feat: change post-cleanup default to false (#272)

Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>

.gitattributes

@@ -1 +1,2 @@
 dist/** merge=binary -diff linguist-generated=true
+pnpm-lock.yaml merge=binary linguist-generated=true

.github/chainguard/write.sts.yaml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json
+issuer: https://token.actions.githubusercontent.com
+subject: repo:prefix-dev/setup-pixi:ref:refs/heads/main
+
+permissions:
+  contents: write
+  pull_requests: write

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
       gh-actions:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7
   - package-ecosystem: npm
     directory: /
     schedule:
@@ -16,3 +18,5 @@ updates:
       nodejs:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -15,15 +15,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.4.0
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
           version: 9
 
       - name: Install Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 20
           cache: pnpm
@@ -41,13 +41,13 @@ jobs:
     name: Reference latest version in README
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Assert latest setup-pixi version is mentioned in README
         run: |
           set -euo pipefail
           latest_version="$(jq -r '.version' package.json)"
-          count_expected=21
+          count_expected=24
           count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
           if [ "$count_actual" -ne "$count_expected" ]; then
             echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
@@ -59,10 +59,10 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Assert latest pixi version is mentioned in README
         run: |
@@ -78,11 +78,17 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          identity: write
+
       - name: Create pull request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         if: failure() && github.ref_name == 'main'
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
           commit-message: Reference latest Pixi version in README
           title: Reference latest Pixi version in README
           labels: ignore for release
@@ -90,15 +96,15 @@ jobs:
   check-dist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.4.0
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
           version: 9
 
       - name: Install Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 20
           cache: pnpm
@@ -119,7 +125,7 @@ jobs:
         id: diff
 
       # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/release.yml

@@ -12,8 +12,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: Quantco/ui-actions/version-metadata@cd71d2a0e30b25569f6d723e57acca83347e58fc # v1.0.18
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: Quantco/ui-actions/version-metadata@5bfb8cebf0801e07c6a1c208a35b41637a3ff7fa # v1.0.20
         id: version-metadata
         with:
           file: ./package.json
@@ -24,7 +24,7 @@ jobs:
           TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
       - name: Create release
         if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           generate_release_notes: true
           tag_name: v${{ steps.version-metadata.outputs.newVersion }}

.github/workflows/test.yml

@@ -17,12 +17,12 @@ jobs:
     strategy:
       matrix:
         # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
         cache: [true, false]
     runs-on: ${{ matrix.os }}
     name: default ${{ matrix.cache == true && 'with' || 'without' }} cache (${{ matrix.os }})
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -53,7 +53,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -78,7 +78,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -102,7 +102,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -119,7 +119,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -131,10 +131,10 @@ jobs:
   custom-pixi-version:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -152,7 +152,7 @@ jobs:
         locked: [true, false]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -168,10 +168,10 @@ jobs:
   install-path:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -181,10 +181,10 @@ jobs:
   global-install:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -203,7 +203,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -218,7 +218,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -230,7 +230,7 @@ jobs:
   custom-pixi-url:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -242,7 +242,7 @@ jobs:
   pixi-url-headers-bearer:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - name: Setup caddy
@@ -283,7 +283,7 @@ jobs:
   pixi-url-custom-template-no-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           pixi-url: |
@@ -298,7 +298,7 @@ jobs:
   pixi-url-custom-template-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           pixi-url: |
@@ -314,7 +314,7 @@ jobs:
   pixi-url-custom-template-version-latest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           pixi-url: |
@@ -327,13 +327,101 @@ jobs:
           pixi-version: latest
       - run: pixi --version | grep -q "pixi 0.14.0"
 
+  working-directory:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./
+        with:
+          cache: false
+          working-directory: test/default
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/bin/python
+          .pixi/envs/default/bin/python --version | grep -q 3.11
+        shell: bash
+        working-directory: test/default
+        if: matrix.os != 'windows-latest'
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/python.exe
+          .pixi/envs/default/python.exe --version | grep -q 3.11
+        shell: bash
+        working-directory: test/default
+        if: matrix.os == 'windows-latest'
+      - run: pixi run python --version | grep -q 3.11
+        working-directory: test/default
+
+  working-directory-with-manifest-path:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./
+        with:
+          cache: false
+          working-directory: test
+          manifest-path: default/pixi.toml
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/bin/python
+        shell: bash
+        working-directory: test/default
+        if: matrix.os != 'windows-latest'
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/python.exe
+        shell: bash
+        working-directory: test/default
+        if: matrix.os == 'windows-latest'
+      - run: pixi run python --version | grep -q 3.11
+        working-directory: test/default
+
+  working-directory-with-absolute-manifest-path:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./
+        with:
+          cache: false
+          working-directory: test/default
+          manifest-path: ${{ github.workspace }}/test/default/pixi.toml
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/bin/python
+        shell: bash
+        working-directory: test/default
+        if: matrix.os != 'windows-latest'
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/python.exe
+        shell: bash
+        working-directory: test/default
+        if: matrix.os == 'windows-latest'
+      - run: pixi run python --version | grep -q 3.11
+        working-directory: test/default
+
   custom-manifest-path:
     strategy:
       matrix:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           cache: false
@@ -345,7 +433,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -359,7 +447,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -380,7 +468,7 @@ jobs:
         ignore-reason: [none, version, version-latest, url, bin-path]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - name: Create pixi directory and add to PATH
@@ -499,7 +587,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -520,7 +608,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -543,7 +631,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -558,6 +646,52 @@ jobs:
         # https://github.com/prefix-dev/pixi/issues/330
         if: matrix.os == 'ubuntu-latest'
 
+  persist-credentials-false:
+    env:
+      # We must set this environment variable explicitly to force all
+      # operating systems to use the same storage mechanism.
+      # Otherwise, windows and mac will use the keychain, which is more cumbersome to test.
+      RATTLER_AUTH_FILE: .rattler-credentials.json
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      # Sanity check: Login with default persist-credentials behavior
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+      - name: Assert that the credentials are stored
+        run: |
+          # For human log readers
+          cat "${RATTLER_AUTH_FILE}"
+          # Actual test
+          [ $(jq '."*.custom-conda-registry.com".BearerToken' -r "${RATTLER_AUTH_FILE}") = "custom-token" ]
+      - name: Clean up credentials file
+        run: rm "${RATTLER_AUTH_FILE}"
+      # Actual test: Login with persist-credentials: false
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+          persist-credentials: false
+      - name: Assert that the credentials are not stored anymore
+        run: |
+          # For human log readers
+          cat "${RATTLER_AUTH_FILE}"
+
+          # Actual test
+          ! grep -q '"*.custom-conda-registry.com"' "${RATTLER_AUTH_FILE}"
+
   auth-token-install:
     strategy:
       matrix:
@@ -565,7 +699,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/auth/* .
       - uses: ./
@@ -584,7 +718,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/auth-s3/* .
       - uses: ./
@@ -604,7 +738,7 @@ jobs:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -631,7 +765,7 @@ jobs:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -653,7 +787,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -678,7 +812,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -700,7 +834,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -721,7 +855,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -742,7 +876,7 @@ jobs:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -770,11 +904,11 @@ jobs:
     name: multiple-environments (${{ matrix.os }}, cache=${{ matrix.cache }})
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         cache: ['true', 'false']
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -808,9 +942,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -824,9 +958,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -849,9 +983,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -873,9 +1007,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -892,7 +1026,7 @@ jobs:
         os: [windows-latest, ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/pyproject-manifest/* .
       - uses: ./
@@ -910,7 +1044,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           cache: true
@@ -922,7 +1056,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -938,7 +1072,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -954,7 +1088,7 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -970,7 +1104,7 @@ jobs:
       run:
         shell: cmd
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -988,7 +1122,7 @@ jobs:
   environment-activation-false:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -999,7 +1133,7 @@ jobs:
   environment-activation-explicit-env:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -1012,7 +1146,7 @@ jobs:
   environment-activation-multiple-env:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -1029,7 +1163,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -1047,7 +1181,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -1065,7 +1199,7 @@ jobs:
   env-variable-input-custom-pixi-url:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -1078,7 +1212,7 @@ jobs:
   env-variable-input-precendence:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -1096,7 +1230,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -1118,7 +1252,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -1139,7 +1273,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -1162,7 +1296,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -1183,7 +1317,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -1204,7 +1338,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/lockfile-not-up-to-date/* .
       - uses: ./
@@ -1225,7 +1359,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./

README.md

@@ -23,9 +23,9 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
-    pixi-version: v0.49.0
+    pixi-version: v0.66.0
 
     cache: true
     auth-host: prefix.dev
@@ -35,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 
 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.9.1`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.10.0`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -51,6 +51,8 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 >       dependencies:
 >         patterns:
 >           - '*'
+>     cooldown:
+>       default-days: 7
 > ```
 
 ## Features
@@ -59,14 +61,17 @@ To see all available input arguments, see the [`action.yml`](action.yml) file.
 
 ### Caching
 
-The action supports caching of the pixi environment.
-By default, caching is enabled if a `pixi.lock` file is present.
+The action supports caching of the project and global pixi environments.
+By default, project environment caching is enabled if a `pixi.lock` file is present.
 It will then use the `pixi.lock` file to generate a hash of the environment and cache it.
 If the cache is hit, the action will skip the installation and use the cached environment.
 You can specify the behavior by setting the `cache` input argument.
 
-If you need to customize your cache-key, you can use the `cache-key` input argument.
-This will be the prefix of the cache key. The full cache key will be `<cache-key><conda-arch>-<hash>`.
+Global environment caching is disabled by default and can be enabled by setting the `global-cache` input to `true`.
+As there is no lockfile for global environments, the cache will expire at the end of every month to ensure it does not go stale.
+
+If you need to customize your cache-key, you can use the `cache-key` and `global-cache-key` input arguments.
+These will be the prefixes of the cache keys. The full cache keys will be `<cache-key><conda-arch>-<hash>` and `<global-cache-key><conda-arch>-<YYYY-MM>-<hash>` respectively.
 
 #### Only save caches on `main`
 
@@ -74,7 +79,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     cache: true
     cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -119,7 +124,7 @@ test:
       environment: [py311, py312]
   steps:
     - uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.9.1
+    - uses: prefix-dev/setup-pixi@v0.10.0
       with:
         environments: ${{ matrix.environment }}
 ```
@@ -129,7 +134,7 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     # separated by spaces
     environments: >-
@@ -149,10 +154,10 @@ You can specify `pixi global install` commands by setting the `global-environmen
 This will create one environment per line, and install them.
 This is useful in particular to install executables that are needed for `pixi install` to work properly.
 For instance, the `keyring`, or `gcloud` executables. The following example shows how to install both in separate global environments.
-Note that global environments are not cached.
+By default, global environments are not cached. You can enable caching by setting the `global-cache` input to `true`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     global-environments: |
       google-cloud-sdk
@@ -172,7 +177,7 @@ There are currently five ways to authenticate with pixi:
 - using an S3 key pair
 - using keyring for PyPI registries
 
-For more information, see the [pixi documentation](https://prefix.dev/docs/pixi/authentication).
+For more information, see the [pixi documentation](https://pixi.sh/latest/deployment/authentication/).
 
 > [!WARNING]
 > Please only store sensitive information using [GitHub secrets](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions). Do not store them in your repository.
@@ -185,7 +190,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: prefix.dev
     auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -197,7 +202,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: custom-artifactory.com
     auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -210,7 +215,7 @@ Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: anaconda.org # or my-quetz-instance.com
     auth-conda-token: ${{ secrets.CONDA_TOKEN }}
@@ -222,7 +227,7 @@ Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-k
 You can also specify the session token using the `auth-session-token` input argument.
 
 ```yaml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: s3://my-s3-bucket
     auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
@@ -233,12 +238,27 @@ You can also specify the session token using the `auth-session-token` input argu
 
 See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.
 
+#### Restricting credentials to the install step
+
+If you only want pixi to use the authenticated remote channel during the action's own install step
+(and not in any subsequent step of the workflow), set `persist-credentials: false`. The action will
+then run `pixi auth logout <auth-host>` after `pixi install` has completed but before the action
+returns, so that later steps cannot reach the private channel anymore.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.10.0
+  with:
+    auth-host: prefix.dev
+    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
+    persist-credentials: false
+```
+
 #### PyPI keyring provider
 
 You can specify whether to use keyring to look up credentials for PyPI.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     pypi-keyring-provider: subprocess # one of 'subprocess', 'disabled'
 ```
@@ -306,7 +326,7 @@ To this end, `setup-pixi` adds all environment variables set when executing `pix
 As a result, all installed binaries can be accessed without having to call `pixi run`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     activate-environment: true
 ```
@@ -314,7 +334,7 @@ As a result, all installed binaries can be accessed without having to call `pixi
 If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     environments: >-
       py311
@@ -328,10 +348,10 @@ However, be aware that this option augments the environment of your job.
 ### `--frozen` and `--locked`
 
 You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi install --locked` depending on the `frozen` or the `locked` input argument.
-See the [official documentation](https://prefix.dev/docs/pixi/cli#install) for more information about the `--frozen` and `--locked` flags.
+See the [official documentation](https://pixi.sh/latest/reference/cli/pixi/install/#update-options) for more information about the `--frozen` and `--locked` flags.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     locked: true
     # or
@@ -350,7 +370,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   env:
     RUNNER_DEBUG: true
 ```
@@ -368,7 +388,7 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     # one of `q`, `default`, `v`, `vv`, or `vvv`.
     log-level: vvv
@@ -389,12 +409,12 @@ If you set `post-cleanup` to `true`, the action will delete the following files:
 - the rattler cache
 - other rattler files in `~/.rattler`
 
-If nothing is specified, `post-cleanup` will default to `true`.
+If nothing is specified, `post-cleanup` will default to `false`.
 
 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     post-cleanup: true
     # ${{ runner.temp }}\Scripts\pixi.exe on Windows
@@ -410,17 +430,47 @@ You can also use a preinstalled local version of pixi on the runner by not setti
 This can be overwritten by setting the `manifest-path` input argument.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     manifest-path: pyproject.toml
 ```
 
+### Working directory for monorepos
+
+If you're working with a monorepo where your pixi project is in a subdirectory, you can use the `working-directory` input to specify where pixi should look for manifest files (`pixi.toml` or `pyproject.toml`).
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.10.0
+  with:
+    working-directory: ./packages/my-project
+```
+
+This will make pixi look for `pixi.toml` or `pyproject.toml` in the `./packages/my-project` directory instead of the repository root. All pixi commands will be executed from this working directory.
+
+> [!NOTE]
+> The `working-directory` input only affects commands run by `setup-pixi` itself.
+> For subsequent `run:` steps, you need to set the working directory separately:
+>
+> ```yml
+> - run: pixi run test
+>   working-directory: ./packages/my-project
+> ```
+
+You can combine `working-directory` with `manifest-path` if needed:
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.10.0
+  with:
+    working-directory: ./packages/my-project
+    manifest-path: custom-pixi.toml
+```
+
 ### Only install pixi
 
 If you only want to install pixi and not install the current project, you can use the `run-install` option.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     run-install: false
 ```
@@ -431,7 +481,7 @@ You can also download pixi from a custom URL by setting the `pixi-url` input arg
 Optionally, you can combine this with the `pixi-url-headers` input argument to supply additional headers for the download request, such as a bearer token.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     pixi-url: https://pixi-mirror.example.com/releases/download/v0.48.0/pixi-x86_64-unknown-linux-musl
     pixi-url-headers: '{"Authorization": "Bearer ${{ secrets.PIXI_MIRROR_BEARER_TOKEN }}"}'
@@ -447,7 +497,7 @@ It will be rendered with the following variables:
 By default, `pixi-url` is equivalent to the following template:
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.1
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     pixi-url: |
       {{#if latest~}}

action.yml

@@ -18,6 +18,10 @@ inputs:
       One of `q`, `default`, `v`, `vv`, or `vvv`.
   manifest-path:
     description: Path to the manifest file (i.e., `pixi.toml`) to use for the pixi CLI. Defaults to `pixi.toml`.
+  working-directory:
+    description: |
+      Working directory to use for pixi commands. If specified, pixi will look for manifest files (pixi.toml or pyproject.toml) 
+      in this directory instead of the repository root. Useful for monorepos where pixi projects are in subdirectories.
   run-install:
     description: Whether to run `pixi install` after installing pixi. Defaults to `true`.
   environments:
@@ -37,13 +41,21 @@ inputs:
     description: Whether to use `pixi install --frozen`. Defaults to `false`.
   cache:
     description: Whether to cache the pixi environment. Defaults to `true`. Only works if `pixi.lock` is present.
+  global-cache:
+    description: |
+      Whether to cache the global environment(s). Defaults to `false`. As there is no lockfile for global environment,
+      the global cache will expire at the end of every month, to ensure it does not go stale.
   cache-key:
     description: |
       Cache key prefix to use for caching the pixi environment.
       Defaults to `pixi-`. The full cache key is `<cache-key><conda-arch>-<sha-256-of-pixi-lock>`.
+  global-cache-key:
+    description: |
+      Cache key prefix to use for caching the global environments.
+      Defaults to `pixi-global-`. The full cache key is `<global-cache-key><conda-arch>-<sha-256-of-global-environments>`.
   cache-write:
     description: |
-      Whether to write to the cache or only read from it. Defaults to `true`.
+      Whether to write to the cache or only read from it. Defaults to `true`. Applies to both project and global caches as the case may be.
   pixi-bin-path:
     description: |
       Path to the pixi binary to use. Defaults to `~/.pixi/bin/pixi`.
@@ -51,7 +63,7 @@ inputs:
     description: |
       Host to use for authentication. If not set, pixi is not authenticating.
       Requires `auth-token` or `auth-conda-token` or `auth-username` and `auth-password` to be set.
-      See https://prefix.dev/docs/pixi/authentication
+      See https://pixi.prefix.dev/latest/deployment/authentication/
   auth-token:
     description: Token to use for authentication.
   auth-username:
@@ -66,13 +78,19 @@ inputs:
     description: Secret access key to use for S3 authentication.
   auth-s3-session-token:
     description: Session token to use for S3 authentication.
+  persist-credentials:
+    description: |
+      Whether to keep the credentials configured by `auth-host` available to subsequent workflow
+      steps. Defaults to `true`. If set to `false`, the action runs `pixi auth logout <auth-host>`
+      after install, so that later steps cannot reach the private channel anymore. Requires
+      `auth-host`.
   pypi-keyring-provider:
     description: |
       Specifies whether to use keyring to look up credentials for PyPI.
       options: disabled, subprocess
   post-cleanup:
     description: |
-      If the action should clean up after itself. Defaults to `true`.
+      If the action should clean up after itself. Defaults to `false`.
       If `true`, the pixi environment, the pixi binary and the rattler files in ~/.rattler and ~/.cache/rattler are removed.
 
 runs:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "setup-pixi",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "private": true,
   "description": "Action to set up the pixi package manager.",
   "scripts": {
@@ -22,25 +22,25 @@
   "author": "Pavel Zwerschke <pavelzw@gmail.com>",
   "license": "BSD-3-Clause",
   "dependencies": {
-    "@actions/cache": "^4.0.5",
-    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/io": "^1.1.3",
-    "@actions/tool-cache": "^2.0.2",
-    "handlebars": "^4.7.8",
-    "smol-toml": "^1.4.2",
-    "untildify": "^5.0.0",
-    "which": "^5.0.0",
-    "zod": "^4.1.5"
+    "@actions/cache": "^6.0.1",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/io": "^3.0.2",
+    "@actions/tool-cache": "^4.0.0",
+    "handlebars": "^4.7.9",
+    "smol-toml": "^1.6.1",
+    "untildify": "^6.0.0",
+    "which": "^7.0.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@eslint/js": "^9.34.0",
-    "@types/node": "^24.3.0",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.9.1",
     "@types/which": "^3.0.4",
-    "eslint": "^9.34.0",
-    "prettier": "^3.6.2",
-    "tsup": "^8.4.0",
-    "typescript": "^5.9.2",
-    "typescript-eslint": "^8.41.0"
+    "eslint": "^10.4.0",
+    "prettier": "^3.8.3",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.59.4"
   }
 }

src/cache.ts

@@ -5,79 +5,159 @@ import * as cache from '@actions/cache'
 import { options } from './options'
 import { getCondaArch, sha256 } from './util'
 
-export const generateCacheKey = async (cacheKeyPrefix: string) =>
-  Promise.all([fs.readFile(options.pixiLockFile), fs.readFile(options.pixiBinPath)])
-    .then(([lockfileContent, pixiBinary]) => {
-      const lockfileSha = sha256(lockfileContent)
-      core.debug(`lockfileSha: ${lockfileSha}`)
-      const pixiSha = sha256(pixiBinary)
-      core.debug(`pixiSha: ${pixiSha}`)
-      // the path to the lock file decides where the pixi env is created (../.pixi/env)
-      // since conda envs are not relocatable, we need to include the path in the cache key
-      const lockfilePathSha = sha256(options.pixiLockFile)
-      core.debug(`lockfilePathSha: ${lockfilePathSha}`)
-      const environments = sha256(options.environments?.join(' ') ?? '')
-      core.debug(`environments: ${environments}`)
-      // since the lockfile path is not necessarily absolute, we need to include the cwd in the cache key
-      const cwdSha = sha256(process.cwd())
-      core.debug(`cwdSha: ${cwdSha}`)
-      const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
-      core.debug(`sha: ${sha}`)
-      return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
-    })
-    .catch((err: unknown) => {
+const getYearMonth = () => {
+  // this gets us the current month formatted as YYYY-MM
+  return new Date().toLocaleDateString('en-CA', { year: 'numeric', month: '2-digit' })
+}
+
+let pixiSha: string | undefined
+const getPixiSha = async () => {
+  if (pixiSha) {
+    return pixiSha
+  }
+  const pixiBinary = await fs.readFile(options.pixiBinPath)
+  pixiSha = sha256(pixiBinary)
+  return pixiSha
+}
+
+export const generateProjectCacheKey = async (cacheKeyPrefix: string) => {
+  try {
+    const [lockfileContent, pixiSha] = await Promise.all([fs.readFile(options.pixiLockFile), getPixiSha()])
+    const lockfileSha = sha256(lockfileContent)
+    core.debug(`lockfileSha: ${lockfileSha}`)
+    core.debug(`pixiSha: ${pixiSha}`)
+    // the path to the lock file decides where the pixi env is created (../.pixi/env)
+    // since conda envs are not relocatable, we need to include the path in the cache key
+    const lockfilePathSha = sha256(options.pixiLockFile)
+    core.debug(`lockfilePathSha: ${lockfilePathSha}`)
+    const environments = sha256(options.environments?.join(' ') ?? '')
+    core.debug(`environments: ${environments}`)
+    // since the lockfile path is not necessarily absolute, we need to include the working directory in the cache key
+    const cwdSha = sha256(options.workingDirectory)
+    core.debug(`cwdSha: ${cwdSha}`)
+    const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
+    core.debug(`sha: ${sha}`)
+    return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
+  } catch (err: unknown) {
+    throw new Error(`Failed to generate cache key`, { cause: err })
+  }
+}
+
+export const generateGlobalCacheKey = async (cacheKeyPrefix: string) => {
+  try {
+    const pixiSha = await getPixiSha()
+    core.debug(`pixiSha: ${pixiSha}`)
+    const globalEnvironments = sha256(options.globalEnvironments?.join(' ') ?? '')
+    core.debug(`globalEnvironments: ${globalEnvironments}`)
+    const sha = sha256(globalEnvironments + pixiSha + getGlobalCachePath())
+    core.debug(`sha: ${sha}`)
+    return `${cacheKeyPrefix}${getCondaArch()}-${getYearMonth()}-${sha}`
+  } catch (err: unknown) {
+    throw new Error(`Failed to generate cache key`, { cause: err })
+  }
+}
+
+const projectCachePath = path.join(path.dirname(options.pixiLockFile), '.pixi')
+
+const getGlobalCachePath = () => {
+  const pixiHome = process.env.PIXI_HOME
+  if (pixiHome) {
+    return path.join(pixiHome, 'envs')
+  }
+
+  const home = process.env.HOME
+  if (home) {
+    return path.join(home, '.pixi', 'envs')
+  }
+
+  throw new Error('Neither PIXI_HOME nor HOME environment variables are set.')
+}
+
+let projectCacheHit = false
+let globalCacheHit = false
+
+async function _tryRestoreCache(
+  type: 'project' | 'global',
+  keyPrefix: string,
+  generateKey: (prefix: string) => Promise<string>,
+  cachePath: string,
+  onHit: () => void
+): Promise<string | undefined> {
+  return core.group(`Restoring ${type} cache`, async () => {
+    const cacheKey = await generateKey(keyPrefix)
+    core.debug(`Cache key: ${cacheKey}`)
+    core.debug(`Cache path: ${cachePath}`)
+    const key = await cache.restoreCache([cachePath], cacheKey, undefined, undefined, false)
+    if (key) {
+      core.info(`Restored cache with key \`${key}\``)
+      onHit()
+    } else {
+      core.info(`Cache miss`)
+    }
+    return key
+  })
+}
+
+async function _saveCache(
+  type: 'project' | 'global',
+  wasHit: boolean,
+  keyPrefix: string,
+  generateKey: (prefix: string) => Promise<string>,
+  cachePath: string
+) {
+  if (wasHit) {
+    core.debug(`Skipping ${type} cache save because cache was restored.`)
+    return
+  }
+
+  await core.group(`Saving ${type.toLowerCase()} cache`, async () => {
+    const cacheKey = await generateKey(keyPrefix)
+    try {
+      const cacheId = await cache.saveCache([cachePath], cacheKey, undefined, false)
+      core.info(`Saved cache with ID "${cacheId.toString()}"`)
+    } catch (err: unknown) {
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-      throw new Error(`Failed to generate cache key: ${err}`)
-    })
+      core.error(`Error saving ${type} cache: ${err}`)
+    }
+  })
+}
 
-const cachePath = path.join(path.dirname(options.pixiLockFile), '.pixi')
-
-let cacheHit = false
-
-export const tryRestoreCache = (): Promise<string | undefined> => {
+export const tryRestoreProjectCache = async (): Promise<string | undefined> => {
   const cache_ = options.cache
   if (!cache_) {
-    core.debug('Skipping pixi cache restore.')
-    return Promise.resolve(undefined)
+    core.debug('Skipping project cache restore.')
+    return undefined
   }
-  return core.group('Restoring pixi cache', () =>
-    generateCacheKey(cache_.cacheKeyPrefix).then((cacheKey) => {
-      core.debug(`Cache key: ${cacheKey}`)
-      core.debug(`Cache path: ${cachePath}`)
-      return cache.restoreCache([cachePath], cacheKey, undefined, undefined, false).then((key) => {
-        if (key) {
-          core.info(`Restored cache with key \`${key}\``)
-          cacheHit = true
-        } else {
-          core.info(`Cache miss`)
-        }
-        return key
-      })
-    })
-  )
+  return _tryRestoreCache('project', cache_.cacheKeyPrefix, generateProjectCacheKey, projectCachePath, () => {
+    projectCacheHit = true
+  })
 }
 
-export const saveCache = () => {
-  const cache_ = options.cache
-  if (!cache_?.cacheWrite) {
-    core.debug('Skipping pixi cache save.')
-    return Promise.resolve(undefined)
+export const tryRestoreGlobalCache = async (): Promise<string | undefined> => {
+  const cache_ = options.globalCache
+  if (!cache_ || !options.globalEnvironments || options.globalEnvironments.length === 0) {
+    core.debug('Skipping global cache restore.')
+    return undefined
   }
-  if (cacheHit) {
-    core.debug('Skipping pixi cache save because cache was restored.')
-    return Promise.resolve(undefined)
+  return _tryRestoreCache('global', cache_.cacheKeyPrefix, generateGlobalCacheKey, getGlobalCachePath(), () => {
+    globalCacheHit = true
+  })
+}
+
+export const saveProjectCache = async () => {
+  const cache_ = options.cache
+  if (!cache_?.cacheWrite || !options.runInstall) {
+    core.debug('Skipping project cache save.')
+    return
   }
-  return core.group('Saving pixi cache', () =>
-    generateCacheKey(cache_.cacheKeyPrefix).then((cacheKey) =>
-      cache
-        .saveCache([cachePath], cacheKey, undefined, false)
-        .then((cacheId) => {
-          core.info(`Saved cache with ID "${cacheId.toString()}"`)
-        })
-        .catch((err: unknown) => {
-          // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-          core.error(`Error saving cache: ${err}`)
-        })
-    )
-  )
+  await _saveCache('project', projectCacheHit, cache_.cacheKeyPrefix, generateProjectCacheKey, projectCachePath)
+}
+
+export const saveGlobalCache = async () => {
+  const cache_ = options.globalCache
+  if (!cache_?.cacheWrite || !options.globalEnvironments || options.globalEnvironments.length === 0) {
+    core.debug('Skipping global cache save.')
+    return
+  }
+  await _saveCache('global', globalCacheHit, cache_.cacheKeyPrefix, generateGlobalCacheKey, getGlobalCachePath())
 }

src/main.ts

@@ -7,7 +7,7 @@ import { downloadTool } from '@actions/tool-cache'
 import type { PixiSource } from './options'
 import { options } from './options'
 import { execute, pixiCmd, renderPixiUrl } from './util'
-import { saveCache, tryRestoreCache } from './cache'
+import { tryRestoreGlobalCache, tryRestoreProjectCache, saveGlobalCache, saveProjectCache } from './cache'
 import { activateEnvironment } from './activate'
 
 const downloadPixi = async (source: PixiSource) => {
@@ -51,6 +51,18 @@ const pixiLogin = async () => {
   })
 }
 
+const pixiLogout = async () => {
+  const auth = options.auth
+  if (!auth || auth.persistCredentials) {
+    core.debug('Skipping pixi logout.')
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
+  })
+}
+
 const addPixiToPath = () => {
   core.addPath(path.dirname(options.pixiBinPath))
 }
@@ -61,11 +73,16 @@ const pixiGlobalInstall = async () => {
     core.debug('Skipping pixi global install.')
     return
   }
+
+  await tryRestoreGlobalCache()
+
   core.debug('Installing global environments')
   for (const env of globalEnvironments) {
     const command = `global install ${env}`
     await core.group(`pixi ${command}`, () => execute(pixiCmd(command, false)))
   }
+
+  await saveGlobalCache()
 }
 
 const pixiInstall = async () => {
@@ -74,7 +91,7 @@ const pixiInstall = async () => {
     return
   }
 
-  await tryRestoreCache()
+  await tryRestoreProjectCache()
 
   const environments = options.environments ?? [undefined]
   for (const environment of environments) {
@@ -95,7 +112,7 @@ const pixiInstall = async () => {
     await core.group(`pixi ${command}`, () => execute(pixiCmd(command)))
   }
 
-  await saveCache()
+  await saveProjectCache()
 }
 
 const generateList = async () => {
@@ -152,12 +169,13 @@ const run = async () => {
   addPixiToPath()
   await pixiLogin()
   await pixiGlobalInstall()
-  await pixiInstall()
   await generateInfo()
+  await pixiInstall()
   await generateList()
   if (options.activatedEnvironment) {
     await activateEnv(options.activatedEnvironment)
   }
+  await pixiLogout()
 }
 
 const main = async () => {

src/options.ts

@@ -15,13 +15,16 @@ type Inputs = Readonly<{
   pixiUrlHeaders?: NodeJS.Dict<string>
   logLevel?: LogLevel
   manifestPath?: string
+  workingDirectory?: string
   runInstall?: boolean
   environments?: string[]
   activateEnvironment?: string
   frozen?: boolean
   locked?: boolean
   cache?: boolean
+  globalCache?: boolean
   cacheKey?: string
+  globalCacheKey?: string
   cacheWrite?: boolean
   pixiBinPath?: string
   authHost?: string
@@ -32,6 +35,7 @@ type Inputs = Readonly<{
   authS3AccessKeyId?: string
   authS3SecretAccessKey?: string
   authS3SessionToken?: string
+  persistCredentials?: boolean
   pypiKeyringProvider?: 'disabled' | 'subprocess'
   postCleanup?: boolean
   globalEnvironments?: string[]
@@ -45,6 +49,7 @@ export interface PixiSource {
 
 type Auth = {
   host: string
+  persistCredentials: boolean
 } & (
   | {
       token: string
@@ -68,19 +73,27 @@ interface Cache {
   cacheWrite: boolean
 }
 
+interface GlobalCache {
+  cacheKeyPrefix: string
+  cacheWrite: boolean
+}
+
 export type Options = Readonly<{
   pixiSource: PixiSource
   downloadPixi: boolean
   logLevel: LogLevel
   manifestPath: string
+  workingDirectory: string
   pixiLockFile: string
   runInstall: boolean
   environments?: string[]
   frozen: boolean
   locked: boolean
   cache?: Cache
+  globalCache?: GlobalCache
   pixiBinPath: string
   auth?: Auth
+  persistCredentials: boolean
   pypiKeyringProvider?: 'disabled' | 'subprocess'
   postCleanup: boolean
   activatedEnvironment?: string
@@ -170,11 +183,17 @@ const validateInputs = (inputs: Inputs): void => {
     throw new Error('You need to specify pixi-url when using pixi-url-headers')
   }
   if (inputs.cacheKey !== undefined && inputs.cache === false) {
-    throw new Error('Cannot specify cache key without caching')
+    throw new Error('Cannot specify project cache key without project caching')
+  }
+  if (inputs.globalCacheKey !== undefined && inputs.globalCache === false) {
+    throw new Error('Cannot specify global cache key without global caching')
   }
   if (inputs.runInstall === false && inputs.cache === true) {
     throw new Error('Cannot cache without running install')
   }
+  if (inputs.globalCache === true && (!inputs.globalEnvironments || inputs.globalEnvironments.length === 0)) {
+    throw new Error('Cannot use global-cache without specifying global-environments')
+  }
   if (inputs.runInstall === false && inputs.frozen === true) {
     throw new Error('Cannot use `frozen: true` when not running install')
   }
@@ -224,6 +243,9 @@ const validateInputs = (inputs: Inputs): void => {
     if (inputs.authToken || inputs.authUsername || inputs.authCondaToken || inputs.authS3AccessKeyId) {
       throw new Error('You need to specify auth-host')
     }
+    if (inputs.persistCredentials === false) {
+      throw new Error('Cannot use persist-credentials without specifying auth-host')
+    }
   }
   if (inputs.runInstall === false && inputs.environments) {
     throw new Error('Cannot specify environments without running install')
@@ -267,29 +289,43 @@ const inferOptions = (inputs: Inputs): Options => {
     inputs.pixiBinPath
   )
   const logLevel = inputs.logLevel ?? (core.isDebug() ? 'vv' : 'default')
-  // infer manifest path from inputs or default to pixi.toml or pyproject.toml depending on what is present in the repo.
-  let manifestPath = pixiPath // default
+
+  // Determine the working directory - resolve to absolute path if provided
+  const workingDirectory = inputs.workingDirectory ? path.resolve(untildify(inputs.workingDirectory)) : process.cwd()
+  core.debug(`Working directory: ${workingDirectory}`)
+
+  // infer manifest path from inputs or default to pixi.toml or pyproject.toml depending on what is present in the working directory.
+  const pixiTomlPathInWorkingDir = path.join(workingDirectory, pixiPath)
+  const pyprojectTomlPathInWorkingDir = path.join(workingDirectory, pyprojectPath)
+
+  let manifestPath = pixiTomlPathInWorkingDir // default
   if (inputs.manifestPath) {
-    manifestPath = path.resolve(untildify(inputs.manifestPath))
+    // If manifest path is provided, resolve it relative to working directory if it's not absolute
+    manifestPath = path.isAbsolute(inputs.manifestPath)
+      ? path.resolve(untildify(inputs.manifestPath))
+      : path.resolve(workingDirectory, inputs.manifestPath)
   } else {
-    if (existsSync(pixiPath)) {
-      manifestPath = pixiPath
-    } else if (existsSync(pyprojectPath)) {
+    if (existsSync(pixiTomlPathInWorkingDir)) {
+      manifestPath = pixiTomlPathInWorkingDir
+      core.debug(`Found pixi.toml at: ${manifestPath}`)
+    } else if (existsSync(pyprojectTomlPathInWorkingDir)) {
       try {
-        const fileContent = readFileSync(pyprojectPath, 'utf-8')
+        const fileContent = readFileSync(pyprojectTomlPathInWorkingDir, 'utf-8')
         const parsedContent: Record<string, unknown> = parse(fileContent)
 
         // Test if the tool.pixi table is present in the pyproject.toml file, if so, use it as the manifest file.
         if (parsedContent.tool && typeof parsedContent.tool === 'object' && 'pixi' in parsedContent.tool) {
-          core.debug(`The tool.pixi table found, using ${pyprojectPath} as manifest file.`)
-          manifestPath = pyprojectPath
+          core.debug(`The tool.pixi table found, using ${pyprojectTomlPathInWorkingDir} as manifest file.`)
+          manifestPath = pyprojectTomlPathInWorkingDir
         }
       } catch (error) {
-        core.error(`Error while trying to read ${pyprojectPath} file.`)
+        core.error(`Error while trying to read ${pyprojectTomlPathInWorkingDir} file.`)
         core.error(error as Error)
       }
     } else if (runInstall) {
-      core.warning(`Could not find any manifest file. Defaulting to ${pixiPath}.`)
+      core.warning(
+        `Could not find any manifest file in ${workingDirectory}. Defaulting to ${pixiTomlPathInWorkingDir}.`
+      )
     }
   }
 
@@ -309,38 +345,52 @@ const inferOptions = (inputs: Inputs): Options => {
   } else if (inputs.activateEnvironment && inputs.activateEnvironment !== 'false') {
     activatedEnvironment = inputs.activateEnvironment
   }
-  const cache = inputs.cacheKey
-    ? { cacheKeyPrefix: inputs.cacheKey, cacheWrite: inputs.cacheWrite ?? true }
-    : inputs.cache === true || (lockFileAvailable && inputs.cache !== false)
-      ? { cacheKeyPrefix: 'pixi-', cacheWrite: inputs.cacheWrite ?? true }
+  const cache =
+    inputs.cache === true || (lockFileAvailable && inputs.cache !== false)
+      ? {
+          cacheKeyPrefix: inputs.cacheKey ?? 'pixi-',
+          cacheWrite: inputs.cacheWrite ?? true
+        }
+      : undefined
+  const globalCache =
+    inputs.globalCache === true && inputs.globalEnvironments && inputs.globalEnvironments.length > 0
+      ? {
+          cacheKeyPrefix: inputs.globalCacheKey ?? 'pixi-global-',
+          cacheWrite: inputs.cacheWrite ?? true
+        }
       : undefined
   const frozen = inputs.frozen ?? false
   const locked = inputs.locked ?? (lockFileAvailable && !frozen)
+  const persistCredentials = inputs.persistCredentials ?? true
   const auth = !inputs.authHost
     ? undefined
     : ((inputs.authToken
         ? {
             host: inputs.authHost,
-            token: inputs.authToken
+            token: inputs.authToken,
+            persistCredentials: persistCredentials
           }
         : inputs.authCondaToken
           ? {
               host: inputs.authHost,
-              condaToken: inputs.authCondaToken
+              condaToken: inputs.authCondaToken,
+              persistCredentials: persistCredentials
             }
           : inputs.authUsername
             ? {
                 host: inputs.authHost,
                 username: inputs.authUsername,
-                password: inputs.authPassword
+                password: inputs.authPassword,
+                persistCredentials: persistCredentials
               }
             : {
                 host: inputs.authHost,
                 s3AccessKeyId: inputs.authS3AccessKeyId,
                 s3SecretAccessKey: inputs.authS3SecretAccessKey,
-                s3SessionToken: inputs.authS3SessionToken
+                s3SessionToken: inputs.authS3SessionToken,
+                persistCredentials: persistCredentials
               }) as Auth)
-  const postCleanup = inputs.postCleanup ?? true
+  const postCleanup = inputs.postCleanup ?? false
   const pypiKeyringProvider = inputs.pypiKeyringProvider
   return {
     globalEnvironments: inputs.globalEnvironments,
@@ -349,6 +399,7 @@ const inferOptions = (inputs: Inputs): Options => {
     downloadPixi,
     logLevel,
     manifestPath,
+    workingDirectory,
     pixiLockFile,
     runInstall,
     environments: inputs.environments,
@@ -356,8 +407,10 @@ const inferOptions = (inputs: Inputs): Options => {
     frozen,
     locked,
     cache,
+    globalCache,
     pixiBinPath,
     auth,
+    persistCredentials,
     postCleanup
   }
 }
@@ -386,13 +439,16 @@ const getOptions = () => {
       'log-level must be one of `q`, `default`, `v`, `vv`, `vvv`.'
     ),
     manifestPath: parseOrUndefined('manifest-path', z.string()),
+    workingDirectory: parseOrUndefined('working-directory', z.string()),
     runInstall: parseOrUndefinedJSON('run-install', z.boolean()),
     environments: parseOrUndefinedList('environments', z.string()),
     activateEnvironment: parseOrUndefined('activate-environment', z.string()),
     locked: parseOrUndefinedJSON('locked', z.boolean()),
     frozen: parseOrUndefinedJSON('frozen', z.boolean()),
     cache: parseOrUndefinedJSON('cache', z.boolean()),
+    globalCache: parseOrUndefinedJSON('global-cache', z.boolean()),
     cacheKey: parseOrUndefined('cache-key', z.string()),
+    globalCacheKey: parseOrUndefined('global-cache-key', z.string()),
     cacheWrite: parseOrUndefinedJSON('cache-write', z.boolean()),
     pixiBinPath: parseOrUndefined('pixi-bin-path', z.string()),
     authHost: parseOrUndefined('auth-host', z.string()),
@@ -403,6 +459,7 @@ const getOptions = () => {
     authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
     authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
     authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
+    persistCredentials: parseOrUndefinedJSON('persist-credentials', z.boolean()),
     pypiKeyringProvider: parseOrUndefined('pypi-keyring-provider', pypiKeyringProviderSchema),
     globalEnvironments: parseOrUndefinedMultilineList('global-environments', z.string()),
     postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
@@ -433,3 +490,10 @@ try {
 }
 
 export const options = _options
+export const assertAuth = () => {
+  const auth = options.auth
+  if (!auth) {
+    throw new Error('Authentication configuration is missing.')
+  }
+  return auth
+}

src/util.ts

@@ -82,14 +82,15 @@ export const execute = (cmd: string[]) => {
   core.debug(`Executing: \`${cmd.toString()}\``)
   // needs escaping if cmd[0] contains spaces
   // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
-  return exec(`"${cmd[0]}"`, cmd.slice(1))
+  return exec(`"${cmd[0]}"`, cmd.slice(1), { cwd: options.workingDirectory })
 }
 
-export const executeGetOutput = (cmd: string[], options?: ExecOptions) => {
+export const executeGetOutput = (cmd: string[], execOptions: ExecOptions) => {
   core.debug(`Executing: \`${cmd.toString()}\``)
   // needs escaping if cmd[0] contains spaces
   // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
-  return getExecOutput(`"${cmd[0]}"`, cmd.slice(1), options)
+  const defaultOptions = { cwd: options.workingDirectory }
+  return getExecOutput(`"${cmd[0]}"`, cmd.slice(1), { ...defaultOptions, ...execOptions })
 }
 
 export const pixiCmd = (command: string, withManifestPath = true) => {

test/auth-s3/pixi.toml

@@ -1,9 +1,9 @@
-[project]
+[workspace]
 name = "test-auth-s3"
 channels = ["s3://rattler-s3-testing/channel", "conda-forge"]
 platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]
 
-[project.s3-options.rattler-s3-testing]
+[workspace.s3-options.rattler-s3-testing]
 endpoint-url = "https://e1a7cde76f1780ec06bac859036dbaf7.eu.r2.cloudflarestorage.com"
 force-path-style = true
 region = "auto"

test/auth/pixi.toml

@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-auth"
 channels = ["conda-forge", "https://repo.prefix.dev/setup-pixi-test"]
 platforms = ["osx-arm64", "osx-64", "linux-64", "linux-aarch64", "win-64"]

test/bzip2/pixi.toml

@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-win-arm64"
 channels = ["conda-forge"]
 platforms = [

test/default/pixi.toml

@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-default"
 channels = ["conda-forge"]
 platforms = ["linux-64", "linux-aarch64", "osx-64", "osx-arm64", "win-64"]

test/lockfile-not-up-to-date/pixi.toml

@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-default"
 version = "0.1.0"
 description = "Add a short description here"

test/multiple-environments/pixi.toml

@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-package"
 channels = ["conda-forge"]
 platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]

test/no-lockfile/pixi.toml

@@ -1,4 +1,4 @@
-[project]
+[workspace]
 name = "test-no-lockfile"
 channels = ["conda-forge"]
 platforms = ["linux-64", "linux-aarch64", "osx-64", "osx-arm64", "win-64"]

test/pyproject-manifest/pyproject.toml

@@ -19,7 +19,7 @@ lint = ["ruff>=0.1.14"]
 [tool.ruff]
 target-version = "py310"
 line-length = 100
-exclude = [ ".pixi", "__pycache__" ]
+exclude = [".pixi", "__pycache__"]
 # the TOML parser should also support comments in lists
 lint.select = [
   # flake8-bugbear
@@ -34,7 +34,7 @@ lint.select = [
   "F",
 ]
 
-[tool.pixi.project]
+[tool.pixi.workspace]
 name = "pyproject-manifest"
 channels = ["conda-forge"]
 platforms = ["linux-64", "osx-arm64", "osx-64", "win-64"]

tsconfig.json

@@ -1,12 +1,14 @@
 {
   "compilerOptions": {
-    "target": "ES2020" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
     "module": "CommonJS" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
     "outDir": "./lib" /* Redirect output structure to the directory. */,
     "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
     "strict": true /* Enable all strict type-checking options. */,
     "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
-    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
+    "types": ["node"],
+    "skipLibCheck": true
   },
   "exclude": ["node_modules", "**/*.test.ts"]
 }