feat!: Add auth-logout input and run pixi auth status after login (#291 )

chore: bump typescript to v7 and migrate to oxlint and oxfmt (#289 )
chore(deps): bump the nodejs group across 1 directory with 7 updates (#288 )
2026-10-08 15:04:08 +03:00 · 2026-10-06 18:15:30 +02:00 · 2026-10-01 12:31:45 +02:00 · 2026-10-01 11:46:57 +02:00 · 2026-10-01 11:22:52 +02:00 · 2026-09-15 17:24:57 +02:00
29 changed files with 79783 additions and 79704 deletions
@@ -1 +1,2 @@
 dist/** merge=binary -diff linguist-generated=true
+pnpm-lock.yaml merge=binary linguist-generated=true
@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json
+issuer: https://token.actions.githubusercontent.com
+subject: repo:prefix-dev/setup-pixi:ref:refs/heads/main
+
+permissions:
+  contents: write
+  pull_requests: write
@@ -8,6 +8,8 @@ updates:
      gh-actions:
        patterns:
          - '*'
+    cooldown:
+      default-days: 7
  - package-ecosystem: npm
    directory: /
    schedule:
@@ -16,3 +18,5 @@ updates:
      nodejs:
        patterns:
          - '*'
+    cooldown:
+      default-days: 7
@@ -15,15 +15,15 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
-          version: 9
+          version: 10

      - name: Install Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -35,19 +35,22 @@ jobs:
        run: pnpm build

      - name: Lint
-        run: pnpm lint
+        run: pnpm lint:check
+
+      - name: Format
+        run: pnpm fmt:check

  reference-latest-version-in-readme:
    name: Reference latest version in README
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Assert latest setup-pixi version is mentioned in README
        run: |
          set -euo pipefail
          latest_version="$(jq -r '.version' package.json)"
-          count_expected=23
+          count_expected=24
          count_actual="$(grep -c "setup-pixi@v$latest_version" README.md || true)"
          if [ "$count_actual" -ne "$count_expected" ]; then
            echo "::error file=README.md::Expected $count_expected mentions of \`setup-pixi@v$latest_version\` in README.md, but found $count_actual."
@@ -59,10 +62,10 @@ jobs:
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
-      contents: write
-      pull-requests: write
+      contents: read
+      id-token: write
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Assert latest pixi version is mentioned in README
        run: |
@@ -78,11 +81,17 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          identity: write
+
      - name: Create pull request
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        if: failure() && github.ref_name == 'main'
        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
          commit-message: Reference latest Pixi version in README
          title: Reference latest Pixi version in README
          labels: ignore for release
@@ -90,15 +99,15 @@ jobs:
  check-dist:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.4.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
-          version: 9
+          version: 10

      - name: Install Node.js
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20
          cache: pnpm
@@ -119,7 +128,7 @@ jobs:
        id: diff

      # If index.js or post.js are different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
        with:
          name: dist
@@ -12,8 +12,8 @@ jobs:
  release:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: Quantco/ui-actions/version-metadata@cd71d2a0e30b25569f6d723e57acca83347e58fc # v1.0.18
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: Quantco/ui-actions/version-metadata@5bfb8cebf0801e07c6a1c208a35b41637a3ff7fa # v1.0.20
        id: version-metadata
        with:
          file: ./package.json
@@ -24,7 +24,7 @@ jobs:
          TAG_NAME: v${{ steps.version-metadata.outputs.newVersion }}
      - name: Create release
        if: steps.version-metadata.outputs.changed == 'true'
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          generate_release_notes: true
          tag_name: v${{ steps.version-metadata.outputs.newVersion }}
@@ -16,13 +16,18 @@ jobs:
  default:
    strategy:
      matrix:
-        # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+          - ubuntu-24.04-riscv
+          - macos-latest
+          - windows-latest
+          - windows-11-arm
        cache: [true, false]
    runs-on: ${{ matrix.os }}
    name: default ${{ matrix.cache == true && 'with' || 'without' }} cache (${{ matrix.os }})
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -33,18 +38,18 @@ jobs:
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/bin/python
-          ./.pixi/envs/default/bin/python --version | grep -q 3.11
+          ./.pixi/envs/default/bin/python --version | grep -q 3.14
        shell: bash
-        if: matrix.os != 'windows-latest'
+        if: "!startsWith(matrix.os, 'windows')"
      - run: |
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/python.exe
-          ./.pixi/envs/default/python.exe --version | grep -q 3.11
+          ./.pixi/envs/default/python.exe --version | grep -q 3.14
        shell: bash
-        if: matrix.os == 'windows-latest'
+        if: startsWith(matrix.os, 'windows')
      - run: |
-          pixi run python --version | grep -q 3.11
+          pixi run python --version | grep -q 3.14
          pixi run test | grep -q "Hello world"

  global-environments:
@@ -53,7 +58,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -66,10 +71,10 @@ jobs:
          set -o pipefail
          pixi info
          test -f ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }}
-          ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }} --version | grep -q 3.11
+          ${{ matrix.os == 'windows-latest' && './.pixi/envs/default/python.exe' || './.pixi/envs/default/bin/python' }} --version | grep -q 3.14
        shell: bash
      - run: |
-          pixi run python --version | grep -q 3.11
+          pixi run python --version | grep -q 3.14
          pixi run test | grep -q "Hello world"

  global-environments-with-project-install:
@@ -78,7 +83,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -102,7 +107,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -119,7 +124,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -134,7 +139,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -152,7 +157,7 @@ jobs:
        locked: [true, false]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -171,7 +176,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -184,7 +189,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
@@ -203,14 +208,14 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
        with:
          cache: false
          frozen: true
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14

  locked:
    strategy:
@@ -218,19 +223,19 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
        with:
          cache: false
          locked: true
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14

  custom-pixi-url:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -242,7 +247,7 @@ jobs:
  pixi-url-headers-bearer:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - name: Setup caddy
@@ -283,7 +288,7 @@ jobs:
  pixi-url-custom-template-no-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          pixi-url: |
@@ -298,7 +303,7 @@ jobs:
  pixi-url-custom-template-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          pixi-url: |
@@ -314,7 +319,7 @@ jobs:
  pixi-url-custom-template-version-latest:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          pixi-url: |
@@ -333,7 +338,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -342,7 +347,7 @@ jobs:
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/bin/python
-          .pixi/envs/default/bin/python --version | grep -q 3.11
+          .pixi/envs/default/bin/python --version | grep -q 3.14
        shell: bash
        working-directory: test/default
        if: matrix.os != 'windows-latest'
@@ -350,11 +355,11 @@ jobs:
          set -o pipefail
          pixi info
          test -f .pixi/envs/default/python.exe
-          .pixi/envs/default/python.exe --version | grep -q 3.11
+          .pixi/envs/default/python.exe --version | grep -q 3.14
        shell: bash
        working-directory: test/default
        if: matrix.os == 'windows-latest'
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14
        working-directory: test/default

  working-directory-with-manifest-path:
@@ -363,7 +368,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -383,7 +388,7 @@ jobs:
        shell: bash
        working-directory: test/default
        if: matrix.os == 'windows-latest'
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14
        working-directory: test/default

  working-directory-with-absolute-manifest-path:
@@ -392,7 +397,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -412,7 +417,7 @@ jobs:
        shell: bash
        working-directory: test/default
        if: matrix.os == 'windows-latest'
-      - run: pixi run python --version | grep -q 3.11
+      - run: pixi run python --version | grep -q 3.14
        working-directory: test/default

  custom-manifest-path:
@@ -421,7 +426,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: false
@@ -433,7 +438,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -447,7 +452,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -468,7 +473,7 @@ jobs:
        ignore-reason: [none, version, version-latest, url, bin-path]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - name: Create pixi directory and add to PATH
@@ -485,18 +490,18 @@ jobs:
      - name: Download pixi binary (Ubuntu)
        run: |
          set -o pipefail
-          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.43.0/pixi-x86_64-unknown-linux-musl
+          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.79.0/pixi-x86_64-unknown-linux-musl
          chmod +x "$HOME/custom existing pixi/pixi"
        if: matrix.os == 'ubuntu-latest'
      - name: Download pixi binary (macOS)
        run: |
          set -o pipefail
-          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.43.0/pixi-x86_64-apple-darwin
+          curl -L --output "$HOME/custom existing pixi/pixi" https://github.com/prefix-dev/pixi/releases/download/v0.79.0/pixi-x86_64-apple-darwin
          chmod +x "$HOME/custom existing pixi/pixi"
        if: matrix.os == 'macos-latest'
      - name: Download pixi binary (Windows)
        run: |
-          curl -L --output "$HOME/custom existing pixi/pixi.exe" https://github.com/prefix-dev/pixi/releases/download/v0.43.0/pixi-x86_64-pc-windows-msvc.exe
+          curl -L --output "$HOME/custom existing pixi/pixi.exe" https://github.com/prefix-dev/pixi/releases/download/v0.79.0/pixi-x86_64-pc-windows-msvc.exe
        if: matrix.os == 'windows-latest'
      - run: |
          echo "Path: $PATH"
@@ -504,7 +509,7 @@ jobs:
      - name: Verify pixi version (before setup-pixi)
        run: |
          pixi --version
-          pixi --version | grep -q "pixi 0.43.0"
+          pixi --version | grep -q "pixi 0.79.0"
        shell: bash
      - name: Verify pixi path (before setup-pixi)
        run: |
@@ -525,7 +530,7 @@ jobs:
        uses: ./
        with:
          cache: false
-          pixi-version: v0.44.0
+          pixi-version: v0.80.0
        if: matrix.ignore-reason == 'version'
      - name: Run Action (url should overwrite preinstalled pixi)
        uses: ./
@@ -534,10 +539,10 @@ jobs:
          pixi-url: |
            ${{
                matrix.os == 'ubuntu-latest' &&
-                    'https://github.com/prefix-dev/pixi/releases/download/v0.44.0/pixi-x86_64-unknown-linux-musl'
+                    'https://github.com/prefix-dev/pixi/releases/download/v0.80.0/pixi-x86_64-unknown-linux-musl'
                || matrix.os == 'macos-latest' &&
-                    'https://github.com/prefix-dev/pixi/releases/download/v0.44.0/pixi-x86_64-apple-darwin'
-                    || 'https://github.com/prefix-dev/pixi/releases/download/v0.44.0/pixi-x86_64-pc-windows-msvc.exe'
+                    'https://github.com/prefix-dev/pixi/releases/download/v0.80.0/pixi-x86_64-apple-darwin'
+                    || 'https://github.com/prefix-dev/pixi/releases/download/v0.80.0/pixi-x86_64-pc-windows-msvc.exe'
            }}
        if: matrix.ignore-reason == 'url'
      - name: Create custom bin directory
@@ -551,23 +556,23 @@ jobs:
          # this will implicitly set pixi-version to latest
          pixi-bin-path: custom-bin/pixi${{ matrix.os == 'windows-latest' && '.exe' || '' }}
        if: matrix.ignore-reason == 'bin-path'
-      - name: Verify pixi version (after setup-pixi) - still at 0.43.0
+      - name: Verify pixi version (after setup-pixi) - still at 0.79.0
        run: |
          pixi --version
-          pixi --version | grep -q 0.43.0
+          pixi --version | grep -q 0.79.0
        shell: bash
        if: matrix.ignore-reason == 'none'
-      - name: Verify pixi version (after setup-pixi) - should be 0.44.0
+      - name: Verify pixi version (after setup-pixi) - should be 0.80.0
        run: |
          pixi --version
-          pixi --version | grep -q 0.44.0
+          pixi --version | grep -q 0.80.0
        shell: bash
        if: matrix.ignore-reason != 'none' && matrix.ignore-reason != 'bin-path' && matrix.ignore-reason != 'version-latest'
      - name: Verify pixi version (after setup-pixi) - should be latest
        run: |
          pixi --version
-          pixi --version | grep -vq 0.43.0
-          pixi --version | grep -vq 0.44.0
+          pixi --version | grep -vq 0.79.0
+          pixi --version | grep -vq 0.80.0
        shell: bash
        if: matrix.ignore-reason == 'bin-path' || matrix.ignore-reason == 'version-latest'
      - name: Verify pixi path (after setup-pixi, no ignore reason)
@@ -587,7 +592,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -608,7 +613,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -631,7 +636,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -646,6 +651,75 @@ jobs:
        # https://github.com/prefix-dev/pixi/issues/330
        if: matrix.os == 'ubuntu-latest'

+  auth-logout-after-install:
+    env:
+      # We must set this environment variable explicitly to force all
+      # operating systems to use the same storage mechanism.
+      # Otherwise, windows and mac will use the keychain, which is more cumbersome to test.
+      RATTLER_AUTH_FILE: .rattler-credentials.json
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      # auth-logout: post and never are tested in auth-logout-post-never
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+          auth-logout: after-install
+      - name: Assert that the credentials are not stored anymore
+        run: |
+          # For human log readers
+          cat "${RATTLER_AUTH_FILE}"
+
+          # Actual test
+          ! grep -q '"*.custom-conda-registry.com"' "${RATTLER_AUTH_FILE}"
+
+  auth-logout-post-never:
+    env:
+      # We must set this environment variable explicitly to force all
+      # operating systems to use the same storage mechanism.
+      # Otherwise, mac will use the keychain, which is more cumbersome to test.
+      RATTLER_AUTH_FILE: .rattler-credentials.json
+    strategy:
+      matrix:
+        # action-post-run doesn't support bash on windows
+        os: [ubuntu-latest, macos-latest]
+        auth-logout: [post, never]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Move pixi.toml
+        run: mv test/default/* .
+      # post steps run in reverse order, so this runs after the post step of setup-pixi
+      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
+        with:
+          run: |
+            set -euxo pipefail
+            cat "${RATTLER_AUTH_FILE}"
+            ${{ matrix.auth-logout == 'post' && '! ' || '' }}grep -q '"*.custom-conda-registry.com"' "${RATTLER_AUTH_FILE}"
+      - uses: ./
+        with:
+          cache: false
+          auth-host: https://custom-conda-registry.com
+          auth-token: custom-token
+          auth-logout: ${{ matrix.auth-logout }}
+      - name: Assert that the credentials are still stored
+        run: |
+          cat "${RATTLER_AUTH_FILE}"
+          [ $(jq '."*.custom-conda-registry.com".BearerToken' -r "${RATTLER_AUTH_FILE}") = "custom-token" ]
+
  auth-token-install:
    strategy:
      matrix:
@@ -653,7 +727,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/auth/* .
      - uses: ./
@@ -672,7 +746,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/auth-s3/* .
      - uses: ./
@@ -688,18 +762,17 @@ jobs:
  pixi-shell:
    strategy:
      matrix:
-        # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
        with:
          cache: false
      - run: |
-          python --version | grep -q "3.11"
+          python --version | grep -q "3.14"
        shell: pixi run bash -e {0}
      - run: |
          import sys
@@ -707,7 +780,7 @@ jobs:
          print("Hello world")
        shell: pixi run python {0}
      - run: |
-          python --version | Select-String "3.11"
+          python --version | Select-String "3.14"
        shell: pixi run pwsh -Command {0}
        # TODO investigate: for some reason, this errors on ubuntu-arm
        if: matrix.os != 'ubuntu-24.04-arm'
@@ -715,23 +788,22 @@ jobs:
  pixi-shell-exec:
    strategy:
      matrix:
-        # TODO: add windows-11-arm: https://github.com/conda-forge/conda-forge.github.io/issues/1940
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          run-install: false
      - run: |
-          python --version | grep -q "3.11"
-        shell: pixi exec --spec python=3.11.* -- bash -e {0}
+          python --version | grep -q "3.14"
+        shell: pixi exec --spec python=3.14.* -- bash -e {0}
      - run: |
          import ruamel.yaml
        shell: pixi exec --spec python --spec ruamel.yaml -- python {0}
      - run: |
-          python --version | Select-String "3.11"
-        shell: pixi exec --spec python=3.11.* -- pwsh -Command {0}
+          python --version | Select-String "3.14"
+        shell: pixi exec --spec python=3.14.* -- pwsh -Command {0}
        # TODO investigate: for some reason, this errors on ubuntu-arm
        if: matrix.os != 'ubuntu-24.04-arm'

@@ -741,7 +813,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -766,7 +838,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -788,7 +860,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -809,7 +881,7 @@ jobs:
      matrix:
        post-cleanup: ['true', 'false']
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: lisanna-dettwyler/action-post-run@d053b9b43d788b87a409f6cdb3b6fc87c6c8a4fe # v3.1.0
@@ -830,7 +902,7 @@ jobs:
        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -862,7 +934,7 @@ jobs:
        cache: ['true', 'false']
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -898,7 +970,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -914,7 +986,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -939,7 +1011,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -963,7 +1035,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -980,7 +1052,7 @@ jobs:
        os: [windows-latest, ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/pyproject-manifest/* .
      - uses: ./
@@ -998,7 +1070,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./
        with:
          cache: true
@@ -1010,7 +1082,7 @@ jobs:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1026,7 +1098,7 @@ jobs:
      run:
        shell: bash
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1042,7 +1114,7 @@ jobs:
      run:
        shell: pwsh
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1058,7 +1130,7 @@ jobs:
      run:
        shell: cmd
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1076,7 +1148,7 @@ jobs:
  environment-activation-false:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1087,7 +1159,7 @@ jobs:
  environment-activation-explicit-env:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -1100,7 +1172,7 @@ jobs:
  environment-activation-multiple-env:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -1117,7 +1189,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/multiple-environments/* .
      - uses: ./
@@ -1135,7 +1207,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/default/* .
      - uses: ./
@@ -1153,7 +1225,7 @@ jobs:
  env-variable-input-custom-pixi-url:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -1166,7 +1238,7 @@ jobs:
  env-variable-input-precendence:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi.toml
        run: mv test/old-pixi-lockfiles/* .
      - uses: ./
@@ -1184,7 +1256,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1206,7 +1278,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -1227,7 +1299,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/default/* .
      - uses: ./
@@ -1250,7 +1322,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1271,7 +1343,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -1292,7 +1364,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/lockfile-not-up-to-date/* .
      - uses: ./
@@ -1313,7 +1385,7 @@ jobs:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Move pixi files
        run: mv test/no-lockfile/* .
      - uses: ./
@@ -0,0 +1,10 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "tabWidth": 2,
+  "printWidth": 120,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "semi": false,
+  "sortPackageJson": false,
+  "ignorePatterns": ["dist", "pnpm-lock.yaml", "pixi.lock", "**/*.toml"]
+}
@@ -0,0 +1,23 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["eslint", "typescript", "unicorn", "oxc", "node"],
+  "categories": {
+    "correctness": "error"
+  },
+  "options": {
+    "typeAware": true,
+    "typeCheck": true,
+    "denyWarnings": true
+  },
+  "ignorePatterns": ["dist"],
+  "rules": {
+    "no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
+    "typescript/no-explicit-any": "error",
+    "typescript/no-unsafe-argument": "error",
+    "typescript/no-unsafe-assignment": "error",
+    "typescript/no-unsafe-call": "error",
+    "typescript/no-unsafe-member-access": "error",
+    "typescript/no-unsafe-return": "error",
+    "typescript/prefer-nullish-coalescing": ["error", { "ignoreConditionalTests": true }]
+  }
+}
@@ -1,3 +0,0 @@
-dist
-pnpm-lock.yaml
-pixi.lock
@@ -1,3 +1,3 @@
 {
-  "editor.defaultFormatter": "esbenp.prettier-vscode"
+  "editor.defaultFormatter": "oxc.oxc-vscode"
 }
@@ -23,9 +23,9 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 ## Usage

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
-    pixi-version: v0.62.2
+    pixi-version: v0.66.0

    cache: true
    auth-host: prefix.dev
@@ -35,7 +35,7 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m

 > [!WARNING]
 > Since pixi is not yet stable, the API of this action may change between minor versions.
-> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.9.4`) to avoid breaking changes.
+> Please pin the versions of this action to a specific version (i.e., `prefix-dev/setup-pixi@v0.11.0`) to avoid breaking changes.
 > You can automatically update the version of this action by using [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
 >
 > Put the following in your `.github/dependabot.yml` file to enable Dependabot for your GitHub Actions:
@@ -51,6 +51,8 @@ GitHub Action to set up the [pixi](https://github.com/prefix-dev/pixi) package m
 >       dependencies:
 >         patterns:
 >           - '*'
+>     cooldown:
+>       default-days: 7
 > ```

 ## Features
@@ -77,7 +79,7 @@ In order to not exceed the [10 GB cache size limit](https://docs.github.com/en/a
 This can be done by setting the `cache-write` argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    cache: true
    cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -122,7 +124,7 @@ test:
      environment: [py311, py312]
  steps:
    - uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.9.4
+    - uses: prefix-dev/setup-pixi@v0.11.0
      with:
        environments: ${{ matrix.environment }}
 ```
@@ -132,7 +134,7 @@ test:
 The following example will install both the `py311` and the `py312` environment on the runner.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    # separated by spaces
    environments: >-
@@ -155,7 +157,7 @@ For instance, the `keyring`, or `gcloud` executables. The following example show
 By default, global environments are not cached. You can enable caching by setting the `global-cache` input to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    global-environments: |
      google-cloud-sdk
@@ -188,7 +190,7 @@ Specify the token using the `auth-token` input argument.
 This form of authentication (bearer token in the request headers) is mainly used at [prefix.dev](https://prefix.dev).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: prefix.dev
    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
@@ -200,7 +202,7 @@ Specify the username and password using the `auth-username` and `auth-password`
 This form of authentication (HTTP Basic Auth) is used in some enterprise environments with [artifactory](https://jfrog.com/artifactory) for example.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: custom-artifactory.com
    auth-username: ${{ secrets.PIXI_USERNAME }}
@@ -213,7 +215,7 @@ Specify the conda-token using the `auth-conda-token` input argument.
 This form of authentication (token is encoded in URL: `https://my-quetz-instance.com/t/<token>/get/custom-channel`) is used at [anaconda.org](https://anaconda.org) or with [quetz instances](https://github.com/mamba-org/quetz).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: anaconda.org # or my-quetz-instance.com
    auth-conda-token: ${{ secrets.CONDA_TOKEN }}
@@ -225,7 +227,7 @@ Specify the S3 key pair using the `auth-access-key-id` and `auth-secret-access-k
 You can also specify the session token using the `auth-session-token` input argument.

 ```yaml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    auth-host: s3://my-s3-bucket
    auth-s3-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
@@ -236,12 +238,36 @@ You can also specify the session token using the `auth-session-token` input argu

 See the [pixi documentation](https://pixi.sh/latest/advanced/s3) for more information about S3 authentication.

+#### Logging out
+
+By default, the credentials stay available to all subsequent steps of the job and the action runs
+`pixi auth logout <auth-host>` in its post step at the end of the job.
+You can change this behavior with the `auth-logout` input:
+
+- `post` (default): log out in the post step at the end of the job.
+- `after-install`: log out at the end of the action, after `pixi install` has completed.
+  Use this if you only want pixi to use the authenticated remote channel during the action's own install step,
+  so that later steps cannot reach the private channel anymore.
+- `never`: never log out, for example on self-hosted runners where the credentials should persist between jobs.
+
+```yml
+- uses: prefix-dev/setup-pixi@v0.11.0
+  with:
+    auth-host: prefix.dev
+    auth-token: ${{ secrets.PREFIX_DEV_TOKEN }}
+    auth-logout: after-install
+```
+
+> [!NOTE]
+> `auth-logout` replaces the removed `persist-credentials` input.
+> Use `auth-logout: after-install` instead of `persist-credentials: false` and `auth-logout: never` instead of `persist-credentials: true`.
+
 #### PyPI keyring provider

 You can specify whether to use keyring to look up credentials for PyPI.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    pypi-keyring-provider: subprocess # one of 'subprocess', 'disabled'
 ```
@@ -309,7 +335,7 @@ To this end, `setup-pixi` adds all environment variables set when executing `pix
 As a result, all installed binaries can be accessed without having to call `pixi run`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    activate-environment: true
 ```
@@ -317,7 +343,7 @@ As a result, all installed binaries can be accessed without having to call `pixi
 If you are installing multiple environments, you will need to specify the name of the environment that you want to be activated.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    environments: >-
      py311
@@ -334,7 +360,7 @@ You can specify whether `setup-pixi` should run `pixi install --frozen` or `pixi
 See the [official documentation](https://pixi.sh/latest/reference/cli/pixi/install/#update-options) for more information about the `--frozen` and `--locked` flags.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    locked: true
    # or
@@ -353,7 +379,7 @@ The first one is the debug logging of the action itself.
 This can be enabled by running the action with the `RUNNER_DEBUG` environment variable set to `true`.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  env:
    RUNNER_DEBUG: true
 ```
@@ -371,7 +397,7 @@ The second type is the debug logging of the pixi executable.
 This can be specified by setting the `log-level` input.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    # one of `q`, `default`, `v`, `vv`, or `vvv`.
    log-level: vvv
@@ -392,12 +418,12 @@ If you set `post-cleanup` to `true`, the action will delete the following files:
 - the rattler cache
 - other rattler files in `~/.rattler`

-If nothing is specified, `post-cleanup` will default to `true`.
+If nothing is specified, `post-cleanup` will default to `false`.

 On self-hosted runners, you also might want to alter the default pixi install location to a temporary location. You can use `pixi-bin-path: ${{ runner.temp }}/bin/pixi` to do this.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    post-cleanup: true
    # ${{ runner.temp }}\Scripts\pixi.exe on Windows
@@ -413,7 +439,7 @@ You can also use a preinstalled local version of pixi on the runner by not setti
 This can be overwritten by setting the `manifest-path` input argument.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    manifest-path: pyproject.toml
 ```
@@ -423,7 +449,7 @@ This can be overwritten by setting the `manifest-path` input argument.
 If you're working with a monorepo where your pixi project is in a subdirectory, you can use the `working-directory` input to specify where pixi should look for manifest files (`pixi.toml` or `pyproject.toml`).

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    working-directory: ./packages/my-project
 ```
@@ -442,7 +468,7 @@ This will make pixi look for `pixi.toml` or `pyproject.toml` in the `./packages/
 You can combine `working-directory` with `manifest-path` if needed:

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    working-directory: ./packages/my-project
    manifest-path: custom-pixi.toml
@@ -453,7 +479,7 @@ You can combine `working-directory` with `manifest-path` if needed:
 If you only want to install pixi and not install the current project, you can use the `run-install` option.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    run-install: false
 ```
@@ -464,7 +490,7 @@ You can also download pixi from a custom URL by setting the `pixi-url` input arg
 Optionally, you can combine this with the `pixi-url-headers` input argument to supply additional headers for the download request, such as a bearer token.

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    pixi-url: https://pixi-mirror.example.com/releases/download/v0.48.0/pixi-x86_64-unknown-linux-musl
    pixi-url-headers: '{"Authorization": "Bearer ${{ secrets.PIXI_MIRROR_BEARER_TOKEN }}"}'
@@ -480,7 +506,7 @@ It will be rendered with the following variables:
 By default, `pixi-url` is equivalent to the following template:

 ```yml
- uses: prefix-dev/setup-pixi@v0.9.4
+- uses: prefix-dev/setup-pixi@v0.11.0
  with:
    pixi-url: |
      {{#if latest~}}
@@ -63,7 +63,7 @@ inputs:
    description: |
      Host to use for authentication. If not set, pixi is not authenticating.
      Requires `auth-token` or `auth-conda-token` or `auth-username` and `auth-password` to be set.
-      See https://prefix.dev/docs/pixi/authentication
+      See https://pixi.prefix.dev/latest/deployment/authentication/
  auth-token:
    description: Token to use for authentication.
  auth-username:
@@ -78,13 +78,23 @@ inputs:
    description: Secret access key to use for S3 authentication.
  auth-s3-session-token:
    description: Session token to use for S3 authentication.
+  auth-logout:
+    description: |
+      When to run `pixi auth logout <auth-host>`. Requires `auth-host`.
+      options: post, after-install, never
+      - `post` (default): The credentials stay available to all subsequent steps and are removed in the post step at the end of the job.
+      - `after-install`: The credentials are removed at the end of this action, so that later steps cannot reach the private channel anymore.
+      - `never`: The credentials are never removed.
+  persist-credentials:
+    description: Removed, use `auth-logout` instead.
+    deprecationMessage: '`persist-credentials` has been removed, use `auth-logout: after-install` (instead of `false`) or `auth-logout: never` (instead of `true`).'
  pypi-keyring-provider:
    description: |
      Specifies whether to use keyring to look up credentials for PyPI.
      options: disabled, subprocess
  post-cleanup:
    description: |
-      If the action should clean up after itself. Defaults to `true`.
+      If the action should clean up after itself. Defaults to `false`.
      If `true`, the pixi environment, the pixi binary and the rattler files in ~/.rattler and ~/.cache/rattler are removed.

 runs:
@@ -1,42 +0,0 @@
-// @ts-check
-
-import eslint from '@eslint/js'
-import tseslint from 'typescript-eslint'
-
-export default tseslint.config(
-  eslint.configs.recommended,
-  ...tseslint.configs.strictTypeChecked,
-  ...tseslint.configs.stylisticTypeChecked,
-  {
-    ignores: ['dist/*']
-  },
-  {
-    languageOptions: {
-      parserOptions: {
-        project: true,
-        tsconfigRootDir: import.meta.dirname
-      }
-    }
-  },
-  {
-    rules: {
-      '@typescript-eslint/no-unused-vars': [
-        'error',
-        {
-          argsIgnorePattern: '^_'
-        }
-      ],
-      '@typescript-eslint/prefer-nullish-coalescing': [
-        'error',
-        {
-          ignoreConditionalTests: true
-        }
-      ]
-    }
-  },
-  // disable type checking for config files as they aren't in the TS root
-  {
-    files: ['eslint.config.mjs', 'prettier.config.mjs', 'tsup.config.js'],
-    ...tseslint.configs.disableTypeChecked
-  }
-)
@@ -1,14 +1,15 @@
 {
  "name": "setup-pixi",
-  "version": "0.9.4",
+  "version": "0.11.0",
  "private": true,
  "description": "Action to set up the pixi package manager.",
  "scripts": {
    "build": "tsup",
    "dev": "tsup --watch",
-    "eslint": "eslint .",
-    "lint": "pnpm eslint && prettier -c .",
-    "lint:fix": "eslint . --fix && prettier -w ."
+    "lint": "oxlint --fix",
+    "lint:check": "oxlint",
+    "fmt": "oxfmt",
+    "fmt:check": "oxfmt --check"
  },
  "repository": {
    "type": "git",
@@ -22,25 +23,24 @@
  "author": "Pavel Zwerschke <pavelzw@gmail.com>",
  "license": "BSD-3-Clause",
  "dependencies": {
-    "@actions/cache": "^5.0.1",
-    "@actions/core": "^2.0.1",
-    "@actions/exec": "^2.0.0",
-    "@actions/io": "^2.0.0",
-    "@actions/tool-cache": "^2.0.2",
-    "handlebars": "^4.7.8",
-    "smol-toml": "^1.6.0",
+    "@actions/cache": "^6.2.0",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/io": "^3.0.2",
+    "@actions/tool-cache": "^4.0.0",
+    "handlebars": "^4.7.9",
+    "smol-toml": "^1.9.0",
    "untildify": "^6.0.0",
-    "which": "^6.0.0",
-    "zod": "^4.3.4"
+    "which": "^7.0.0",
+    "zod": "^4.6.5"
  },
  "devDependencies": {
-    "@eslint/js": "^9.39.2",
-    "@types/node": "^25.0.3",
+    "@types/node": "^26.6.2",
    "@types/which": "^3.0.4",
-    "eslint": "^9.39.2",
-    "prettier": "^3.7.4",
+    "oxfmt": "^0.71.0",
+    "oxlint": "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
    "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.51.0"
+    "typescript": "^7.0.2"
  }
 }
@@ -0,0 +1,9 @@
+allowBuilds:
+  esbuild: true
+
+overrides:
+  undici: ^6.28.0
+  rollup: ^4.59.0
+  fast-xml-parser: ^5.10.1
+  minimatch@3>brace-expansion: ^1.1.18
+  minimatch@10>brace-expansion: ^5.0.9
@@ -1,9 +0,0 @@
-const config = {
-  tabWidth: 2,
-  printWidth: 120,
-  singleQuote: true,
-  trailingComma: 'none',
-  semi: false
-}
-
-export default config
@@ -14,7 +14,6 @@ const splitEnvironment = (shellHook: ShellHook): [Record<string, string>, string
    if (pathEnvs.length > 0) {
      const caseSensitivePathName = pathEnvs[0]
      const path = shellHook.environment_variables[caseSensitivePathName]
-      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
      delete shellHook.environment_variables[caseSensitivePathName]
      return [shellHook.environment_variables, path]
    }
@@ -39,8 +39,7 @@ export const generateProjectCacheKey = async (cacheKeyPrefix: string) => {
    core.debug(`sha: ${sha}`)
    return `${cacheKeyPrefix}${getCondaArch()}-${sha}`
  } catch (err: unknown) {
-    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-    throw new Error(`Failed to generate cache key: ${err}`)
+    throw new Error(`Failed to generate cache key`, { cause: err })
  }
 }

@@ -54,8 +53,7 @@ export const generateGlobalCacheKey = async (cacheKeyPrefix: string) => {
    core.debug(`sha: ${sha}`)
    return `${cacheKeyPrefix}${getCondaArch()}-${getYearMonth()}-${sha}`
  } catch (err: unknown) {
-    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-    throw new Error(`Failed to generate cache key: ${err}`)
+    throw new Error(`Failed to generate cache key`, { cause: err })
  }
 }

@@ -118,7 +116,7 @@ async function _saveCache(
      const cacheId = await cache.saveCache([cachePath], cacheKey, undefined, false)
      core.info(`Saved cache with ID "${cacheId.toString()}"`)
    } catch (err: unknown) {
-      // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+      // oxlint-disable-next-line typescript/restrict-template-expressions
      core.error(`Error saving ${type} cache: ${err}`)
    }
  })
@@ -48,6 +48,19 @@ const pixiLogin = async () => {
      core.debug(`Logging in to ${auth.host} with conda token`)
      await execute(pixiCmd(`auth login --conda-token ${auth.condaToken} ${auth.host}`, false))
    }
+    await execute(pixiCmd('auth status', false))
+  })
+}
+
+const pixiLogout = async () => {
+  const auth = options.auth
+  if (auth?.logout !== 'after-install') {
+    core.debug('Skipping pixi logout.')
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
  })
 }

@@ -163,6 +176,7 @@ const run = async () => {
  if (options.activatedEnvironment) {
    await activateEnv(options.activatedEnvironment)
  }
+  await pixiLogout()
 }

 const main = async () => {
@@ -35,6 +35,7 @@ type Inputs = Readonly<{
  authS3AccessKeyId?: string
  authS3SecretAccessKey?: string
  authS3SessionToken?: string
+  authLogout?: AuthLogout
  pypiKeyringProvider?: 'disabled' | 'subprocess'
  postCleanup?: boolean
  globalEnvironments?: string[]
@@ -48,6 +49,7 @@ export interface PixiSource {

 type Auth = {
  host: string
+  logout: AuthLogout
 } & (
  | {
      token: string
@@ -102,6 +104,9 @@ const pyprojectPath = 'pyproject.toml'
 const logLevelSchema = z.enum(['q', 'default', 'v', 'vv', 'vvv'])
 export type LogLevel = z.infer<typeof logLevelSchema>

+const authLogoutSchema = z.enum(['post', 'after-install', 'never'])
+export type AuthLogout = z.infer<typeof authLogoutSchema>
+
 const pypiKeyringProviderSchema = z.enum(['disabled', 'subprocess'])
 export type PypiKeyringProvider = z.infer<typeof pypiKeyringProviderSchema>

@@ -240,6 +245,9 @@ const validateInputs = (inputs: Inputs): void => {
    if (inputs.authToken || inputs.authUsername || inputs.authCondaToken || inputs.authS3AccessKeyId) {
      throw new Error('You need to specify auth-host')
    }
+    if (inputs.authLogout) {
+      throw new Error('Cannot use auth-logout without specifying auth-host')
+    }
  }
  if (inputs.runInstall === false && inputs.environments) {
    throw new Error('Cannot specify environments without running install')
@@ -355,31 +363,36 @@ const inferOptions = (inputs: Inputs): Options => {
      : undefined
  const frozen = inputs.frozen ?? false
  const locked = inputs.locked ?? (lockFileAvailable && !frozen)
+  const authLogout = inputs.authLogout ?? 'post'
  const auth = !inputs.authHost
    ? undefined
    : ((inputs.authToken
        ? {
            host: inputs.authHost,
-            token: inputs.authToken
+            token: inputs.authToken,
+            logout: authLogout
          }
        : inputs.authCondaToken
          ? {
              host: inputs.authHost,
-              condaToken: inputs.authCondaToken
+              condaToken: inputs.authCondaToken,
+              logout: authLogout
            }
          : inputs.authUsername
            ? {
                host: inputs.authHost,
                username: inputs.authUsername,
-                password: inputs.authPassword
+                password: inputs.authPassword,
+                logout: authLogout
              }
            : {
                host: inputs.authHost,
                s3AccessKeyId: inputs.authS3AccessKeyId,
                s3SecretAccessKey: inputs.authS3SecretAccessKey,
-                s3SessionToken: inputs.authS3SessionToken
+                s3SessionToken: inputs.authS3SessionToken,
+                logout: authLogout
              }) as Auth)
-  const postCleanup = inputs.postCleanup ?? true
+  const postCleanup = inputs.postCleanup ?? false
  const pypiKeyringProvider = inputs.pypiKeyringProvider
  return {
    globalEnvironments: inputs.globalEnvironments,
@@ -413,6 +426,11 @@ const assertOptions = (_options: Options) => {
 }

 const getOptions = () => {
+  if (inputOrEnvironmentVariable('persist-credentials') !== undefined) {
+    throw new Error(
+      '`persist-credentials` has been removed, use `auth-logout: after-install` (instead of `false`) or `auth-logout: never` (instead of `true`).'
+    )
+  }
  const inputs: Inputs = {
    pixiVersion: parseOrUndefined(
      'pixi-version',
@@ -447,6 +465,11 @@ const getOptions = () => {
    authS3AccessKeyId: parseOrUndefined('auth-s3-access-key-id', z.string()),
    authS3SecretAccessKey: parseOrUndefined('auth-s3-secret-access-key', z.string()),
    authS3SessionToken: parseOrUndefined('auth-s3-session-token', z.string()),
+    authLogout: parseOrUndefined(
+      'auth-logout',
+      authLogoutSchema,
+      'auth-logout must be one of `post`, `after-install`, `never`.'
+    ),
    pypiKeyringProvider: parseOrUndefined('pypi-keyring-provider', pypiKeyringProviderSchema),
    globalEnvironments: parseOrUndefinedMultilineList('global-environments', z.string()),
    postCleanup: parseOrUndefinedJSON('post-cleanup', z.boolean())
@@ -477,3 +500,10 @@ try {
 }

 export const options = _options
+export const assertAuth = () => {
+  const auth = options.auth
+  if (!auth) {
+    throw new Error('Authentication configuration is missing.')
+  }
+  return auth
+}
@@ -5,6 +5,7 @@ import os from 'os'
 import { exit } from 'process'
 import * as core from '@actions/core'
 import { options } from './options'
+import { execute, pixiCmd } from './util'

 const removeEmptyParentDirs = (dirPath: string): Promise<void> => {
  if (existsSync(dirPath)) {
@@ -52,7 +53,6 @@ const cleanupEnv = () => {
 const determineCacheDir = (): string => {
  // rattler uses dirs::cache_dir https://docs.rs/dirs/latest/dirs/fn.cache_dir.html
  if (os.platform() === 'win32') {
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
    return process.env.LOCALAPPDATA!
  }
  if (os.platform() === 'linux') {
@@ -72,13 +72,31 @@ const cleanupRattler = () => {
  ])
 }

-const run = () => {
+const pixiLogout = async () => {
+  const auth = options.auth
+  if (auth?.logout !== 'post') {
+    core.debug('Skipping pixi logout.')
+    return
+  }
+  if (!existsSync(options.pixiBinPath)) {
+    core.debug(`Skipping pixi logout, pixi binary ${options.pixiBinPath} does not exist.`)
+    return
+  }
+  await core.group('Logging out of private channel', async () => {
+    core.debug(`Logging out of ${auth.host}`)
+    await execute(pixiCmd(`auth logout ${auth.host}`, false))
+  })
+}
+
+const run = async () => {
+  // needs to happen before the cleanup since that removes the pixi binary
+  await pixiLogout()
  const postCleanup = options.postCleanup
  if (postCleanup) {
-    return Promise.all([cleanupPixiBin(), cleanupEnv(), cleanupRattler()])
+    await Promise.all([cleanupPixiBin(), cleanupEnv(), cleanupRattler()])
+    return
  }
  core.debug('Skipping post-cleanup.')
-  return Promise.resolve()
 }

 run()
@@ -1,4 +1,3 @@
-import type { BinaryLike } from 'crypto'
 import { createHash } from 'crypto'
 import os from 'os'
 import * as core from '@actions/core'
@@ -21,6 +20,7 @@ export const getCondaArch = () => {
    'linux-x64': 'linux-64',
    'linux-arm64': 'linux-aarch64',
    'linux-ppc64': 'linux-ppc64le',
+    'linux-riscv64': 'linux-riscv64',
    'win32-x64': 'win-64',
    'win32-arm64': 'win-arm64'
  }
@@ -33,15 +33,21 @@ export const getCondaArch = () => {

 const getPlatform = () => {
  const platform = os.platform()
+  const arch = os.arch()
+
  switch (platform) {
    case 'darwin':
      return 'apple-darwin'
    case 'linux':
+      if (arch == 'riscv64') {
+        // https://github.com/prefix-dev/pixi/issues/6903
+        return 'unknown-linux-gnu'
+      }
      return 'unknown-linux-musl'
    case 'win32':
      return 'pc-windows-msvc'
    default:
-      throw new Error(`Unsupported architecture: ${platform}`)
+      throw new Error(`Unsupported platform: ${platform}`)
  }
 }

@@ -52,6 +58,8 @@ const getArch = () => {
      return 'x86_64'
    case 'arm64':
      return 'aarch64'
+    case 'riscv64':
+      return 'riscv64gc'
    default:
      throw new Error(`Unsupported architecture: ${arch}`)
  }
@@ -70,11 +78,11 @@ export const renderPixiUrl = (urlTemplate: string, version: string) => {
  })
 }

-export const sha256 = (s: BinaryLike) => {
+export const sha256 = (s: string | NodeJS.ArrayBufferView) => {
  return createHash('sha256').update(s).digest('hex')
 }

-export const sha256Short = (s: BinaryLike) => {
+export const sha256Short = (s: string | NodeJS.ArrayBufferView) => {
  return sha256(s).slice(0, 7)
 }

@@ -1,10 +1,19 @@
 [workspace]
 name = "test-default"
 channels = ["conda-forge"]
-platforms = ["linux-64", "linux-aarch64", "osx-64", "osx-arm64", "win-64"]
+platforms = [
+  "linux-64",
+  "linux-aarch64",
+  "linux-riscv64",
+  "linux-ppc64le",
+  "osx-64",
+  "osx-arm64",
+  "win-64",
+  "win-arm64",
+]

 [tasks]
 test = "python -c 'print(\"Hello world!\")'"

 [dependencies]
-python = "3.11.*"
+python = "3.14.*"
@@ -1,12 +1,14 @@
 {
  "compilerOptions": {
-    "target": "ES2020" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
    "module": "CommonJS" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
    "outDir": "./lib" /* Redirect output structure to the directory. */,
    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
    "strict": true /* Enable all strict type-checking options. */,
    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
-    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
+    "types": ["node"],
+    "skipLibCheck": true
  },
  "exclude": ["node_modules", "**/*.test.ts"]
 }
@@ -12,6 +12,8 @@ export default defineConfig({
  sourcemap: false,
  platform: 'node',
  minify: false,
+  // shim `import.meta.url` in CJS output; some deps (e.g. @azure/storage-common) rely on it
+  shims: true,
  outExtension() {
    return {
      js: '.js'
Author	SHA1	Message	Date
Pavel Zwerschke	9dabb60412	feat!: Add auth-logout input and run pixi auth status after login (#291 )	2026-10-06 18:15:30 +02:00
Pavel Zwerschke	5fdf4c63fe	chore: bump typescript to v7 and migrate to oxlint and oxfmt (#289 )	2026-10-01 12:31:45 +02:00
dependabot[bot]andPavel Zwerschke	1fa34b61c2	chore(deps): bump the nodejs group across 1 directory with 7 updates (#288 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-10-01 11:46:57 +02:00
dependabot[bot]	999d92afb1	chore(deps): bump the gh-actions group across 1 directory with 2 updates (#287 ) Signed-off-by: dependabot[bot] <support@github.com>	2026-10-01 11:22:52 +02:00
Pavel Zwerschke	2a8a9843bb	chore: simplify example recipe (#285 )	2026-09-15 17:24:57 +02:00
Pavel Zwerschke	d3f436a425	feat: Add support for linux-riscv64 (#282 )	2026-08-28 10:55:29 +02:00
Wolf Vollprecht	f00437f565	Update dependencies and add pnpm workspace configuration (#279 )	2026-08-05 17:52:08 +02:00
dependabot[bot]	d0c199d447	chore(deps): bump the gh-actions group with 3 updates (#276 )	2026-08-01 08:31:09 +02:00
dependabot[bot]andPavel Zwerschke	2253d9c931	chore(deps): bump the gh-actions group with 3 updates (#273 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-07-02 17:56:44 +02:00
dependabot[bot]andPavel Zwerschke	c5359a316e	chore(deps): bump the nodejs group with 6 updates (#274 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-07-01 18:06:30 +02:00
Hofer-Julian	a09b624715	feat: change post-cleanup default to false (#272 )	2026-06-29 16:31:17 +02:00
dependabot[bot]andPavel Zwerschke	947fc1f2cc	chore(deps): bump the nodejs group with 6 updates (#269 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-06-01 14:42:15 +02:00
dependabot[bot]	36c1c8cc24	chore(deps): bump the gh-actions group with 2 updates (#268 ) Signed-off-by: dependabot[bot] <support@github.com>	2026-06-01 14:24:05 +02:00
Andreas AlbertandPavel Zwerschke	5185adfbff	feat: Add `persist-credentials` option (#266 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2026-05-21 13:13:17 +02:00
dependabot[bot]andPavel Zwerschke	92596c33b0	chore(deps): bump the nodejs group with 6 updates (#264 ) Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com> Signed-off-by: dependabot[bot] <support@github.com>	2026-05-21 13:04:19 +02:00
dependabot[bot]	68a459aa8a	chore(deps): bump the gh-actions group with 5 updates (#263 ) Signed-off-by: dependabot[bot] <support@github.com>	2026-05-21 12:54:08 +02:00
Pavel Zwerschke	8ce63489f8	add octo-sts (#262 )	2026-04-24 09:08:08 +02:00
github-actions[bot]	b92f01076d	Reference latest Pixi version in README (#260 )	2026-04-01 06:06:51 +00:00
dependabot[bot]	46d4c99b05	chore(deps): bump the gh-actions group with 4 updates (#261 )	2026-04-01 07:57:58 +02:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Pavel Zwerschke	1b2de7f335	chore(deps): bump dependencies (#259 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2026-03-31 11:00:43 +02:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Ruben Arts	6ef69835bb	chore(deps): bump the nodejs group with 10 dependencies (#257 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ruben Arts <ruben.arts@hotmail.com>	2026-03-30 14:23:16 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	e6477eb81d	chore(deps): bump Quantco/ui-actions from 1.0.18 to 1.0.19 in the gh-actions group (#256 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-30 13:50:53 +02:00
dependabot[bot]dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Pavel Zwerschke	33be5bafa6	chore(deps): bump the nodejs group with 7 updates (#250 ) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pavel Zwerschke <pavelzw@gmail.com>	2026-02-01 19:18:18 +01:00
dependabot[bot]	72f90fea0c	chore(deps): bump the gh-actions group across 1 directory with 3 updates (#253 )	2026-02-01 11:36:06 +01:00
Copilot	c0d7209ec3	Fix broken authentication documentation link (#252 )	2026-01-29 13:38:47 +00:00
Pavel Zwerschke	f1fb10f03b	docs: Mention cooldown in dependabot config (#247 )	2026-01-28 11:15:30 +01:00