{2})?$/i;
 var _hasDate, _hasTime, _offset;
 var _TomlDate = class _TomlDate extends Date {
@@ -29147,7 +29349,7 @@ _hasTime = new WeakMap();
 _offset = new WeakMap();
 var TomlDate = _TomlDate;

-// node_modules/.pnpm/smol-toml@1.4.1/node_modules/smol-toml/dist/primitive.js
+// node_modules/.pnpm/smol-toml@1.4.2/node_modules/smol-toml/dist/primitive.js
 var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
 var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
 var LEADING_ZERO = /^[+-]?0[0-9_]/;
@@ -29285,7 +29487,7 @@ function parseValue(value, toml, ptr, integersAsBigInt) {
  return date3;
 }

-// node_modules/.pnpm/smol-toml@1.4.1/node_modules/smol-toml/dist/extract.js
+// node_modules/.pnpm/smol-toml@1.4.2/node_modules/smol-toml/dist/extract.js
 function sliceAndTrimEndOf(str, startPtr, endPtr, allowNewLines) {
  let value = str.slice(startPtr, endPtr);
  let commentIdx = value.indexOf("#");
@@ -29361,7 +29563,7 @@ function extractValue(str, ptr, end, depth, integersAsBigInt) {
  ];
 }

-// node_modules/.pnpm/smol-toml@1.4.1/node_modules/smol-toml/dist/struct.js
+// node_modules/.pnpm/smol-toml@1.4.2/node_modules/smol-toml/dist/struct.js
 var KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
 function parseKey(str, ptr, end = "=") {
  let dot = ptr - 1;
@@ -29517,7 +29719,7 @@ function parseArray(str, ptr, depth, integersAsBigInt) {
  return [res, ptr];
 }

-// node_modules/.pnpm/smol-toml@1.4.1/node_modules/smol-toml/dist/parse.js
+// node_modules/.pnpm/smol-toml@1.4.2/node_modules/smol-toml/dist/parse.js
 function peekTable(key, table, meta, type) {
  let t = table;
  let m = meta;
@@ -29577,7 +29779,7 @@ function peekTable(key, table, meta, type) {
  }
  return [k, t, state.c];
 }
-function parse2(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
+function parse3(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
  let res = {};
  let meta = {};
  let tbl = res;
@@ -29659,6 +29861,7 @@ https://github.com/prefix-dev/pixi/releases/download/{{version}}/{{pixiFile}}
 var pixiPath = "pixi.toml";
 var pyprojectPath = "pyproject.toml";
 var logLevelSchema = _enum(["q", "default", "v", "vv", "vvv"]);
+var pypiKeyringProviderSchema = _enum(["disabled", "subprocess"]);
 var PATHS = {
  pixiBin: import_path.default.join(import_os.default.homedir(), ".pixi", "bin", `pixi${import_os.default.platform() === "win32" ? ".exe" : ""}`)
 };
@@ -29706,16 +29909,29 @@ var parseOrUndefinedList = (key, schema) => {
  }
  return input.split(" ").map((s) => schema.parse(s)).filter((s) => s !== "");
 };
+var parseOrUndefinedMultilineList = (key, schema) => {
+  const input = inputOrEnvironmentVariable(key);
+  if (input === void 0) {
+    return void 0;
+  }
+  return input.split("\n").map((s) => schema.parse(s.trim())).filter((s) => s !== "");
+};
 var validateInputs = (inputs) => {
  if (inputs.pixiUrlHeaders && !inputs.pixiUrl) {
    throw new Error("You need to specify pixi-url when using pixi-url-headers");
  }
  if (inputs.cacheKey !== void 0 && inputs.cache === false) {
-    throw new Error("Cannot specify cache key without caching");
+    throw new Error("Cannot specify project cache key without project caching");
+  }
+  if (inputs.globalCacheKey !== void 0 && inputs.globalCache === false) {
+    throw new Error("Cannot specify global cache key without global caching");
  }
  if (inputs.runInstall === false && inputs.cache === true) {
    throw new Error("Cannot cache without running install");
  }
+  if (inputs.globalCache === true && (!inputs.globalEnvironments || inputs.globalEnvironments.length === 0)) {
+    throw new Error("Cannot use global-cache without specifying global-environments");
+  }
  if (inputs.runInstall === false && inputs.frozen === true) {
    throw new Error("Cannot use `frozen: true` when not running install");
  }
@@ -29807,7 +30023,7 @@ var inferOptions = (inputs) => {
    } else if ((0, import_fs.existsSync)(pyprojectPath)) {
      try {
        const fileContent = (0, import_fs.readFileSync)(pyprojectPath, "utf-8");
-        const parsedContent = parse2(fileContent);
+        const parsedContent = parse3(fileContent);
        if (parsedContent.tool && typeof parsedContent.tool === "object" && "pixi" in parsedContent.tool) {
          core2.debug(`The tool.pixi table found, using ${pyprojectPath} as manifest file.`);
          manifestPath = pyprojectPath;
@@ -29836,7 +30052,14 @@ var inferOptions = (inputs) => {
  } else if (inputs.activateEnvironment && inputs.activateEnvironment !== "false") {
    activatedEnvironment = inputs.activateEnvironment;
  }
-  const cache = inputs.cacheKey ? { cacheKeyPrefix: inputs.cacheKey, cacheWrite: inputs.cacheWrite ?? true } : inputs.cache === true || lockFileAvailable && inputs.cache !== false ? { cacheKeyPrefix: "pixi-", cacheWrite: inputs.cacheWrite ?? true } : void 0;
+  const cache = inputs.cache === true || lockFileAvailable && inputs.cache !== false ? {
+    cacheKeyPrefix: inputs.cacheKey ?? "pixi-",
+    cacheWrite: inputs.cacheWrite ?? true
+  } : void 0;
+  const globalCache = inputs.globalCache === true && inputs.globalEnvironments && inputs.globalEnvironments.length > 0 ? {
+    cacheKeyPrefix: inputs.globalCacheKey ?? "pixi-global-",
+    cacheWrite: inputs.cacheWrite ?? true
+  } : void 0;
  const frozen = inputs.frozen ?? false;
  const locked = inputs.locked ?? (lockFileAvailable && !frozen);
  const auth = !inputs.authHost ? void 0 : inputs.authToken ? {
@@ -29856,8 +30079,11 @@ var inferOptions = (inputs) => {
    s3SessionToken: inputs.authS3SessionToken
  };
  const postCleanup = inputs.postCleanup ?? true;
+  const pypiKeyringProvider = inputs.pypiKeyringProvider;
  return {
+    globalEnvironments: inputs.globalEnvironments,
    pixiSource,
+    pypiKeyringProvider,
    downloadPixi,
    logLevel,
    manifestPath,
@@ -29868,6 +30094,7 @@ var inferOptions = (inputs) => {
    frozen,
    locked,
    cache,
+    globalCache,
    pixiBinPath,
    auth,
    postCleanup
@@ -29896,7 +30123,9 @@ var getOptions = () => {
    locked: parseOrUndefinedJSON("locked", boolean2()),
    frozen: parseOrUndefinedJSON("frozen", boolean2()),
    cache: parseOrUndefinedJSON("cache", boolean2()),
+    globalCache: parseOrUndefinedJSON("global-cache", boolean2()),
    cacheKey: parseOrUndefined("cache-key", string2()),
+    globalCacheKey: parseOrUndefined("global-cache-key", string2()),
    cacheWrite: parseOrUndefinedJSON("cache-write", boolean2()),
    pixiBinPath: parseOrUndefined("pixi-bin-path", string2()),
    authHost: parseOrUndefined("auth-host", string2()),
@@ -29907,6 +30136,8 @@ var getOptions = () => {
    authS3AccessKeyId: parseOrUndefined("auth-s3-access-key-id", string2()),
    authS3SecretAccessKey: parseOrUndefined("auth-s3-secret-access-key", string2()),
    authS3SessionToken: parseOrUndefined("auth-s3-session-token", string2()),
+    pypiKeyringProvider: parseOrUndefined("pypi-keyring-provider", pypiKeyringProviderSchema),
+    globalEnvironments: parseOrUndefinedMultilineList("global-environments", string2()),
    postCleanup: parseOrUndefinedJSON("post-cleanup", boolean2())
  };
  core2.debug(`Inputs: ${JSON.stringify(inputs)}`);
@@ -1,6 +1,6 @@
 {
  "name": "setup-pixi",
-  "version": "0.9.0",
+  "version": "0.9.3",
  "private": true,
  "description": "Action to set up the pixi package manager.",
  "scripts": {
@@ -22,25 +22,25 @@
  "author": "Pavel Zwerschke <pavelzw@gmail.com>",
  "license": "BSD-3-Clause",
  "dependencies": {
-    "@actions/cache": "^4.0.3",
+    "@actions/cache": "^4.1.0",
    "@actions/core": "^1.11.1",
    "@actions/exec": "^1.1.1",
-    "@actions/io": "^1.1.3",
+    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^2.0.2",
    "handlebars": "^4.7.8",
-    "smol-toml": "^1.4.1",
-    "untildify": "^5.0.0",
+    "smol-toml": "^1.4.2",
+    "untildify": "^6.0.0",
    "which": "^5.0.0",
-    "zod": "^4.0.14"
+    "zod": "^4.1.12"
  },
  "devDependencies": {
-    "@eslint/js": "^9.32.0",
-    "@types/node": "^24.1.0",
+    "@eslint/js": "^9.39.0",
+    "@types/node": "^24.9.2",
    "@types/which": "^3.0.4",
-    "eslint": "^9.32.0",
+    "eslint": "^9.34.0",
    "prettier": "^3.6.2",
    "tsup": "^8.4.0",
-    "typescript": "^5.9.2",
-    "typescript-eslint": "^8.38.0"
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.46.2"
  }
 }
@@ -5,79 +5,161 @@ import * as cache from '@actions/cache'
 import { options } from './options'
 import { getCondaArch, sha256 } from './util'

-export const generateCacheKey = async (cacheKeyPrefix: string) =>
-  Promise.all([fs.readFile(options.pixiLockFile), fs.readFile(options.pixiBinPath)])
-    .then(([lockfileContent, pixiBinary]) => {
-      const lockfileSha = sha256(lockfileContent)
-      core.debug(`lockfileSha: ${lockfileSha}`)
-      const pixiSha = sha256(pixiBinary)
-      core.debug(`pixiSha: ${pixiSha}`)
-      // the path to the lock file decides where the pixi env is created (../.pixi/env)
-      // since conda envs are not relocatable, we need to include the path in the cache key
-      const lockfilePathSha = sha256(options.pixiLockFile)
-      core.debug(`lockfilePathSha: ${lockfilePathSha}`)
-      const environments = sha256(options.environments?.join(' ') ?? '')
-      core.debug(`environments: ${environments}`)
-      // since the lockfile path is not necessarily absolute, we need to include the cwd in the cache key
-      const cwdSha = sha256(process.cwd())
-      core.debug(`cwdSha: ${cwdSha}`)
-      const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
-      core.debug(`sha: ${sha}`)
-      return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
-    })
-    .catch((err: unknown) => {
+const getYearMonth = () => {
+  // this gets us the current month formatted as YYYY-MM
+  return new Date().toLocaleDateString('en-CA', { year: 'numeric', month: '2-digit' })
+}
+
+let pixiSha: string | undefined
+const getPixiSha = async () => {
+  if (pixiSha) {
+    return pixiSha
+  }
+  const pixiBinary = await fs.readFile(options.pixiBinPath)
+  pixiSha = sha256(pixiBinary)
+  return pixiSha
+}
+
+export const generateProjectCacheKey = async (cacheKeyPrefix: string) => {
+  try {
+    const [lockfileContent, pixiSha] = await Promise.all([fs.readFile(options.pixiLockFile), getPixiSha()])
+    const lockfileSha = sha256(lockfileContent)
+    core.debug(`lockfileSha: ${lockfileSha}`)
+    core.debug(`pixiSha: ${pixiSha}`)
+    // the path to the lock file decides where the pixi env is created (../.pixi/env)
+    // since conda envs are not relocatable, we need to include the path in the cache key
+    const lockfilePathSha = sha256(options.pixiLockFile)
+    core.debug(`lockfilePathSha: ${lockfilePathSha}`)
+    const environments = sha256(options.environments?.join(' ') ?? '')
+    core.debug(`environments: ${environments}`)
+    // since the lockfile path is not necessarily absolute, we need to include the cwd in the cache key
+    const cwdSha = sha256(process.cwd())
+    core.debug(`cwdSha: ${cwdSha}`)
+    const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
+    core.debug(`sha: ${sha}`)
+    return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
+  } catch (err: unknown) {
+    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+    throw new Error(`Failed to generate cache key: ${err}`)
+  }
+}
+
+export const generateGlobalCacheKey = async (cacheKeyPrefix: string) => {
+  try {
+    const pixiSha = await getPixiSha()
+    core.debug(`pixiSha: ${pixiSha}`)
+    const globalEnvironments = sha256(options.globalEnvironments?.join(' ') ?? '')
+    core.debug(`globalEnvironments: ${globalEnvironments}`)
+    const sha = sha256(globalEnvironments + pixiSha + getGlobalCachePath())
+    core.debug(`sha: ${sha}`)
+    return `${cacheKeyPrefix}${getCondaArch()}-${getYearMonth()}-${sha}`
+  } catch (err: unknown) {
+    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+    throw new Error(`Failed to generate cache key: ${err}`)
+  }
+}
+
+const projectCachePath = path.join(path.dirname(options.pixiLockFile), '.pixi')
+
+const getGlobalCachePath = () => {
+  const pixiHome = process.env.PIXI_HOME
+  if (pixiHome) {
+    return path.join(pixiHome, 'envs')
+  }
+
+  const home = process.env.HOME
+  if (home) {
+    return path.join(home, '.pixi', 'envs')
+  }
+
+  throw new Error('Neither PIXI_HOME nor HOME environment variables are set.')
+}
+
+let projectCacheHit = false
+let globalCacheHit = false
+
+async function _tryRestoreCache(
+  type: 'project' | 'global',
+  keyPrefix: string,
+  generateKey: (prefix: string) => Promise<string>,
+  cachePath: string,
+  onHit: () => void
+): Promise<string | undefined> {
+  return core.group(`Restoring ${type} cache`, async () => {
+    const cacheKey = await generateKey(keyPrefix)
+    core.debug(`Cache key: ${cacheKey}`)
+    core.debug(`Cache path: ${cachePath}`)
+    const key = await cache.restoreCache([cachePath], cacheKey, undefined, undefined, false)
+    if (key) {
+      core.info(`Restored cache with key \`${key}\``)
+      onHit()
+    } else {
+      core.info(`Cache miss`)
+    }
+    return key
+  })
+}
+
+async function _saveCache(
+  type: 'project' | 'global',
+  wasHit: boolean,
+  keyPrefix: string,
+  generateKey: (prefix: string) => Promise<string>,
+  cachePath: string
+) {
+  if (wasHit) {
+    core.debug(`Skipping ${type} cache save because cache was restored.`)
+    return
+  }
+
+  await core.group(`Saving ${type.toLowerCase()} cache`, async () => {
+    const cacheKey = await generateKey(keyPrefix)
+    try {
+      const cacheId = await cache.saveCache([cachePath], cacheKey, undefined, false)
+      core.info(`Saved cache with ID "${cacheId.toString()}"`)
+    } catch (err: unknown) {
      // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-      throw new Error(`Failed to generate cache key: ${err}`)
-    })
+      core.error(`Error saving ${type} cache: ${err}`)
+    }
+  })
+}

-const cachePath = path.join(path.dirname(options.pixiLockFile), '.pixi')
-
-let cacheHit = false
-
-export const tryRestoreCache = (): Promise<string | undefined> => {
+export const tryRestoreProjectCache = async (): Promise<string | undefined> => {
  const cache_ = options.cache
  if (!cache_) {
-    core.debug('Skipping pixi cache restore.')
-    return Promise.resolve(undefined)
+    core.debug('Skipping project cache restore.')
+    return undefined
  }
-  return core.group('Restoring pixi cache', () =>
-    generateCacheKey(cache_.cacheKeyPrefix).then((cacheKey) => {
-      core.debug(`Cache key: ${cacheKey}`)
-      core.debug(`Cache path: ${cachePath}`)
-      return cache.restoreCache([cachePath], cacheKey, undefined, undefined, false).then((key) => {
-        if (key) {
-          core.info(`Restored cache with key \`${key}\``)
-          cacheHit = true
-        } else {
-          core.info(`Cache miss`)
-        }
-        return key
-      })
-    })
-  )
+  return _tryRestoreCache('project', cache_.cacheKeyPrefix, generateProjectCacheKey, projectCachePath, () => {
+    projectCacheHit = true
+  })
 }

-export const saveCache = () => {
-  const cache_ = options.cache
-  if (!cache_?.cacheWrite) {
-    core.debug('Skipping pixi cache save.')
-    return Promise.resolve(undefined)
+export const tryRestoreGlobalCache = async (): Promise<string | undefined> => {
+  const cache_ = options.globalCache
+  if (!cache_ || !options.globalEnvironments || options.globalEnvironments.length === 0) {
+    core.debug('Skipping global cache restore.')
+    return undefined
  }
-  if (cacheHit) {
-    core.debug('Skipping pixi cache save because cache was restored.')
-    return Promise.resolve(undefined)
+  return _tryRestoreCache('global', cache_.cacheKeyPrefix, generateGlobalCacheKey, getGlobalCachePath(), () => {
+    globalCacheHit = true
+  })
+}
+
+export const saveProjectCache = async () => {
+  const cache_ = options.cache
+  if (!cache_?.cacheWrite || !options.runInstall) {
+    core.debug('Skipping project cache save.')
+    return
  }
-  return core.group('Saving pixi cache', () =>
-    generateCacheKey(cache_.cacheKeyPrefix).then((cacheKey) =>
-      cache
-        .saveCache([cachePath], cacheKey, undefined, false)
-        .then((cacheId) => {
-          core.info(`Saved cache with ID "${cacheId.toString()}"`)
-        })
-        .catch((err: unknown) => {
-          // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-          core.error(`Error saving cache: ${err}`)
-        })
-    )
-  )
+  await _saveCache('project', projectCacheHit, cache_.cacheKeyPrefix, generateProjectCacheKey, projectCachePath)
+}
+
+export const saveGlobalCache = async () => {
+  const cache_ = options.globalCache
+  if (!cache_?.cacheWrite || !options.globalEnvironments || options.globalEnvironments.length === 0) {
+    core.debug('Skipping global cache save.')
+    return
+  }
+  await _saveCache('global', globalCacheHit, cache_.cacheKeyPrefix, generateGlobalCacheKey, getGlobalCachePath())
 }
@@ -7,51 +7,47 @@ import { downloadTool } from '@actions/tool-cache'
 import type { PixiSource } from './options'
 import { options } from './options'
 import { execute, pixiCmd, renderPixiUrl } from './util'
-import { saveCache, tryRestoreCache } from './cache'
+import { tryRestoreGlobalCache, tryRestoreProjectCache, saveGlobalCache, saveProjectCache } from './cache'
 import { activateEnvironment } from './activate'

-const downloadPixi = (source: PixiSource) => {
+const downloadPixi = async (source: PixiSource) => {
  const url = renderPixiUrl(source.urlTemplate, source.version)
-  return core.group('Downloading Pixi', () => {
+  await core.group('Downloading Pixi', async () => {
    core.debug('Installing pixi')
    core.debug(`Downloading pixi from ${url}`)
    core.debug(`Using headers: ${JSON.stringify(source.headers)}`)
-    return fs
-      .mkdir(path.dirname(options.pixiBinPath), { recursive: true })
-      .then(() => downloadTool(url, options.pixiBinPath, undefined, source.headers))
-      .then((_downloadPath) => fs.chmod(options.pixiBinPath, 0o755))
-      .then(() => {
-        core.info(`Pixi installed to ${options.pixiBinPath}`)
-      })
+    await fs.mkdir(path.dirname(options.pixiBinPath), { recursive: true })
+    await downloadTool(url, options.pixiBinPath, undefined, source.headers)
+    await fs.chmod(options.pixiBinPath, 0o755)
+    core.info(`Pixi installed to ${options.pixiBinPath}`)
  })
 }

-const pixiLogin = () => {
+const pixiLogin = async () => {
  const auth = options.auth
  if (!auth) {
    core.debug('Skipping pixi login.')
-    return Promise.resolve(0)
+    return
  }
  core.debug(`auth keys: ${Object.keys(auth).toString()}`)
-  return core.group('Logging in to private channel', () => {
+  await core.group('Logging in to private channel', async () => {
    // tokens get censored in the logs as long as they are a github secret
    if ('token' in auth) {
      core.debug(`Logging in to ${auth.host} with token`)
-      return execute(pixiCmd(`auth login --token ${auth.token} ${auth.host}`, false))
-    }
-    if ('username' in auth) {
+      await execute(pixiCmd(`auth login --token ${auth.token} ${auth.host}`, false))
+    } else if ('username' in auth) {
      core.debug(`Logging in to ${auth.host} with username and password`)
-      return execute(pixiCmd(`auth login --username ${auth.username} --password ${auth.password} ${auth.host}`, false))
-    }
-    if ('s3AccessKeyId' in auth) {
+      await execute(pixiCmd(`auth login --username ${auth.username} --password ${auth.password} ${auth.host}`, false))
+    } else if ('s3AccessKeyId' in auth) {
      core.debug(`Logging in to ${auth.host} with s3 credentials`)
      const command = auth.s3SessionToken
        ? `auth login --s3-access-key-id ${auth.s3AccessKeyId} --s3-secret-access-key ${auth.s3SecretAccessKey} --s3-session-token ${auth.s3SessionToken} ${auth.host}`
        : `auth login --s3-access-key-id ${auth.s3AccessKeyId} --s3-secret-access-key ${auth.s3SecretAccessKey} ${auth.host}`
-      return execute(pixiCmd(command, false))
+      await execute(pixiCmd(command, false))
+    } else if ('condaToken' in auth) {
+      core.debug(`Logging in to ${auth.host} with conda token`)
+      await execute(pixiCmd(`auth login --conda-token ${auth.condaToken} ${auth.host}`, false))
    }
-    core.debug(`Logging in to ${auth.host} with conda token`)
-    return execute(pixiCmd(`auth login --conda-token ${auth.condaToken} ${auth.host}`, false))
  })
 }

@@ -59,33 +55,58 @@ const addPixiToPath = () => {
  core.addPath(path.dirname(options.pixiBinPath))
 }

+const pixiGlobalInstall = async () => {
+  const { globalEnvironments } = options
+  if (!globalEnvironments) {
+    core.debug('Skipping pixi global install.')
+    return
+  }
+
+  await tryRestoreGlobalCache()
+
+  core.debug('Installing global environments')
+  for (const env of globalEnvironments) {
+    const command = `global install ${env}`
+    await core.group(`pixi ${command}`, () => execute(pixiCmd(command, false)))
+  }
+
+  await saveGlobalCache()
+}
+
 const pixiInstall = async () => {
  if (!options.runInstall) {
    core.debug('Skipping pixi install.')
-    return Promise.resolve()
+    return
  }
-  return tryRestoreCache()
-    .then(async (_cacheKey) => {
-      if (options.environments) {
-        for (const environment of options.environments) {
-          core.debug(`Installing environment ${environment}`)
-          const command = `install -e ${environment}${options.frozen ? ' --frozen' : ''}${
-            options.locked ? ' --locked' : ''
-          }`
-          await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
-        }
-      } else {
-        const command = `install${options.frozen ? ' --frozen' : ''}${options.locked ? ' --locked' : ''}`
-        return core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
-      }
-    })
-    .then(saveCache)
+
+  await tryRestoreProjectCache()
+
+  const environments = options.environments ?? [undefined]
+  for (const environment of environments) {
+    core.debug(`Installing environment ${environment ?? 'default'}`)
+    let command = `install`
+    if (environment) {
+      command += ` -e ${environment}`
+    }
+    if (options.frozen) {
+      command += ' --frozen'
+    }
+    if (options.locked) {
+      command += ' --locked'
+    }
+    if (options.pypiKeyringProvider) {
+      command += ` --pypi-keyring-provider ${options.pypiKeyringProvider}`
+    }
+    await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
+  }
+
+  await saveProjectCache()
 }

 const generateList = async () => {
  if (!options.runInstall) {
    core.debug('Skipping pixi list.')
-    return Promise.resolve()
+    return
  }
  if (
    'version' in options.pixiSource &&
@@ -95,7 +116,7 @@ const generateList = async () => {
    core.warning(
      'pixi list is not supported for pixi versions < `v0.13.0`. Please set `pixi-version` to `v0.13.0` or later.'
    )
-    return Promise.resolve()
+    return
  }
  let command = 'list'
  if (
@@ -111,17 +132,21 @@ const generateList = async () => {
  if (options.environments) {
    for (const environment of options.environments) {
      core.debug(`Listing environment ${environment}`)
-      await core.group(`pixi ${command} -e ${environment}`, () => execute(pixiCmd(`${command} -e ${environment}`)))
+      const cmd = `${command} -e ${environment}`
+      await core.group(`pixi ${cmd}`, () => execute(pixiCmd(cmd)))
    }
-    return Promise.resolve()
  } else {
-    return core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
+    await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
  }
 }

-const generateInfo = () => core.group('pixi info', () => execute(pixiCmd('info')))
+const generateInfo = async () => {
+  await core.group('pixi info', () => execute(pixiCmd('info')))
+}

-const activateEnv = (environment: string) => core.group('Activate environment', () => activateEnvironment(environment))
+const activateEnv = async (environment: string) => {
+  await core.group('Activate environment', () => activateEnvironment(environment))
+}

 const run = async () => {
  core.debug(`process.env.HOME: ${process.env.HOME ?? '-'}`)
@@ -131,17 +156,21 @@ const run = async () => {
  }
  addPixiToPath()
  await pixiLogin()
-  await pixiInstall()
+  await pixiGlobalInstall()
  await generateInfo()
+  await pixiInstall()
  await generateList()
  if (options.activatedEnvironment) {
    await activateEnv(options.activatedEnvironment)
  }
 }

-run()
-  .then(() => exit(0)) // workaround for https://github.com/actions/toolkit/issues/1578
-  .catch((error: unknown) => {
+const main = async () => {
+  try {
+    await run()
+    // workaround for https://github.com/actions/toolkit/issues/1578
+    exit(0)
+  } catch (error: unknown) {
    if (core.isDebug()) {
      throw error
    }
@@ -151,6 +180,10 @@ run()
    } else if (typeof error === 'string') {
      core.setFailed(error)
      exit(1)
+    } else {
+      throw error
    }
-    throw error
-  })
+  }
+}
+
+void main()
@@ -21,7 +21,9 @@ type Inputs = Readonly<{
  frozen?: boolean
  locked?: boolean
  cache?: boolean
+  globalCache?: boolean
  cacheKey?: string
+  globalCacheKey?: string
  cacheWrite?: boolean
  pixiBinPath?: string
  authHost?: string
@@ -32,7 +34,9 @@ type Inputs = Readonly<{
  authS3AccessKeyId?: string
  authS3SecretAccessKey?: string
  authS3SessionToken?: string
+  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup?: boolean
+  globalEnvironments?: string[]
 }>

 export interface PixiSource {
@@ -66,6 +70,11 @@ interface Cache {
  cacheWrite: boolean
 }

+interface GlobalCache {
+  cacheKeyPrefix: string
+  cacheWrite: boolean
+}
+
 export type Options = Readonly<{
  pixiSource: PixiSource
  downloadPixi: boolean
@@ -77,10 +86,13 @@ export type Options = Readonly<{
  frozen: boolean
  locked: boolean
  cache?: Cache
+  globalCache?: GlobalCache
  pixiBinPath: string
  auth?: Auth
+  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup: boolean
  activatedEnvironment?: string
+  globalEnvironments?: string[]
 }>
 const pixiPath = 'pixi.toml'
 const pyprojectPath = 'pyproject.toml'
@@ -88,6 +100,9 @@ const pyprojectPath = 'pyproject.toml'
 const logLevelSchema = z.enum(['q', 'default', 'v', 'vv', 'vvv'])
 export type LogLevel = z.infer<typeof logLevelSchema>

+const pypiKeyringProviderSchema = z.enum(['disabled', 'subprocess'])
+export type PypiKeyringProvider = z.infer<typeof pypiKeyringProviderSchema>
+
 export const PATHS = {
  pixiBin: path.join(os.homedir(), '.pixi', 'bin', `pixi${os.platform() === 'win32' ? '.exe' : ''}`)
 }
@@ -147,16 +162,33 @@ const parseOrUndefinedList = <T>(key: string, schema: z.ZodType<T>): T[] | undef
    .filter((s) => s !== '')
 }

+const parseOrUndefinedMultilineList = <T>(key: string, schema: z.ZodType<T>): T[] | undefined => {
+  const input = inputOrEnvironmentVariable(key)
+  if (input === undefined) {
+    return undefined
+  }
+  return input
+    .split('\n')
+    .map((s) => schema.parse(s.trim()))
+    .filter((s) => s !== '')
+}
+
 const validateInputs = (inputs: Inputs): void => {
  if (inputs.pixiUrlHeaders && !inputs.pixiUrl) {
    throw new Error('You need to specify pixi-url when using pixi-url-headers')
  }
  if (inputs.cacheKey !== undefined && inputs.cache === false) {
-    throw new Error('Cannot specify cache key without caching')
+    throw new Error('Cannot specify project cache key without project caching')
+  }
+  if (inputs.globalCacheKey !== undefined && inputs.globalCache === false) {
+    throw new Error('Cannot specify global cache key without global caching')
  }
  if (inputs.runInstall === false && inputs.cache === true) {
    throw new Error('Cannot cache without running install')
  }
+  if (inputs.globalCache === true && (!inputs.globalEnvironments || inputs.globalEnvironments.length === 0)) {
+    throw new Error('Cannot use global-cache without specifying global-environments')
+  }
  if (inputs.runInstall === false && inputs.frozen === true) {
    throw new Error('Cannot use `frozen: true` when not running install')
  }
@@ -291,10 +323,19 @@ const inferOptions = (inputs: Inputs): Options => {
  } else if (inputs.activateEnvironment && inputs.activateEnvironment !== 'false') {
    activatedEnvironment = inputs.activateEnvironment
  }
-  const cache = inputs.cacheKey
-    ? { cacheKeyPrefix: inputs.cacheKey, cacheWrite: inputs.cacheWrite ?? true }
-    : inputs.cache === true || (lockFileAvailable && inputs.cache !== false)
-      ? { cacheKeyPrefix: 'pixi-', cacheWrite: inputs.cacheWrite ?? true }
+  const cache =
+    inputs.cache === true || (lockFileAvailable && inputs.cache !== false)
+      ? {
+          cacheKeyPrefix: inputs.cacheKey ?? 'pixi-',
+          cacheWrite: inputs.cacheWrite ?? true
+        }
+      : undefined
+  const globalCache =
+    inputs.globalCache === true && inputs.globalEnvironments && inputs.globalEnvironments.length > 0
+      ? {
+          cacheKeyPrefix: inputs.globalCacheKey ?? 'pixi-global-',
+          cacheWrite: inputs.cacheWrite ?? true
+        }
      : undefined
  const frozen = inputs.frozen ?? false
  const locked = inputs.locked ?? (lockFileAvailable && !frozen)
@@ -323,8 +364,11 @@ const inferOptions = (inputs: Inputs): Options => {
                s3SessionToken: inputs.authS3SessionToken
              }) as Auth)
  const postCleanup = inputs.postCleanup ?? true
+  const pypiKeyringProvider = inputs.pypiKeyringProvider
  return {
+    globalEnvironments: inputs.globalEnvironments,
    pixiSource,
+    pypiKeyringProvider,
    downloadPixi,
    logLevel,
    manifestPath,
@@ -335,6 +379,7 @@ const inferOptions = (inputs: Inputs): Options => {
    frozen,
    locked,
    cache,
+    globalCache,
    pixiBinPath,
    auth,
    postCleanup
@@ -371,7 +416,9 @@ const getOptions = () => {
    locked: parseOrUndefinedJSON('locked', z.boolean()),
    frozen: parseOrUndefinedJSON('frozen', z.boolean()),
    cache: parseOrUndefinedJSON('cache', z.boolean()),
+    globalCache: parseOrUndefinedJSON('global-cache', z.boolean()),
    cacheKey: parseOrUndefined('cache-key', z.string()),
+    globalCacheKey: parseOrUndefined('global-cache-key', z.string()),
    cacheWrite: parseOrUndefinedJSON('cache-write', z.boolean()),
    pixiBinPath: parseOrUndefined('pixi-bin-path', z.string()),
    authHost: parseOrUndefined('auth-host', z.string()),
@@ -382,6 +429,8 @@ const getOptions = () => {
    authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
    authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
    authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
+    pypiKeyringProvider: parseOrUndefined('pypi-keyring-provider', pypiKeyringProviderSchema),
+    globalEnvironments: parseOrUndefinedMultilineList('global-environments', z.string()),
    postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
  }
  core.debug(`Inputs: ${JSON.stringify(inputs)}`)
@@ -1,9 +1,9 @@
-[project]
+[workspace]
 name = "test-auth-s3"
 channels = ["s3://rattler-s3-testing/channel", "conda-forge"]
 platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]

-[project.s3-options.rattler-s3-testing]
+[workspace.s3-options.rattler-s3-testing]
 endpoint-url = "https://e1a7cde76f1780ec06bac859036dbaf7.eu.r2.cloudflarestorage.com"
 force-path-style = true
 region = "auto"
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-auth"
 channels = ["conda-forge", "https://repo.prefix.dev/setup-pixi-test"]
 platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-win-arm64"
 channels = ["conda-forge"]
 platforms = [
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-default"
 channels = ["conda-forge"]
 platforms = ["linux-64", "linux-aarch64", "osx-64", "osx-arm64", "win-64"]
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-default"
 version = "0.1.0"
 description = "Add a short description here"
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-package"
 channels = ["conda-forge"]
 platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]
@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-no-lockfile"
 channels = ["conda-forge"]
 platforms = ["linux-64", "linux-aarch64", "osx-64", "osx-arm64", "win-64"]
@@ -19,7 +19,7 @@ lint = ["ruff>=0.1.14"]
 [tool.ruff]
 target-version = "py310"
 line-length = 100
-exclude = [ ".pixi", "__pycache__" ]
+exclude = [".pixi", "__pycache__"]
 # the TOML parser should also support comments in lists
 lint.select = [
  # flake8-bugbear
@@ -34,7 +34,7 @@ lint.select = [
  "F",
 ]

-[tool.pixi.project]
+[tool.pixi.workspace]
 name = "pyproject-manifest"
 channels = ["conda-forge"]
 platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]
Author	SHA1	Message	Date
Pavel Zwerschke	82d477f15f	feat: Switch order of pixi info and pixi install (#234 )	2025-11-03 11:25:42 +01:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Pavel Zwerschke	a976380763	chore(deps): bump the nodejs group across 1 directory with 9 updates (#233 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2025-11-03 10:33:38 +01:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	de110d6265	chore(deps): bump the gh-actions group with 4 updates (#232 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-01 06:47:05 +01:00
Ruben Arts	59d669bca0	Update documentation links to new pixi URLs (#230 )	2025-10-20 06:26:01 +00:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	046c0f75f2	chore(deps): bump the gh-actions group with 3 updates (#228 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-10-19 17:30:41 +02:00
github-actions[bot]	34ef3cc298	docs: Reference latest Pixi version in README (#227 )	2025-10-19 17:30:07 +02:00
Olivier Lacroix	28eb668aaf	feat: Allow caching global environment(s) (#226 )	2025-10-19 15:37:21 +02:00
Olivier LacroixandPavel Zwerschke	194d461b21	Add possibility to install global environments (#221 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2025-09-22 11:51:37 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	40ab2611f4	chore(deps): bump the nodejs group with 7 updates (#223 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-09-01 11:47:19 +00:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	83ecca31f5	chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 in the gh-actions group (#222 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-09-01 13:41:15 +02:00
Olivier Lacroix	ba511d5090	Add pypi-keyring-provider option (#220 )	2025-08-13 14:23:50 +02:00