feat: change post-cleanup default to false (#272)

Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>

.gitattributes

@@ -1 +1,2 @@
 dist/** merge=binary -diff linguist-generated=true
+pnpm-lock.yaml merge=binary linguist-generated=true

.github/chainguard/write.sts.yaml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json
+issuer: https://token.actions.githubusercontent.com
+subject: repo:prefix-dev/setup-pixi:ref:refs/heads/main
+
+permissions:
+  contents: write
+  pull_requests: write

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
       gh-actions:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7
   - package-ecosystem: npm
     directory: /
     schedule:
@@ -16,3 +18,5 @@ updates:
       nodejs:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -15,15 +15,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
           version: 9
 
       - name: Install Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 20
           cache: pnpm
@@ -41,13 +41,13 @@ jobs:
     name: Reference latest version in README
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Assert latest setup-pixi version is mentioned in README
         run: |
           set -euo pipefail
           latest_version="$(jq -r '.version' package.json)"
-          count_expected=21
+          count_expected=24
           count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
           if [ "$count_actual" -ne "$count_expected" ]; then
             echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
@@ -59,10 +59,10 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Assert latest pixi version is mentioned in README
         run: |
@@ -78,11 +78,17 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          identity: write
+
       - name: Create pull request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         if: failure() && github.ref_name == 'main'
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
           commit-message: Reference latest Pixi version in README
           title: Reference latest Pixi version in README
           labels: ignore for release
@@ -90,15 +96,15 @@ jobs:
   check-dist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
           version: 9
 
       - name: Install Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 20
           cache: pnpm
@@ -119,7 +125,7 @@ jobs:
         id: diff
 
       # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/release.yml

@@ -12,8 +12,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: Quantco/ui-actions/version-metadata@cd71d2a0e30b25569f6d723e57acca83347e58fc # v1.0.18
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: Quantco/ui-actions/version-metadata@5bfb8cebf0801e07c6a1c208a35b41637a3ff7fa # v1.0.20
         id: version-metadata
         with:
           file: ./package.json
@@ -24,7 +24,7 @@ jobs:
           TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
       - name: Create release
         if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           generate_release_notes: true
           tag_name: v${{ steps.version-metadata.outputs.newVersion }}

.github/workflows/test.yml

@@ -17,12 +17,12 @@ jobs:
     strategy:
       matrix:
         # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
         cache: [true, false]
     runs-on: ${{ matrix.os }}
     name: default ${{ matrix.cache == true && 'with' || 'without' }} cache (${{ matrix.os }})
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -53,7 +53,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -78,7 +78,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -102,7 +102,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -119,7 +119,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -131,10 +131,10 @@ jobs:
   custom-pixi-version:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -152,7 +152,7 @@ jobs:
         locked: [true, false]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -168,10 +168,10 @@ jobs:
   install-path:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -181,10 +181,10 @@ jobs:
   global-install:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -203,7 +203,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -218,7 +218,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -230,7 +230,7 @@ jobs:
   custom-pixi-url:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -242,7 +242,7 @@ jobs:
   pixi-url-headers-bearer:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - name: Setup caddy
@@ -283,7 +283,7 @@ jobs:
   pixi-url-custom-template-no-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           pixi-url: |
@@ -298,7 +298,7 @@ jobs:
   pixi-url-custom-template-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           pixi-url: |
@@ -314,7 +314,7 @@ jobs:
   pixi-url-custom-template-version-latest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           pixi-url: |
@@ -327,13 +327,101 @@ jobs:
           pixi-version: latest
       - run: pixi --version | grep -q "pixi 0.14.0"
 
+  working-directory:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./
+        with:
+          cache: false
+          working-directory: test/default
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/bin/python
+          .pixi/envs/default/bin/python --version | grep -q 3.11
+        shell: bash
+        working-directory: test/default
+        if: matrix.os != 'windows-latest'
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/python.exe
+          .pixi/envs/default/python.exe --version | grep -q 3.11
+        shell: bash
+        working-directory: test/default
+        if: matrix.os == 'windows-latest'
+      - run: pixi run python --version | grep -q 3.11
+        working-directory: test/default
+
+  working-directory-with-manifest-path:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./
+        with:
+          cache: false
+          working-directory: test
+          manifest-path: default/pixi.toml
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/bin/python
+        shell: bash
+        working-directory: test/default
+        if: matrix.os != 'windows-latest'
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/python.exe
+        shell: bash
+        working-directory: test/default
+        if: matrix.os == 'windows-latest'
+      - run: pixi run python --version | grep -q 3.11
+        working-directory: test/default
+
+  working-directory-with-absolute-manifest-path:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./
+        with:
+          cache: false
+          working-directory: test/default
+          manifest-path: ${{ github.workspace }}/test/default/pixi.toml
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/bin/python
+        shell: bash
+        working-directory: test/default
+        if: matrix.os != 'windows-latest'
+      - run: |
+          set -o pipefail
+          pixi info
+          test -f .pixi/envs/default/python.exe
+        shell: bash
+        working-directory: test/default
+        if: matrix.os == 'windows-latest'
+      - run: pixi run python --version | grep -q 3.11
+        working-directory: test/default
+
   custom-manifest-path:
     strategy:
       matrix:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           cache: false
@@ -345,7 +433,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -359,7 +447,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -380,7 +468,7 @@ jobs:
         ignore-reason: [none, version, version-latest, url, bin-path]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - name: Create pixi directory and add to PATH
@@ -499,7 +587,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -520,7 +608,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -543,7 +631,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -558,6 +646,52 @@ jobs:
         # https://github.com/prefix-dev/pixi/issues/330
         if: matrix.os == 'ubuntu-latest'
 
+  persist-credentials-false:
+    env:
+      # We must set this environment variable explicitly to force all
+      # operating systems to use the same storage mechanism.
+      # Otherwise, windows and mac will use the keychain, which is more cumbersome to test.
+      RATTLER_AUTH_FILE: .rattler-credentials.json
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      # Sanity check: Login with default persist-credentials behavior
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+      - name: Assert that the credentials are stored
+        run: |
+          # For human log readers
+          cat "${RATTLER_AUTH_FILE}"
+          # Actual test
+          [ $(jq '."*.custom-conda-registry.com".BearerToken' -r "${RATTLER_AUTH_FILE}") = "custom-token" ]
+      - name: Clean up credentials file
+        run: rm "${RATTLER_AUTH_FILE}"
+      # Actual test: Login with persist-credentials: false
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+          persist-credentials: false
+      - name: Assert that the credentials are not stored anymore
+        run: |
+          # For human log readers
+          cat "${RATTLER_AUTH_FILE}"
+
+          # Actual test
+          ! grep -q '"*.custom-conda-registry.com"' "${RATTLER_AUTH_FILE}"
+
   auth-token-install:
     strategy:
       matrix:
@@ -565,7 +699,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/auth/* .
       - uses: ./
@@ -584,7 +718,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/auth-s3/* .
       - uses: ./
@@ -604,7 +738,7 @@ jobs:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -631,7 +765,7 @@ jobs:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           run-install: false
@@ -653,7 +787,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -678,7 +812,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -700,7 +834,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -721,7 +855,7 @@ jobs:
       matrix:
         post-cleanup: ['true', 'false']
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -742,7 +876,7 @@ jobs:
         os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -770,11 +904,11 @@ jobs:
     name: multiple-environments (${{ matrix.os }}, cache=${{ matrix.cache }})
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, macos-13]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         cache: ['true', 'false']
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -808,9 +942,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -824,9 +958,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -849,9 +983,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -873,9 +1007,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest, macos-13]
+        os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -892,7 +1026,7 @@ jobs:
         os: [windows-latest, ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/pyproject-manifest/* .
       - uses: ./
@@ -910,7 +1044,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           cache: true
@@ -922,7 +1056,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -938,7 +1072,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -954,7 +1088,7 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -970,7 +1104,7 @@ jobs:
       run:
         shell: cmd
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -988,7 +1122,7 @@ jobs:
   environment-activation-false:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -999,7 +1133,7 @@ jobs:
   environment-activation-explicit-env:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -1012,7 +1146,7 @@ jobs:
   environment-activation-multiple-env:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -1029,7 +1163,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/multiple-environments/* .
       - uses: ./
@@ -1047,7 +1181,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/default/* .
       - uses: ./
@@ -1065,7 +1199,7 @@ jobs:
   env-variable-input-custom-pixi-url:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -1078,7 +1212,7 @@ jobs:
   env-variable-input-precendence:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi.toml
         run: mv test/old-pixi-lockfiles/* .
       - uses: ./
@@ -1096,7 +1230,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -1118,7 +1252,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -1139,7 +1273,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/default/* .
       - uses: ./
@@ -1162,7 +1296,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -1183,7 +1317,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./
@@ -1204,7 +1338,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/lockfile-not-up-to-date/* .
       - uses: ./
@@ -1225,7 +1359,7 @@ jobs:
       matrix:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Move pixi files
         run: mv test/no-lockfile/* .
       - uses: ./

README.md

@@ -23,9 +23,9 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
-    pixi-version: v0.59.0
+    pixi-version: v0.66.0
 
     cache: true
     auth-host: prefix.dev
@@ -35,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 
 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.9.3`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.10.0`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -51,6 +51,8 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 >       dependencies:
 >         patterns:
 >           - '*'
+>     cooldown:
+>       default-days: 7
 > ```
 
 ## Features
@@ -77,7 +79,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     cache: true
     cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -122,7 +124,7 @@ test:
       environment: [py311, py312]
   steps:
     - uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.9.3
+    - uses: prefix-dev/setup-pixi@v0.10.0
       with:
         environments: ${{ matrix.environment }}
 ```
@@ -132,7 +134,7 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     # separated by spaces
     environments: >-
@@ -155,7 +157,7 @@ For instance, the `keyring`, or `gcloud` executables. The following example show
 By default, global environments are not cached. You can enable caching by setting the `global-cache` input to `true`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     global-environments: |
       google-cloud-sdk
@@ -188,7 +190,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: prefix.dev
     auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -200,7 +202,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: custom-artifactory.com
     auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -213,7 +215,7 @@ Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: anaconda.org # or my-quetz-instance.com
     auth-conda-token: ${{ secrets.CONDA_TOKEN }}
@@ -225,7 +227,7 @@ Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-k
 You can also specify the session token using the `auth-session-token` input argument.
 
 ```yaml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     auth-host: s3://my-s3-bucket
     auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
@@ -236,12 +238,27 @@ You can also specify the session token using the `auth-session-token` input argu
 
 See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.
 
+#### Restricting credentials to the install step
+
+If you only want pixi to use the authenticated remote channel during the action's own install step
+(and not in any subsequent step of the workflow), set `persist-credentials: false`. The action will
+then run `pixi auth logout <auth-host>` after `pixi install` has completed but before the action
+returns, so that later steps cannot reach the private channel anymore.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.10.0
+  with:
+    auth-host: prefix.dev
+    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
+    persist-credentials: false
+```
+
 #### PyPI keyring provider
 
 You can specify whether to use keyring to look up credentials for PyPI.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     pypi-keyring-provider: subprocess # one of 'subprocess', 'disabled'
 ```
@@ -309,7 +326,7 @@ To this end, `setup-pixi` adds all environment variables set when executing `pix
 As a result, all installed binaries can be accessed without having to call `pixi run`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     activate-environment: true
 ```
@@ -317,7 +334,7 @@ As a result, all installed binaries can be accessed without having to call `pixi
 If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     environments: >-
       py311
@@ -334,7 +351,7 @@ You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi
 See the [official documentation](https://pixi.sh/latest/reference/cli/pixi/install/#update-options) for more information about the `--frozen` and `--locked` flags.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     locked: true
     # or
@@ -353,7 +370,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   env:
     RUNNER_DEBUG: true
 ```
@@ -371,7 +388,7 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     # one of `q`, `default`, `v`, `vv`, or `vvv`.
     log-level: vvv
@@ -392,12 +409,12 @@ If you set `post-cleanup` to `true`, the action will delete the following files:
 - the rattler cache
 - other rattler files in `~/.rattler`
 
-If nothing is specified, `post-cleanup` will default to `true`.
+If nothing is specified, `post-cleanup` will default to `false`.
 
 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     post-cleanup: true
     # ${{ runner.temp }}\Scripts\pixi.exe on Windows
@@ -413,17 +430,47 @@ You can also use a preinstalled local version of pixi on the runner by not setti
 This can be overwritten by setting the `manifest-path` input argument.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     manifest-path: pyproject.toml
 ```
 
+### Working directory for monorepos
+
+If you're working with a monorepo where your pixi project is in a subdirectory, you can use the `working-directory` input to specify where pixi should look for manifest files (`pixi.toml` or `pyproject.toml`).
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.10.0
+  with:
+    working-directory: ./packages/my-project
+```
+
+This will make pixi look for `pixi.toml` or `pyproject.toml` in the `./packages/my-project` directory instead of the repository root. All pixi commands will be executed from this working directory.
+
+> [!NOTE]
+> The `working-directory` input only affects commands run by `setup-pixi` itself.
+> For subsequent `run:` steps, you need to set the working directory separately:
+>
+> ```yml
+> - run: pixi run test
+>   working-directory: ./packages/my-project
+> ```
+
+You can combine `working-directory` with `manifest-path` if needed:
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.10.0
+  with:
+    working-directory: ./packages/my-project
+    manifest-path: custom-pixi.toml
+```
+
 ### Only install pixi
 
 If you only want to install pixi and not install the current project, you can use the `run-install` option.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     run-install: false
 ```
@@ -434,7 +481,7 @@ You can also download pixi from a custom URL by setting the `pixi-url` input arg
 Optionally, you can combine this with the `pixi-url-headers` input argument to supply additional headers for the download request, such as a bearer token.
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     pixi-url: https://pixi-mirror.example.com/releases/download/v0.48.0/pixi-x86_64-unknown-linux-musl
     pixi-url-headers: '{"Authorization": "Bearer ${{ secrets.PIXI_MIRROR_BEARER_TOKEN }}"}'
@@ -450,7 +497,7 @@ It will be rendered with the following variables:
 By default, `pixi-url` is equivalent to the following template:
 
 ```yml
-- uses: prefix-dev/setup-pixi@v0.9.3
+- uses: prefix-dev/setup-pixi@v0.10.0
   with:
     pixi-url: |
       {{#if latest~}}

action.yml

@@ -18,6 +18,10 @@ inputs:
       One of `q`, `default`, `v`, `vv`, or `vvv`.
   manifest-path:
     description: Path to the manifest file (i.e., `pixi.toml`) to use for the pixi CLI. Defaults to `pixi.toml`.
+  working-directory:
+    description: |
+      Working directory to use for pixi commands. If specified, pixi will look for manifest files (pixi.toml or pyproject.toml) 
+      in this directory instead of the repository root. Useful for monorepos where pixi projects are in subdirectories.
   run-install:
     description: Whether to run `pixi install` after installing pixi. Defaults to `true`.
   environments:
@@ -59,7 +63,7 @@ inputs:
     description: |
       Host to use for authentication. If not set, pixi is not authenticating.
       Requires `auth-token` or `auth-conda-token` or `auth-username` and `auth-password` to be set.
-      See https://prefix.dev/docs/pixi/authentication
+      See https://pixi.prefix.dev/latest/deployment/authentication/
   auth-token:
     description: Token to use for authentication.
   auth-username:
@@ -74,13 +78,19 @@ inputs:
     description: Secret access key to use for S3 authentication.
   auth-s3-session-token:
     description: Session token to use for S3 authentication.
+  persist-credentials:
+    description: |
+      Whether to keep the credentials configured by `auth-host` available to subsequent workflow
+      steps. Defaults to `true`. If set to `false`, the action runs `pixi auth logout <auth-host>`
+      after install, so that later steps cannot reach the private channel anymore. Requires
+      `auth-host`.
   pypi-keyring-provider:
     description: |
       Specifies whether to use keyring to look up credentials for PyPI.
       options: disabled, subprocess
   post-cleanup:
     description: |
-      If the action should clean up after itself. Defaults to `true`.
+      If the action should clean up after itself. Defaults to `false`.
       If `true`, the pixi environment, the pixi binary and the rattler files in ~/.rattler and ~/.cache/rattler are removed.
 
 runs:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "setup-pixi",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "private": true,
   "description": "Action to set up the pixi package manager.",
   "scripts": {
@@ -22,25 +22,25 @@
   "author": "Pavel Zwerschke <pavelzw@gmail.com>",
   "license": "BSD-3-Clause",
   "dependencies": {
-    "@actions/cache": "^4.1.0",
-    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/io": "^2.0.0",
-    "@actions/tool-cache": "^2.0.2",
-    "handlebars": "^4.7.8",
-    "smol-toml": "^1.4.2",
+    "@actions/cache": "^6.0.1",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/io": "^3.0.2",
+    "@actions/tool-cache": "^4.0.0",
+    "handlebars": "^4.7.9",
+    "smol-toml": "^1.6.1",
     "untildify": "^6.0.0",
-    "which": "^5.0.0",
-    "zod": "^4.1.12"
+    "which": "^7.0.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.0",
-    "@types/node": "^24.9.2",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.9.1",
     "@types/which": "^3.0.4",
-    "eslint": "^9.34.0",
-    "prettier": "^3.6.2",
-    "tsup": "^8.4.0",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.46.2"
+    "eslint": "^10.4.0",
+    "prettier": "^3.8.3",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.59.4"
   }
 }

src/cache.ts

@@ -32,15 +32,14 @@ export const generateProjectCacheKey = async (cacheKeyPrefix: string) => {
     core.debug(`lockfilePathSha: ${lockfilePathSha}`)
     const environments = sha256(options.environments?.join(' ') ?? '')
     core.debug(`environments: ${environments}`)
-    // since the lockfile path is not necessarily absolute, we need to include the cwd in the cache key
-    const cwdSha = sha256(process.cwd())
+    // since the lockfile path is not necessarily absolute, we need to include the working directory in the cache key
+    const cwdSha = sha256(options.workingDirectory)
     core.debug(`cwdSha: ${cwdSha}`)
     const sha = sha256(lockfileSha + environments + pixiSha + lockfilePathSha + cwdSha)
     core.debug(`sha: ${sha}`)
     return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
   } catch (err: unknown) {
-    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-    throw new Error(`Failed to generate cache key: ${err}`)
+    throw new Error(`Failed to generate cache key`, { cause: err })
   }
 }
 
@@ -54,8 +53,7 @@ export const generateGlobalCacheKey = async (cacheKeyPrefix: string) => {
     core.debug(`sha: ${sha}`)
     return `${cacheKeyPrefix}${getCondaArch()}-${getYearMonth()}-${sha}`
   } catch (err: unknown) {
-    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-    throw new Error(`Failed to generate cache key: ${err}`)
+    throw new Error(`Failed to generate cache key`, { cause: err })
   }
 }
 

src/main.ts

@@ -51,6 +51,18 @@ const pixiLogin = async () => {
   })
 }
 
+const pixiLogout = async () => {
+  const auth = options.auth
+  if (!auth || auth.persistCredentials) {
+    core.debug('Skipping pixi logout.')
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
+  })
+}
+
 const addPixiToPath = () => {
   core.addPath(path.dirname(options.pixiBinPath))
 }
@@ -163,6 +175,7 @@ const run = async () => {
   if (options.activatedEnvironment) {
     await activateEnv(options.activatedEnvironment)
   }
+  await pixiLogout()
 }
 
 const main = async () => {

src/options.ts

@@ -15,6 +15,7 @@ type Inputs = Readonly<{
   pixiUrlHeaders?: NodeJS.Dict<string>
   logLevel?: LogLevel
   manifestPath?: string
+  workingDirectory?: string
   runInstall?: boolean
   environments?: string[]
   activateEnvironment?: string
@@ -34,6 +35,7 @@ type Inputs = Readonly<{
   authS3AccessKeyId?: string
   authS3SecretAccessKey?: string
   authS3SessionToken?: string
+  persistCredentials?: boolean
   pypiKeyringProvider?: 'disabled' | 'subprocess'
   postCleanup?: boolean
   globalEnvironments?: string[]
@@ -47,6 +49,7 @@ export interface PixiSource {
 
 type Auth = {
   host: string
+  persistCredentials: boolean
 } & (
   | {
       token: string
@@ -80,6 +83,7 @@ export type Options = Readonly<{
   downloadPixi: boolean
   logLevel: LogLevel
   manifestPath: string
+  workingDirectory: string
   pixiLockFile: string
   runInstall: boolean
   environments?: string[]
@@ -89,6 +93,7 @@ export type Options = Readonly<{
   globalCache?: GlobalCache
   pixiBinPath: string
   auth?: Auth
+  persistCredentials: boolean
   pypiKeyringProvider?: 'disabled' | 'subprocess'
   postCleanup: boolean
   activatedEnvironment?: string
@@ -238,6 +243,9 @@ const validateInputs = (inputs: Inputs): void => {
     if (inputs.authToken || inputs.authUsername || inputs.authCondaToken || inputs.authS3AccessKeyId) {
       throw new Error('You need to specify auth-host')
     }
+    if (inputs.persistCredentials === false) {
+      throw new Error('Cannot use persist-credentials without specifying auth-host')
+    }
   }
   if (inputs.runInstall === false && inputs.environments) {
     throw new Error('Cannot specify environments without running install')
@@ -281,29 +289,43 @@ const inferOptions = (inputs: Inputs): Options => {
     inputs.pixiBinPath
   )
   const logLevel = inputs.logLevel ?? (core.isDebug() ? 'vv' : 'default')
-  // infer manifest path from inputs or default to pixi.toml or pyproject.toml depending on what is present in the repo.
-  let manifestPath = pixiPath // default
+
+  // Determine the working directory - resolve to absolute path if provided
+  const workingDirectory = inputs.workingDirectory ? path.resolve(untildify(inputs.workingDirectory)) : process.cwd()
+  core.debug(`Working directory: ${workingDirectory}`)
+
+  // infer manifest path from inputs or default to pixi.toml or pyproject.toml depending on what is present in the working directory.
+  const pixiTomlPathInWorkingDir = path.join(workingDirectory, pixiPath)
+  const pyprojectTomlPathInWorkingDir = path.join(workingDirectory, pyprojectPath)
+
+  let manifestPath = pixiTomlPathInWorkingDir // default
   if (inputs.manifestPath) {
-    manifestPath = path.resolve(untildify(inputs.manifestPath))
+    // If manifest path is provided, resolve it relative to working directory if it's not absolute
+    manifestPath = path.isAbsolute(inputs.manifestPath)
+      ? path.resolve(untildify(inputs.manifestPath))
+      : path.resolve(workingDirectory, inputs.manifestPath)
   } else {
-    if (existsSync(pixiPath)) {
-      manifestPath = pixiPath
-    } else if (existsSync(pyprojectPath)) {
+    if (existsSync(pixiTomlPathInWorkingDir)) {
+      manifestPath = pixiTomlPathInWorkingDir
+      core.debug(`Found pixi.toml at: ${manifestPath}`)
+    } else if (existsSync(pyprojectTomlPathInWorkingDir)) {
       try {
-        const fileContent = readFileSync(pyprojectPath, 'utf-8')
+        const fileContent = readFileSync(pyprojectTomlPathInWorkingDir, 'utf-8')
         const parsedContent: Record<string, unknown> = parse(fileContent)
 
         // Test if the tool.pixi table is present in the pyproject.toml file, if so, use it as the manifest file.
         if (parsedContent.tool && typeof parsedContent.tool === 'object' && 'pixi' in parsedContent.tool) {
-          core.debug(`The tool.pixi table found, using ${pyprojectPath} as manifest file.`)
-          manifestPath = pyprojectPath
+          core.debug(`The tool.pixi table found, using ${pyprojectTomlPathInWorkingDir} as manifest file.`)
+          manifestPath = pyprojectTomlPathInWorkingDir
         }
       } catch (error) {
-        core.error(`Error while trying to read ${pyprojectPath} file.`)
+        core.error(`Error while trying to read ${pyprojectTomlPathInWorkingDir} file.`)
         core.error(error as Error)
       }
     } else if (runInstall) {
-      core.warning(`Could not find any manifest file. Defaulting to ${pixiPath}.`)
+      core.warning(
+        `Could not find any manifest file in ${workingDirectory}. Defaulting to ${pixiTomlPathInWorkingDir}.`
+      )
     }
   }
 
@@ -339,31 +361,36 @@ const inferOptions = (inputs: Inputs): Options => {
       : undefined
   const frozen = inputs.frozen ?? false
   const locked = inputs.locked ?? (lockFileAvailable && !frozen)
+  const persistCredentials = inputs.persistCredentials ?? true
   const auth = !inputs.authHost
     ? undefined
     : ((inputs.authToken
         ? {
             host: inputs.authHost,
-            token: inputs.authToken
+            token: inputs.authToken,
+            persistCredentials: persistCredentials
           }
         : inputs.authCondaToken
           ? {
               host: inputs.authHost,
-              condaToken: inputs.authCondaToken
+              condaToken: inputs.authCondaToken,
+              persistCredentials: persistCredentials
             }
           : inputs.authUsername
             ? {
                 host: inputs.authHost,
                 username: inputs.authUsername,
-                password: inputs.authPassword
+                password: inputs.authPassword,
+                persistCredentials: persistCredentials
               }
             : {
                 host: inputs.authHost,
                 s3AccessKeyId: inputs.authS3AccessKeyId,
                 s3SecretAccessKey: inputs.authS3SecretAccessKey,
-                s3SessionToken: inputs.authS3SessionToken
+                s3SessionToken: inputs.authS3SessionToken,
+                persistCredentials: persistCredentials
               }) as Auth)
-  const postCleanup = inputs.postCleanup ?? true
+  const postCleanup = inputs.postCleanup ?? false
   const pypiKeyringProvider = inputs.pypiKeyringProvider
   return {
     globalEnvironments: inputs.globalEnvironments,
@@ -372,6 +399,7 @@ const inferOptions = (inputs: Inputs): Options => {
     downloadPixi,
     logLevel,
     manifestPath,
+    workingDirectory,
     pixiLockFile,
     runInstall,
     environments: inputs.environments,
@@ -382,6 +410,7 @@ const inferOptions = (inputs: Inputs): Options => {
     globalCache,
     pixiBinPath,
     auth,
+    persistCredentials,
     postCleanup
   }
 }
@@ -410,6 +439,7 @@ const getOptions = () => {
       'log-level must be one of `q`, `default`, `v`, `vv`, `vvv`.'
     ),
     manifestPath: parseOrUndefined('manifest-path', z.string()),
+    workingDirectory: parseOrUndefined('working-directory', z.string()),
     runInstall: parseOrUndefinedJSON('run-install', z.boolean()),
     environments: parseOrUndefinedList('environments', z.string()),
     activateEnvironment: parseOrUndefined('activate-environment', z.string()),
@@ -429,6 +459,7 @@ const getOptions = () => {
     authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
     authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
     authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
+    persistCredentials: parseOrUndefinedJSON('persist-credentials', z.boolean()),
     pypiKeyringProvider: parseOrUndefined('pypi-keyring-provider', pypiKeyringProviderSchema),
     globalEnvironments: parseOrUndefinedMultilineList('global-environments', z.string()),
     postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
@@ -459,3 +490,10 @@ try {
 }
 
 export const options = _options
+export const assertAuth = () => {
+  const auth = options.auth
+  if (!auth) {
+    throw new Error('Authentication configuration is missing.')
+  }
+  return auth
+}

src/util.ts

@@ -82,14 +82,15 @@ export const execute = (cmd: string[]) => {
   core.debug(`Executing: \`${cmd.toString()}\``)
   // needs escaping if cmd[0] contains spaces
   // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
-  return exec(`"${cmd[0]}"`, cmd.slice(1))
+  return exec(`"${cmd[0]}"`, cmd.slice(1), { cwd: options.workingDirectory })
 }
 
-export const executeGetOutput = (cmd: string[], options?: ExecOptions) => {
+export const executeGetOutput = (cmd: string[], execOptions: ExecOptions) => {
   core.debug(`Executing: \`${cmd.toString()}\``)
   // needs escaping if cmd[0] contains spaces
   // https://github.com/prefix-dev/setup-pixi/issues/184#issuecomment-2765724843
-  return getExecOutput(`"${cmd[0]}"`, cmd.slice(1), options)
+  const defaultOptions = { cwd: options.workingDirectory }
+  return getExecOutput(`"${cmd[0]}"`, cmd.slice(1), { ...defaultOptions, ...execOptions })
 }
 
 export const pixiCmd = (command: string, withManifestPath = true) => {

tsconfig.json

@@ -1,12 +1,14 @@
 {
   "compilerOptions": {
-    "target": "ES2020" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
     "module": "CommonJS" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
     "outDir": "./lib" /* Redirect output structure to the directory. */,
     "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
     "strict": true /* Enable all strict type-checking options. */,
     "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
-    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
+    "types": ["node"],
+    "skipLibCheck": true
   },
   "exclude": ["node_modules", "**/*.test.ts"]
 }