chore: update known checksums for 0.10.11

This PR tries fetching the uv artifact from `releases.astral.sh` by
default, only in cases where the artifact would otherwise have come from
`https://github.com/astral-sh/uv/releases/download/`. The checksums are
supposed to be the same for the mirror, and can still come from
`raw.githubusercontent.com/astral-sh/versions`. If the download fails,
we fall back to the original URL.

This avoids hitting GitHub's Releases API which is prone to rate
limiting. As far as I can tell, together with
https://github.com/astral-sh/setup-uv/pull/802 this PR makes a github
token entirely unnecessary for this action.


Towards https://github.com/astral-sh/uv/issues/18503.

.github/workflows/test.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Actionlint
         uses: eifinger/actionlint-action@7802e0cc3ab3f81cbffb36fb0bf1a3621d994b89 # v1.10.1
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: .nvmrc

__tests__/download/download-version.test.ts

@@ -68,6 +68,7 @@ const {
   downloadVersionFromManifest,
   downloadVersionFromNdjson,
   resolveVersion,
+  rewriteToMirror,
 } = await import("../../src/download/download-version");
 
 describe("download-version", () => {
@@ -198,6 +199,135 @@ describe("download-version", () => {
         "0.9.26",
       );
     });
+
+    it("rewrites GitHub Releases URLs to the Astral mirror", async () => {
+      mockGetArtifactFromNdjson.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        sha256: "abc123",
+        url: "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+      });
+
+      await downloadVersionFromNdjson(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledWith(
+        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        undefined,
+        undefined,
+      );
+    });
+
+    it("does not rewrite non-GitHub URLs", async () => {
+      mockGetArtifactFromNdjson.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        sha256: "abc123",
+        url: "https://example.com/uv.tar.gz",
+      });
+
+      await downloadVersionFromNdjson(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledWith(
+        "https://example.com/uv.tar.gz",
+        undefined,
+        "token",
+      );
+    });
+
+    it("falls back to GitHub Releases when the mirror fails", async () => {
+      mockGetArtifactFromNdjson.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        sha256: "abc123",
+        url: "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+      });
+
+      mockDownloadTool
+        .mockRejectedValueOnce(new Error("mirror unavailable"))
+        .mockResolvedValueOnce("/tmp/downloaded");
+
+      await downloadVersionFromNdjson(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledTimes(2);
+      // Mirror request: no token
+      expect(mockDownloadTool).toHaveBeenNthCalledWith(
+        1,
+        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        undefined,
+        undefined,
+      );
+      // GitHub fallback: token restored
+      expect(mockDownloadTool).toHaveBeenNthCalledWith(
+        2,
+        "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        undefined,
+        "token",
+      );
+      expect(mockWarning).toHaveBeenCalledWith(
+        "Failed to download from mirror, falling back to GitHub Releases: mirror unavailable",
+      );
+    });
+
+    it("does not fall back for non-GitHub URLs", async () => {
+      mockGetArtifactFromNdjson.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        sha256: "abc123",
+        url: "https://example.com/uv.tar.gz",
+      });
+
+      mockDownloadTool.mockRejectedValue(new Error("download failed"));
+
+      await expect(
+        downloadVersionFromNdjson(
+          "unknown-linux-gnu",
+          "x86_64",
+          "0.9.26",
+          undefined,
+          "token",
+        ),
+      ).rejects.toThrow("download failed");
+
+      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("rewriteToMirror", () => {
+    it("rewrites a GitHub Releases URL to the Astral mirror", () => {
+      expect(
+        rewriteToMirror(
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        ),
+      ).toBe(
+        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+      );
+    });
+
+    it("returns undefined for non-GitHub URLs", () => {
+      expect(rewriteToMirror("https://example.com/uv.tar.gz")).toBeUndefined();
+    });
+
+    it("returns undefined for a different GitHub repo", () => {
+      expect(
+        rewriteToMirror(
+          "https://github.com/other/repo/releases/download/v1.0/file.tar.gz",
+        ),
+      ).toBeUndefined();
+    });
   });
 
   describe("downloadVersionFromManifest", () => {

dist/setup/index.cjs

@@ -91887,6 +91887,8 @@ var TOOL_CACHE_NAME = "uv";
 var STATE_UV_PATH = "uv-path";
 var STATE_UV_VERSION = "uv-version";
 var VERSIONS_NDJSON_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
+var GITHUB_RELEASES_PREFIX = "https://github.com/astral-sh/uv/releases/download/";
+var ASTRAL_MIRROR_PREFIX = "https://releases.astral.sh/github/uv/releases/download/";
 
 // src/download/checksum/checksum.ts
 var crypto6 = __toESM(require("node:crypto"), 1);
@@ -91894,6 +91896,23 @@ var fs11 = __toESM(require("node:fs"), 1);
 
 // src/download/checksum/known-checksums.ts
 var KNOWN_CHECKSUMS = {
+  "aarch64-apple-darwin-0.10.11": "437a7d498dd6564d5bf986074249ba1fc600e73da55ae04d7bd4c24d5f149b95",
+  "aarch64-pc-windows-msvc-0.10.11": "6a3eec4105c775dd87c11ef8ec41564648273751ff807c8955c24ddbcc636d03",
+  "aarch64-unknown-linux-gnu-0.10.11": "23003df007937dd607409c8ddf010baa82bad2673e60e254632ca5b04edcce13",
+  "aarch64-unknown-linux-musl-0.10.11": "5d80a7f6343d2676dfde1e5126582070a2bbc62df6f60d5527a169be3788532a",
+  "arm-unknown-linux-musleabihf-0.10.11": "d3c248497c450d22a39c1d43a4a358c0c852e6056f5f49be96495eea41afb96c",
+  "armv7-unknown-linux-gnueabihf-0.10.11": "7895a6470dfba051af4e74253599482fc0b37141b5d229956b383365e1a22902",
+  "armv7-unknown-linux-musleabihf-0.10.11": "d2880c08acfdaef0985488972c8b14969f7139c27545046e2f6202f0e0f4d9d8",
+  "i686-pc-windows-msvc-0.10.11": "c17f3dc3b2c47490057f17a1f0c37270f11a7b7cedf9bf2c0f841ce02bc7001b",
+  "i686-unknown-linux-gnu-0.10.11": "1ab69ff7dd104a902731758ee05b782dfd9bdb263384e61650de638f33f586df",
+  "i686-unknown-linux-musl-0.10.11": "cffb80d303fc1655e259d0b769c489f452e97425a6b6d3393d766413783a1d8c",
+  "powerpc64le-unknown-linux-gnu-0.10.11": "ddc6a20670e60219e947b1b04813be80d7e9f4c4a0234231c8ed9298eec04aa6",
+  "riscv64gc-unknown-linux-gnu-0.10.11": "c0719473cf5f8b475e917b8dfef6ae5d876b86a00a82ef91e47a02f561399f4f",
+  "s390x-unknown-linux-gnu-0.10.11": "305ee734c585918515a22fe43b7cf253c38d468771373a0c02364d67498e07b2",
+  "x86_64-apple-darwin-0.10.11": "ff90020b554cf02ef8008535c9aab6ef27bb7be6b075359300dec79c361df897",
+  "x86_64-pc-windows-msvc-0.10.11": "9ee74df98582f37fdd6069e1caac80d2616f9a489f5dbb2b1c152f30be69c58e",
+  "x86_64-unknown-linux-gnu-0.10.11": "5a360b0de092ddf4131f5313d0411b48c4e95e8107e40c3f8f2e9fcb636b3583",
+  "x86_64-unknown-linux-musl-0.10.11": "d78246139dc6cf3ed6d03c84da762686bced7ad1de67977ee372a45b95a1f6d0",
   "aarch64-apple-darwin-0.10.10": "8a09f0ef51ee7f7170731b4cb8bde5bf9ba6da5304f49a7df6cdab42a1f37b5d",
   "aarch64-pc-windows-msvc-0.10.10": "2c6fe113f14574bc27f085751c68d3485589fcc3c3c64ed85dd1eecc2f87cffc",
   "aarch64-unknown-linux-gnu-0.10.10": "2b80457b950deda12e8d5dc3b9b7494ac143eae47f1fb11b1c6e5a8495a6421e",
@@ -96658,15 +96677,42 @@ async function downloadVersionFromNdjson(platform2, arch3, version4, checkSum2,
       `Could not find artifact for version ${version4}, arch ${arch3}, platform ${platform2} in ${VERSIONS_NDJSON_URL} .`
     );
   }
-  return await downloadVersion(
-    artifact.url,
-    `uv-${arch3}-${platform2}`,
-    platform2,
-    arch3,
-    version4,
-    checkSum2,
-    githubToken2
-  );
+  const mirrorUrl = rewriteToMirror(artifact.url);
+  const downloadUrl = mirrorUrl ?? artifact.url;
+  const downloadToken = mirrorUrl !== void 0 ? void 0 : githubToken2;
+  try {
+    return await downloadVersion(
+      downloadUrl,
+      `uv-${arch3}-${platform2}`,
+      platform2,
+      arch3,
+      version4,
+      checkSum2,
+      downloadToken
+    );
+  } catch (err) {
+    if (mirrorUrl === void 0) {
+      throw err;
+    }
+    warning(
+      `Failed to download from mirror, falling back to GitHub Releases: ${err.message}`
+    );
+    return await downloadVersion(
+      artifact.url,
+      `uv-${arch3}-${platform2}`,
+      platform2,
+      arch3,
+      version4,
+      checkSum2,
+      githubToken2
+    );
+  }
+}
+function rewriteToMirror(url2) {
+  if (!url2.startsWith(GITHUB_RELEASES_PREFIX)) {
+    return void 0;
+  }
+  return ASTRAL_MIRROR_PREFIX + url2.slice(GITHUB_RELEASES_PREFIX.length);
 }
 async function downloadVersionFromManifest(manifestUrl, platform2, arch3, version4, checkSum2, githubToken2) {
   const artifact = await getManifestArtifact(

dist/update-known-checksums/index.cjs

@@ -44949,6 +44949,23 @@ var semver = __toESM(require_semver(), 1);
 
 // src/download/checksum/known-checksums.ts
 var KNOWN_CHECKSUMS = {
+  "aarch64-apple-darwin-0.10.11": "437a7d498dd6564d5bf986074249ba1fc600e73da55ae04d7bd4c24d5f149b95",
+  "aarch64-pc-windows-msvc-0.10.11": "6a3eec4105c775dd87c11ef8ec41564648273751ff807c8955c24ddbcc636d03",
+  "aarch64-unknown-linux-gnu-0.10.11": "23003df007937dd607409c8ddf010baa82bad2673e60e254632ca5b04edcce13",
+  "aarch64-unknown-linux-musl-0.10.11": "5d80a7f6343d2676dfde1e5126582070a2bbc62df6f60d5527a169be3788532a",
+  "arm-unknown-linux-musleabihf-0.10.11": "d3c248497c450d22a39c1d43a4a358c0c852e6056f5f49be96495eea41afb96c",
+  "armv7-unknown-linux-gnueabihf-0.10.11": "7895a6470dfba051af4e74253599482fc0b37141b5d229956b383365e1a22902",
+  "armv7-unknown-linux-musleabihf-0.10.11": "d2880c08acfdaef0985488972c8b14969f7139c27545046e2f6202f0e0f4d9d8",
+  "i686-pc-windows-msvc-0.10.11": "c17f3dc3b2c47490057f17a1f0c37270f11a7b7cedf9bf2c0f841ce02bc7001b",
+  "i686-unknown-linux-gnu-0.10.11": "1ab69ff7dd104a902731758ee05b782dfd9bdb263384e61650de638f33f586df",
+  "i686-unknown-linux-musl-0.10.11": "cffb80d303fc1655e259d0b769c489f452e97425a6b6d3393d766413783a1d8c",
+  "powerpc64le-unknown-linux-gnu-0.10.11": "ddc6a20670e60219e947b1b04813be80d7e9f4c4a0234231c8ed9298eec04aa6",
+  "riscv64gc-unknown-linux-gnu-0.10.11": "c0719473cf5f8b475e917b8dfef6ae5d876b86a00a82ef91e47a02f561399f4f",
+  "s390x-unknown-linux-gnu-0.10.11": "305ee734c585918515a22fe43b7cf253c38d468771373a0c02364d67498e07b2",
+  "x86_64-apple-darwin-0.10.11": "ff90020b554cf02ef8008535c9aab6ef27bb7be6b075359300dec79c361df897",
+  "x86_64-pc-windows-msvc-0.10.11": "9ee74df98582f37fdd6069e1caac80d2616f9a489f5dbb2b1c152f30be69c58e",
+  "x86_64-unknown-linux-gnu-0.10.11": "5a360b0de092ddf4131f5313d0411b48c4e95e8107e40c3f8f2e9fcb636b3583",
+  "x86_64-unknown-linux-musl-0.10.11": "d78246139dc6cf3ed6d03c84da762686bced7ad1de67977ee372a45b95a1f6d0",
   "aarch64-apple-darwin-0.10.10": "8a09f0ef51ee7f7170731b4cb8bde5bf9ba6da5304f49a7df6cdab42a1f37b5d",
   "aarch64-pc-windows-msvc-0.10.10": "2c6fe113f14574bc27f085751c68d3485589fcc3c3c64ed85dd1eecc2f87cffc",
   "aarch64-unknown-linux-gnu-0.10.10": "2b80457b950deda12e8d5dc3b9b7494ac143eae47f1fb11b1c6e5a8495a6421e",

src/download/checksum/known-checksums.ts

@@ -1,5 +1,39 @@
 // AUTOGENERATED_DO_NOT_EDIT
 export const KNOWN_CHECKSUMS: { [key: string]: string } = {
+  "aarch64-apple-darwin-0.10.11":
+    "437a7d498dd6564d5bf986074249ba1fc600e73da55ae04d7bd4c24d5f149b95",
+  "aarch64-pc-windows-msvc-0.10.11":
+    "6a3eec4105c775dd87c11ef8ec41564648273751ff807c8955c24ddbcc636d03",
+  "aarch64-unknown-linux-gnu-0.10.11":
+    "23003df007937dd607409c8ddf010baa82bad2673e60e254632ca5b04edcce13",
+  "aarch64-unknown-linux-musl-0.10.11":
+    "5d80a7f6343d2676dfde1e5126582070a2bbc62df6f60d5527a169be3788532a",
+  "arm-unknown-linux-musleabihf-0.10.11":
+    "d3c248497c450d22a39c1d43a4a358c0c852e6056f5f49be96495eea41afb96c",
+  "armv7-unknown-linux-gnueabihf-0.10.11":
+    "7895a6470dfba051af4e74253599482fc0b37141b5d229956b383365e1a22902",
+  "armv7-unknown-linux-musleabihf-0.10.11":
+    "d2880c08acfdaef0985488972c8b14969f7139c27545046e2f6202f0e0f4d9d8",
+  "i686-pc-windows-msvc-0.10.11":
+    "c17f3dc3b2c47490057f17a1f0c37270f11a7b7cedf9bf2c0f841ce02bc7001b",
+  "i686-unknown-linux-gnu-0.10.11":
+    "1ab69ff7dd104a902731758ee05b782dfd9bdb263384e61650de638f33f586df",
+  "i686-unknown-linux-musl-0.10.11":
+    "cffb80d303fc1655e259d0b769c489f452e97425a6b6d3393d766413783a1d8c",
+  "powerpc64le-unknown-linux-gnu-0.10.11":
+    "ddc6a20670e60219e947b1b04813be80d7e9f4c4a0234231c8ed9298eec04aa6",
+  "riscv64gc-unknown-linux-gnu-0.10.11":
+    "c0719473cf5f8b475e917b8dfef6ae5d876b86a00a82ef91e47a02f561399f4f",
+  "s390x-unknown-linux-gnu-0.10.11":
+    "305ee734c585918515a22fe43b7cf253c38d468771373a0c02364d67498e07b2",
+  "x86_64-apple-darwin-0.10.11":
+    "ff90020b554cf02ef8008535c9aab6ef27bb7be6b075359300dec79c361df897",
+  "x86_64-pc-windows-msvc-0.10.11":
+    "9ee74df98582f37fdd6069e1caac80d2616f9a489f5dbb2b1c152f30be69c58e",
+  "x86_64-unknown-linux-gnu-0.10.11":
+    "5a360b0de092ddf4131f5313d0411b48c4e95e8107e40c3f8f2e9fcb636b3583",
+  "x86_64-unknown-linux-musl-0.10.11":
+    "d78246139dc6cf3ed6d03c84da762686bced7ad1de67977ee372a45b95a1f6d0",
   "aarch64-apple-darwin-0.10.10":
     "8a09f0ef51ee7f7170731b4cb8bde5bf9ba6da5304f49a7df6cdab42a1f37b5d",
   "aarch64-pc-windows-msvc-0.10.10":

src/download/download-version.ts

@@ -4,7 +4,12 @@ import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
 import * as pep440 from "@renovatebot/pep440";
 import * as semver from "semver";
-import { TOOL_CACHE_NAME, VERSIONS_NDJSON_URL } from "../utils/constants";
+import {
+  ASTRAL_MIRROR_PREFIX,
+  GITHUB_RELEASES_PREFIX,
+  TOOL_CACHE_NAME,
+  VERSIONS_NDJSON_URL,
+} from "../utils/constants";
 import type { Architecture, Platform } from "../utils/platforms";
 import { validateChecksum } from "./checksum/checksum";
 import {
@@ -48,17 +53,53 @@ export async function downloadVersionFromNdjson(
     );
   }
 
+  const mirrorUrl = rewriteToMirror(artifact.url);
+  const downloadUrl = mirrorUrl ?? artifact.url;
+  // Don't send the GitHub token to the Astral mirror.
+  const downloadToken = mirrorUrl !== undefined ? undefined : githubToken;
+
   // For the default astral-sh/versions source, checksum validation relies on
   // user input or the built-in KNOWN_CHECKSUMS table, not NDJSON sha256 values.
-  return await downloadVersion(
-    artifact.url,
-    `uv-${arch}-${platform}`,
-    platform,
-    arch,
-    version,
-    checkSum,
-    githubToken,
-  );
+  try {
+    return await downloadVersion(
+      downloadUrl,
+      `uv-${arch}-${platform}`,
+      platform,
+      arch,
+      version,
+      checkSum,
+      downloadToken,
+    );
+  } catch (err) {
+    if (mirrorUrl === undefined) {
+      throw err;
+    }
+
+    core.warning(
+      `Failed to download from mirror, falling back to GitHub Releases: ${(err as Error).message}`,
+    );
+
+    return await downloadVersion(
+      artifact.url,
+      `uv-${arch}-${platform}`,
+      platform,
+      arch,
+      version,
+      checkSum,
+      githubToken,
+    );
+  }
+}
+
+/**
+ * Rewrite a GitHub Releases URL to the Astral mirror.
+ * Returns `undefined` if the URL does not match the expected GitHub prefix.
+ */
+export function rewriteToMirror(url: string): string | undefined {
+  if (!url.startsWith(GITHUB_RELEASES_PREFIX)) {
+    return undefined;
+  }
+  return ASTRAL_MIRROR_PREFIX + url.slice(GITHUB_RELEASES_PREFIX.length);
 }
 
 export async function downloadVersionFromManifest(
@@ -99,7 +140,7 @@ async function downloadVersion(
   arch: Architecture,
   version: string,
   checksum: string | undefined,
-  githubToken: string,
+  githubToken: string | undefined,
 ): Promise<{ version: string; cachedToolDir: string }> {
   core.info(`Downloading uv from "${downloadUrl}" ...`);
   const downloadPath = await tc.downloadTool(

src/utils/constants.ts

@@ -3,3 +3,11 @@ export const STATE_UV_PATH = "uv-path";
 export const STATE_UV_VERSION = "uv-version";
 export const VERSIONS_NDJSON_URL =
   "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
+
+/** GitHub Releases URL prefix for uv artifacts. */
+export const GITHUB_RELEASES_PREFIX =
+  "https://github.com/astral-sh/uv/releases/download/";
+
+/** Astral mirror URL prefix that fronts GitHub Releases for uv artifacts. */
+export const ASTRAL_MIRROR_PREFIX =
+  "https://releases.astral.sh/github/uv/releases/download/";