chore(deps): roll up dependabot updates (#903)

Rolls up the current open Dependabot npm updates:

- #848 esbuild from 0.27.5 to 0.28.0
- #847 undici from 8.0.0 to 8.3.0
- #846 ts-jest from 29.4.9 to 29.4.11
- #841 @biomejs/biome from 2.4.10 to 2.4.15, including the matching
biome.json schema URL update

Validation:

- npm run all

.agents/skills/dependabot-pr-rollup/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: dependabot-pr-rollup
+description: Find open Dependabot PRs for the current GitHub repo, compare each PR head to its base branch, replay only the net dependency changes in a fresh worktree and branch, run npm validation, and optionally commit, push, and open a PR. Use when you want to batch or manually replicate active Dependabot updates.
+license: MIT
+compatibility: Requires git, git worktree, gh CLI auth, npm, and a GitHub repo with an origin remote.
+---
+
+# Dependabot PR Rollup
+
+## When to use
+
+Use this skill when the user wants to:
+- find all open Dependabot PRs in the current repo
+- reproduce their net effect in one local branch
+- validate the result with the repo's standard npm checks
+- optionally commit, push, and open a PR
+
+## Workflow
+
+1. Inspect the current checkout state, but do not reuse a dirty worktree.
+2. List open Dependabot PRs with `gh pr list --state open --author app/dependabot`.
+3. For each PR, collect the title, base branch, head branch, changed files, and relevant diffs.
+4. Compare each PR head against `origin/<base>` instead of trusting the PR title. Dependabot PRs can already be partially merged, superseded by newer versions, or have no remaining net effect.
+5. Create a new worktree and branch from `origin/<base>`.
+6. Reproduce only the remaining dependency changes in the new worktree.
+   - Inspect `package.json` before editing.
+   - Run `npm ci --ignore-scripts` before applying updates.
+   - Use `npm install ... --ignore-scripts` for direct dependency changes so `package-lock.json` stays in sync.
+   - When updating `@biomejs/biome`, also update the Biome schema URL version in `biome.json` to match the installed Biome version.
+7. Run `npm run all`.
+8. If requested, commit the changed source, lockfile, and generated artifacts, then push and open a PR.
+
+## Repo-specific notes
+
+- Use `gh` for GitHub operations.
+- Keep the user's original checkout untouched by working in a separate worktree.
+- In this repo, `npm run all` is the safest validation command because it runs build, check, package, and test.
+- If dependency changes affect bundled output, include the regenerated `dist/` files.
+
+## Report back
+
+Always report:
+- open Dependabot PRs found
+- which PRs required no net changes
+- new branch name
+- new worktree path
+- files changed
+- `npm run all` result
+- if applicable, commit SHA and PR URL

.github/copilot-instructions.md

@@ -1,263 +0,0 @@
-# Copilot Instructions for setup-uv
-
-This document provides essential information for GitHub Copilot coding agents working on the `astral-sh/setup-uv` repository.
-
-## Repository Overview
-
-**setup-uv** is a GitHub Action that sets up the [uv](https://docs.astral.sh/uv/)
-Python package installer in GitHub Actions workflows.
-It's a TypeScript-based action that downloads uv binaries, manages caching, handles version resolution,
-and configures the environment for subsequent workflow steps.
-
-### Key Features
-
-- Downloads and installs specific uv versions from GitHub releases
-- Supports version resolution from config files (pyproject.toml, uv.toml, .tool-versions)
-- Implements intelligent caching for both uv cache and Python installations
-- Provides cross-platform support (Linux, macOS, Windows, including ARM architectures)
-- Includes problem matchers for Python error reporting
-- Supports environment activation and custom tool directories
-
-## Repository Structure
-
-**Size**: Small-medium repository (~50 source files, ~400 total files including dependencies)
-**Languages**: TypeScript (primary), JavaScript (compiled output), JSON (configuration)
-**Runtime**: Node.js 24 (GitHub Actions runtime)
-**Key Dependencies**: @actions/core, @actions/cache, @actions/tool-cache, @octokit/core
-
-### Core Architecture
-
-```
-src/
-├── setup-uv.ts          # Main entry point and orchestration
-├── save-cache.ts        # Post-action cache saving logic
-├── update-known-versions.ts  # Maintenance script for version updates
-├── cache/               # Cache management functionality
-├── download/            # Version resolution and binary downloading
-├── utils/               # Input parsing, platform detection, configuration
-└── version/             # Version resolution from various file formats
-```
-
-### Key Files and Locations
-
-- **Action Definition**: `action.yml` - Defines all inputs/outputs and entry points
-- **Main Source**: `src/setup-uv.ts` - Primary action logic
-- **Configuration**: `biome.json` (linting), `tsconfig.json` (TypeScript), `jest.config.js` (testing)
-- **Compiled Output**: `dist/` - Contains compiled Node.js bundles (auto-generated, committed)
-- **Test Fixtures**: `__tests__/fixtures/` - Sample projects for different configuration scenarios
-- **Workflows**: `.github/workflows/test.yml` - Comprehensive CI/CD pipeline
-
-## Build and Development Process
-
-### Prerequisites
-
-- Node.js 24+ (matches GitHub Actions runtime)
-- npm (included with Node.js)
-
-### Essential Commands (ALWAYS run in this order)
-
-#### 1. Install Dependencies
-
-```bash
-npm ci --ignore-scripts
-```
-
-**Timing**: ~20-30 seconds
-**Note**: Always run this first after cloning or when package.json changes
-
-#### 2. Build TypeScript
-
-```bash
-npm run build
-```
-
-**Timing**: ~5-10 seconds
-**Purpose**: Compiles TypeScript source to JavaScript in `lib/` directory
-
-#### 3. Lint and Format Code
-
-```bash
-npm run check
-```
-
-**Timing**: ~2-5 seconds
-**Tool**: Biome (replaces ESLint/Prettier)
-**Auto-fixes**: Formatting, import organization, basic linting issues
-
-#### 4. Package for Distribution
-
-```bash
-npm run package
-```
-
-**Timing**: ~20-30 seconds
-**Purpose**: Creates bundled distributions in `dist/` using @vercel/ncc
-**Critical**: This step MUST be run before committing - the `dist/` files are used by GitHub Actions
-
-#### 5. Run Tests
-
-```bash
-npm test
-```
-
-**Timing**: ~10-15 seconds
-**Framework**: Jest with TypeScript support
-**Coverage**: Unit tests for version resolution, input parsing, checksum validation
-
-#### 6. Complete Validation (Recommended)
-
-```bash
-npm run all
-```
-
-**Timing**: ~60-90 seconds
-**Purpose**: Runs build → check → package → test in sequence
-**Use**: Before making pull requests or when unsure about build state
-
-### Important Build Notes
-
-**CRITICAL**: Always run `npm run package` after making code changes. The `dist/` directory contains the compiled bundles that GitHub Actions actually executes. Forgetting this step will cause your changes to have no effect.
-
-**TypeScript Warnings**: You may see ts-jest warnings about "isolatedModules" - these are harmless and don't affect functionality.
-
-**Biome**: This project uses Biome instead of ESLint/Prettier. Run `npm run check` to fix formatting and linting issues automatically.
-
-## Testing Strategy
-
-### Unit Tests
-
-- **Location**: `__tests__/` directory
-- **Framework**: Jest with ts-jest transformer
-- **Coverage**: Version resolution, input parsing, checksum validation, utility functions
-
-### Integration Tests
-
-- **Location**: `.github/workflows/test.yml`
-- **Scope**: Full end-to-end testing across multiple platforms and scenarios
-- **Key Test Categories**:
-  - Version installation (specific, latest, semver ranges)
-  - Cache behavior (setup, restore, invalidation)
-  - Cross-platform compatibility (Ubuntu, macOS, Windows, ARM)
-  - Configuration file parsing (pyproject.toml, uv.toml, requirements.txt)
-  - Error handling and edge cases
-
-### Test Fixtures
-
-Located in `__tests__/fixtures/`, these provide sample projects with different configurations:
-- `pyproject-toml-project/` - Standard Python project with uv version specification
-- `uv-toml-project/` - Project using uv.toml configuration
-- `requirements-txt-project/` - Legacy requirements.txt format
-- `cache-dir-defined-project/` - Custom cache directory configuration
-
-## Continuous Integration
-
-### GitHub Workflows
-
-#### Primary Test Suite (`.github/workflows/test.yml`)
-
-- **Triggers**: PRs, pushes to main, manual dispatch
-- **Matrix**: Multiple OS (Ubuntu, macOS, Windows), architecture (x64, ARM), and configuration combinations
-- **Duration**: ~5 minutes for full matrix
-- **Key Validations**:
-  - Cross-platform installation and functionality
-  - Cache behavior and performance
-  - Version resolution from various sources
-  - Tool directory configurations
-  - Problem matcher functionality
-
-#### Maintenance Workflows
-
-- **CodeQL Analysis**: Security scanning on pushes/PRs
-- **Update Known Versions**: Daily job to sync with latest uv releases
-- **Dependabot**: Automated dependency updates
-
-### Pre-commit Validation
-
-The CI runs these checks that you should run locally:
-1. `npm run all` - Complete build and test suite
-2. ActionLint - GitHub Actions workflow validation
-3. Change detection - Ensures no uncommitted build artifacts
-
-## Key Configuration Files
-
-### Action Configuration (`action.yml`)
-
-Defines 20+ inputs including version specifications,
-cache settings, tool directories, and environment options.
-This file is the authoritative source for understanding available action parameters.
-
-### TypeScript Configuration (`tsconfig.json`)
-
-- Target: ES2024
-- Module: nodenext (Node.js modules)
-- Strict mode enabled
-- Output directory: `lib/`
-
-### Linting Configuration (`biome.json`)
-
-- Formatter and linter combined
-- Enforces consistent code style
-- Automatically organizes imports and sorts object keys
-
-## Common Development Patterns
-
-### Making Code Changes
-
-1. Edit TypeScript source files in `src/`
-2. Run `npm run build` to compile
-3. Run `npm run check` to format and lint
-4. Run `npm run package` to update distribution bundles
-5. Run `npm test` to verify functionality
-6. Commit all changes including `dist/` files
-
-### Adding New Features
-
-- Follow existing patterns in `src/utils/inputs.ts` for new action inputs
-- Update `action.yml` to declare new inputs/outputs
-- Add corresponding tests in `__tests__/`
-- Add a test in `.github/workflows/test.yml` if it affects integration
-- Update README.md with usage examples
-
-### Cache-Related Changes
-
-- Cache logic is complex and affects performance significantly
-- Test with multiple cache scenarios (hit, miss, invalidation)
-- Consider impact on both GitHub-hosted and self-hosted runners
-- Validate cache key generation and dependency detection
-
-### Version Resolution Changes
-
-- Version resolution supports multiple file formats and precedence rules
-- Test with fixtures in `__tests__/fixtures/`
-- Consider backward compatibility with existing projects
-- Validate semver and PEP 440 specification handling
-
-## Troubleshooting
-
-### Build Failures
-
-- **"Module not found"**: Run `npm ci --ignore-scripts` to ensure dependencies are installed
-- **TypeScript errors**: Check `tsconfig.json` and ensure all imports are valid
-- **Test failures**: Check if test fixtures have been modified or if logic changes broke assumptions
-
-### Action Failures in Workflows
-
-- **Changes not taking effect**: Ensure `npm run package` was run and `dist/` files committed
-- **Version resolution issues**: Check version specification format and file existence
-- **Cache problems**: Verify cache key generation and dependency glob patterns
-
-### Common Gotchas
-
-- **Forgetting to package**: Code changes won't work without running `npm run package`
-- **Platform differences**: Windows paths use backslashes, test cross-platform behavior
-- **Cache invalidation**: Cache keys are sensitive to dependency file changes
-- **Tool directory permissions**: Some platforms require specific directory setups
-
-## Trust These Instructions
-
-These instructions are comprehensive and current. Only search for additional information if:
-- You encounter specific error messages not covered here
-- You need to understand implementation details of specific functions
-- The instructions appear outdated (check repository commit history)
-
-For most development tasks, following the build process and development patterns outlined above will be sufficient.

.github/release-drafter.yml

@@ -19,7 +19,7 @@ categories:
     labels:
       - "maintenance"
       - "ci"
-      - "update-known-versions"
+      - "update-known-checksums"
   - title: "📚 Documentation"
     labels:
       - "documentation"

.github/scripts/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "compilerOptions": {
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "target": "es2022",
+    "types": ["node"]
+  },
+  "include": ["check-all-tests-passed-needs.ts"]
+}

.github/workflows/codeql-analysis.yml

@@ -41,13 +41,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           languages: ${{ matrix.language }}
           source-root: src
@@ -59,7 +59,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0

.github/workflows/release-drafter.yml

@@ -19,6 +19,8 @@ jobs:
       pull-requests: read
     steps:
       - name: 🚀 Run Release Drafter
-        uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
+        uses: release-drafter/release-drafter@693d20e7c1ce1a81d3a41962f85914253b518449 # v7.3.1
+        with:
+          commitish: ${{ github.sha }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,113 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version (e.g., 8.1.0)"
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  validate-release:
+    name: Validate release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Validate version and draft release
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version }}
+          TAG: v${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Version must match MAJOR.MINOR.PATCH (e.g., 8.1.0)"
+            exit 1
+          fi
+
+          RELEASE_JSON=$(gh release view "$TAG" --json isDraft,targetCommitish 2>&1) || {
+            echo "::error::No release found for $TAG"
+            exit 1
+          }
+
+          IS_DRAFT=$(echo "$RELEASE_JSON" | jq -r '.isDraft')
+          TARGET=$(echo "$RELEASE_JSON" | jq -r '.targetCommitish')
+
+          if [[ "$IS_DRAFT" != "true" ]]; then
+            echo "::error::Release $TAG already exists and is not a draft"
+            exit 1
+          fi
+
+          if [[ "$TARGET" != "$GITHUB_SHA" ]]; then
+            echo "::error::Draft release target ($TARGET) does not match current commit ($GITHUB_SHA)"
+            exit 1
+          fi
+
+  release-gate:
+    # N.B. This name should not change, it is used for downstream checks.
+    name: release-gate
+    needs:
+      - validate-release
+    runs-on: ubuntu-latest
+    environment:
+      name: release-gate
+    steps:
+      - run: echo "Release approved"
+
+  create-deployment:
+    name: create-deployment
+    needs:
+      - validate-release
+      - release-gate
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    steps:
+      - run: echo "Release deployment created"
+
+  release:
+    name: Release
+    needs:
+      - validate-release
+      - release-gate
+      - create-deployment
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Publish release
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version }}
+          TAG: v${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Version must match MAJOR.MINOR.PATCH (e.g., 8.1.0)"
+            exit 1
+          fi
+
+          RELEASE_JSON=$(gh release view "$TAG" --json isDraft,targetCommitish 2>&1) || {
+            echo "::error::No release found for $TAG"
+            exit 1
+          }
+
+          IS_DRAFT=$(echo "$RELEASE_JSON" | jq -r '.isDraft')
+          TARGET=$(echo "$RELEASE_JSON" | jq -r '.targetCommitish')
+
+          if [[ "$IS_DRAFT" != "true" ]]; then
+            echo "::error::Release $TAG already exists and is not a draft"
+            exit 1
+          fi
+
+          if [[ "$TARGET" != "$GITHUB_SHA" ]]; then
+            echo "::error::Draft release target ($TARGET) does not match current commit ($GITHUB_SHA)"
+            exit 1
+          fi
+
+          echo "Publishing draft release $TAG"
+          gh release edit "$TAG" --draft=false

.github/workflows/test.yml

@@ -21,14 +21,14 @@ jobs:
     permissions:
       security-events: write # for zizmor
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Actionlint
-        uses: eifinger/actionlint-action@213860089b7cf97d640aa67567898fabeb132746 # v1.9.3
+        uses: eifinger/actionlint-action@1fc89649be682d16ec5cf65ea16e269eb88d3982 # v1.10.2
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -38,7 +38,7 @@ jobs:
           npm run all
       - name: Check all jobs are in all-tests-passed.needs
         run: |
-          tsc check-all-tests-passed-needs.ts
+          tsc -p tsconfig.json
           node check-all-tests-passed-needs.js
         working-directory: .github/scripts
       - name: Make sure no changes from linters are detected
@@ -51,7 +51,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, macos-14, windows-latest]
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install latest version
@@ -76,7 +76,7 @@ jobs:
   test-uv-no-modify-path:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install with UV_NO_MODIFY_PATH set
@@ -125,7 +125,7 @@ jobs:
             expected-version: "0.1.0"
             resolution-strategy: "lowest"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install version ${{ matrix.input.version-input }} with strategy ${{ matrix.input.resolution-strategy || 'highest' }}
@@ -154,7 +154,7 @@ jobs:
       matrix:
         version-input: ["latest", ">=0.8"]
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install version ${{ matrix.version-input }}
@@ -164,10 +164,22 @@ jobs:
       - name: Latest version gets installed
         run: |
           LATEST_VERSION=$(gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/astral-sh/uv/releases/latest | jq -r '.tag_name')
+          UV_VERSION_OUTPUT=$(uv --version)
+
+          if [[ ! "$UV_VERSION_OUTPUT" =~ ^uv[[:space:]]+([^[:space:]]+) ]]; then
+            echo "Could not parse uv version from: $UV_VERSION_OUTPUT"
+            exit 1
+          fi
+
+          UV_VERSION="${BASH_REMATCH[1]}"
+
           echo "Latest version is $LATEST_VERSION"
-          if [ "$(uv --version)" != "uv $LATEST_VERSION" ]; then
-              echo "Wrong uv version: $(uv --version)"
-              exit 1
+          echo "uv --version output is $UV_VERSION_OUTPUT"
+          echo "Parsed uv version is $UV_VERSION"
+
+          if [ "$UV_VERSION" != "$LATEST_VERSION" ]; then
+            echo "Wrong uv version: $UV_VERSION_OUTPUT"
+            exit 1
           fi
         env:
           GH_TOKEN: ${{ github.token }}
@@ -182,7 +194,7 @@ jobs:
           - working-directory: "__tests__/fixtures/uv-toml-project"
             expected-version: "0.5.15"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install version from ${{ matrix.input.working-directory }}
@@ -208,7 +220,7 @@ jobs:
           - version-file: "__tests__/fixtures/.tool-versions"
             expected-version: "0.5.15"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install version from ${{ matrix.input.version-file }}
@@ -225,7 +237,7 @@ jobs:
   test-malformed-pyproject-file-fallback:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install using malformed pyproject.toml
@@ -245,7 +257,7 @@ jobs:
           - os: macos-latest
             checksum: "a70cbfbf3bb5c08b2f84963b4f12c94e08fbb2468ba418a3bfe1066fbe9e7218"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Checksum matches expected
@@ -259,7 +271,7 @@ jobs:
   test-with-explicit-token:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install default version
@@ -272,7 +284,7 @@ jobs:
   test-uvx:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install default version
@@ -285,7 +297,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, macos-14, windows-latest]
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install default version
@@ -293,35 +305,13 @@ jobs:
       - run: uv tool install ruff
       - run: ruff --version
 
-  test-tilde-expansion-tool-dirs:
-    runs-on: selfhosted-ubuntu-arm64
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-      - name: Setup with cache
-        uses: ./
-        with:
-          tool-bin-dir: "~/tool-bin-dir"
-          tool-dir: "~/tool-dir"
-      - name: "Check if tool dirs are expanded"
-        run: |
-          if ! echo "$PATH" | grep -q "/home/ubuntu/tool-bin-dir"; then
-              echo "PATH does not contain /home/ubuntu/tool-bin-dir: $PATH"
-              exit 1
-          fi
-          if [ "$UV_TOOL_DIR" != "/home/ubuntu/tool-dir" ]; then
-              echo "UV_TOOL_DIR does not contain /home/ubuntu/tool-dir: $UV_TOOL_DIR"
-              exit 1
-          fi
-
   test-python-version:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install latest version
@@ -353,7 +343,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install latest version
@@ -386,11 +376,122 @@ jobs:
         env:
           UV_VENV: ${{ steps.setup-uv.outputs.venv }}
 
+  test-activate-environment-custom-path:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install latest version
+        id: setup-uv
+        uses: ./
+        with:
+          python-version: 3.13.1t
+          activate-environment: true
+          venv-path: ${{ runner.temp }}/custom-venv
+      - name: Verify VIRTUAL_ENV matches output
+        run: |
+          if [ "$VIRTUAL_ENV" != "$UV_VENV" ]; then
+            echo "VIRTUAL_ENV does not match venv output: $VIRTUAL_ENV vs $UV_VENV"
+            exit 1
+          fi
+        shell: bash
+        env:
+          UV_VENV: ${{ steps.setup-uv.outputs.venv }}
+      - name: Verify venv location is runner.temp/custom-venv
+        run: |
+          python - <<'PY'
+          import os
+          from pathlib import Path
+
+          venv = Path(os.environ["VIRTUAL_ENV"]).resolve()
+          temp = Path(os.environ["RUNNER_TEMP"]).resolve()
+
+          if venv.name != "custom-venv":
+              raise SystemExit(f"Expected venv name 'custom-venv', got: {venv}")
+          if venv.parent != temp:
+              raise SystemExit(f"Expected venv under {temp}, got: {venv}")
+          if not venv.is_dir():
+              raise SystemExit(f"Venv directory does not exist: {venv}")
+          PY
+        shell: bash
+      - name: Verify packages can be installed
+        run: uv pip install pip
+        shell: bash
+      - name: Verify python runs from custom venv
+        run: |
+          python - <<'PY'
+          import sys
+          if "custom-venv" not in sys.executable:
+              raise SystemExit(f"Python is not running from custom venv: {sys.executable}")
+          PY
+        shell: bash
+
+  test-activate-environment-no-project:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Create incompatible pyproject.toml
+        run: |
+          cat > pyproject.toml <<'EOF'
+          [project]
+          name = "test-no-project"
+          version = "0.1.0"
+
+          [dependency-groups]
+          dev = [
+              "-e file:///${PROJECT_ROOT}/projects/pkg",
+          ]
+          EOF
+        shell: bash
+      - name: Install latest version with no-project
+        id: setup-uv
+        uses: ./
+        with:
+          python-version: 3.13.1t
+          activate-environment: true
+          no-project: true
+      - name: Verify packages can be installed
+        run: uv pip install pip
+        shell: bash
+      - name: Verify output venv is set
+        run: |
+          if [ -z "$UV_VENV" ]; then
+            echo "output venv is not set"
+            exit 1
+          fi
+          if [ ! -d "$UV_VENV" ]; then
+            echo "output venv not point to a directory: $UV_VENV"
+            exit 1
+          fi
+        shell: bash
+        env:
+          UV_VENV: ${{ steps.setup-uv.outputs.venv }}
+
+  test-debian-unstable:
+    runs-on: ubuntu-latest
+    container: debian:unstable
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install latest version
+        uses: ./
+        with:
+          enable-cache: true
+      - run: uv sync
+        working-directory: __tests__/fixtures/uv-project
+
   test-musl:
     runs-on: ubuntu-latest
     container: alpine
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install latest version
@@ -429,7 +530,7 @@ jobs:
           - os: windows-2025
             expected-os: "windows-2025"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup uv
@@ -453,9 +554,9 @@ jobs:
     strategy:
       matrix:
         enable-cache: ["true", "false", "auto"]
-        os: ["ubuntu-latest", "selfhosted-ubuntu-arm64", "windows-latest"]
+        os: ["ubuntu-latest", "windows-latest"]
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup with cache
@@ -471,10 +572,10 @@ jobs:
     strategy:
       matrix:
         enable-cache: ["true", "false", "auto"]
-        os: ["ubuntu-latest", "selfhosted-ubuntu-arm64", "windows-latest"]
+        os: ["ubuntu-latest", "windows-latest"]
     needs: test-setup-cache
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Restore with cache
@@ -493,7 +594,7 @@ jobs:
           CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
         shell: bash
       - name: Cache was not hit
-        if: ${{ matrix.enable-cache == 'false' || (matrix.enable-cache == 'auto' && matrix.os == 'selfhosted-ubuntu-arm64') }}
+        if: ${{ matrix.enable-cache == 'false' }}
         run: |
           if [ "$CACHE_HIT" == "true" ]; then
             exit 1
@@ -508,7 +609,7 @@ jobs:
   test-setup-cache-requirements-txt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup with cache
@@ -524,7 +625,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test-setup-cache-requirements-txt
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Restore with cache
@@ -548,7 +649,7 @@ jobs:
   test-setup-cache-dependency-glob:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup with cache
@@ -565,7 +666,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test-setup-cache-dependency-glob
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Change pyproject.toml
@@ -593,7 +694,7 @@ jobs:
   test-setup-cache-save-cache-false:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup with cache
@@ -609,7 +710,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test-setup-cache-save-cache-false
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Restore with cache
@@ -629,7 +730,7 @@ jobs:
   test-setup-cache-restore-cache-false:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup with cache
@@ -644,7 +745,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test-setup-cache-restore-cache-false
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Restore with cache
@@ -670,11 +771,9 @@ jobs:
             expected-cache-dir: "/home/runner/work/_temp/setup-uv-cache"
           - os: windows-latest
             expected-cache-dir: "D:\\a\\_temp\\setup-uv-cache"
-          - os: selfhosted-ubuntu-arm64
-            expected-cache-dir: "/home/ubuntu/.cache/uv"
     runs-on: ${{ matrix.inputs.os }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup with cache
@@ -692,7 +791,7 @@ jobs:
   test-cache-local-cache-disabled:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup without cache
@@ -711,7 +810,7 @@ jobs:
   test-cache-local-cache-disabled-but-explicit-path:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup without cache
@@ -728,99 +827,10 @@ jobs:
           fi
         shell: bash
 
-  test-setup-cache-local:
-    runs-on: selfhosted-ubuntu-arm64
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-      - name: Setup with cache
-        uses: ./
-        with:
-          enable-cache: true
-          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-local
-          cache-local-path: /tmp/uv-cache
-      - run: uv sync
-        working-directory: __tests__/fixtures/uv-project
-  test-restore-cache-local:
-    runs-on: selfhosted-ubuntu-arm64
-    needs: test-setup-cache-local
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-      - name: Restore with cache
-        id: restore
-        uses: ./
-        with:
-          enable-cache: true
-          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-local
-          cache-local-path: /tmp/uv-cache
-      - name: Cache was hit
-        run: |
-          if [ "$CACHE_HIT" != "true" ]; then
-            exit 1
-          fi
-        env:
-          CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
-      - run: uv sync
-        working-directory: __tests__/fixtures/uv-project
-
-  test-tilde-expansion-cache-local-path:
-    runs-on: selfhosted-ubuntu-arm64
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-      - name: Create cache directory
-        run: mkdir -p ~/uv-cache
-        shell: bash
-      - name: Setup with cache
-        uses: ./
-        with:
-          cache-local-path: ~/uv-cache/cache-local-path
-      - run: uv sync
-        working-directory: __tests__/fixtures/uv-project
-
-  test-tilde-expansion-cache-dependency-glob:
-    runs-on: selfhosted-ubuntu-arm64
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-      - name: Create cache directory
-        run: mkdir -p ~/uv-cache
-        shell: bash
-      - name: Create cache dependency glob file
-        run: touch ~/uv-cache.glob
-        shell: bash
-      - name: Setup with cache
-        uses: ./
-        with:
-          enable-cache: true
-          cache-local-path: ~/uv-cache/cache-dependency-glob
-          cache-dependency-glob: "~/uv-cache.glob"
-      - run: uv sync
-        working-directory: __tests__/fixtures/uv-project
-
-  cleanup-tilde-expansion-tests:
-    needs:
-      - test-tilde-expansion-cache-local-path
-      - test-tilde-expansion-cache-dependency-glob
-    if: always()
-    runs-on: selfhosted-ubuntu-arm64
-    steps:
-      - name: Remove cache directory
-        run: rm -rf ~/uv-cache
-        shell: bash
-      - name: Remove cache dependency glob file
-        run: rm -f ~/uv-cache.glob
-        shell: bash
-
   test-no-python-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Fake pyproject.toml at root
@@ -835,26 +845,40 @@ jobs:
   test-custom-manifest-file:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install from custom manifest file
         uses: ./
         with:
-          manifest-file: "https://raw.githubusercontent.com/astral-sh/setup-uv/${{ github.ref }}/__tests__/download/custom-manifest.json"
+          manifest-file: "https://raw.githubusercontent.com/astral-sh/setup-uv/${{ github.ref }}/__tests__/download/custom-manifest.ndjson"
       - run: uv sync
         working-directory: __tests__/fixtures/uv-project
       - name: Correct version gets installed
         run: |
-          if [ "$(uv --version)" != "uv 0.7.12-alpha.1" ]; then
+          if [ "$(uv --version)" != "uv 0.9.26" ]; then
             echo "Wrong uv version: $(uv --version)"
             exit 1
           fi
 
+  test-download-from-astral-mirror-false:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install with download-from-astral-mirror disabled
+        id: setup-uv
+        uses: ./
+        with:
+          download-from-astral-mirror: false
+      - name: Verify uv is installed
+        run: uv --version
+
   test-absolute-path:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Create requirements.txt
@@ -874,7 +898,7 @@ jobs:
   test-relative-path:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: mkdir
@@ -898,7 +922,7 @@ jobs:
   test-cache-prune-force:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Setup uv
@@ -915,7 +939,7 @@ jobs:
   test-cache-dir-from-file:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Verify uv cache dir is not populated
@@ -937,10 +961,33 @@ jobs:
             exit 1
           fi
 
+  test-cache-python-missing-managed-install-dir:
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON_INSTALL_DIR: /tmp/missing-uv-python
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Setup uv with cache and python cache enabled
+        uses: ./
+        with:
+          enable-cache: true
+          cache-python: true
+          python-version: "3.12"
+          cache-local-path: /tmp/setup-uv-cache
+          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-cache-python-missing-managed-install-dir
+      - name: Ensure uv cache dir exists so only python-cache behavior is tested
+        run: uv sync
+        working-directory: __tests__/fixtures/uv-project
+        shell: bash
+      - name: Ensure managed Python install dir does not exist and this does not break caching
+        run: rm -rf "$UV_PYTHON_INSTALL_DIR"
+
   test-cache-python-installs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Verify Python install dir is not populated
@@ -967,7 +1014,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test-cache-python-installs
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Verify Python install dir does not exist
@@ -1007,11 +1054,9 @@ jobs:
             expected-python-dir: "/home/runner/work/_temp/uv-python-dir"
           - os: windows-latest
             expected-python-dir: "D:\\a\\_temp\\uv-python-dir"
-          - os: selfhosted-ubuntu-arm64
-            expected-python-dir: "/home/ubuntu/.local/share/uv/python"
     runs-on: ${{ matrix.inputs.os }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install latest version
@@ -1030,7 +1075,7 @@ jobs:
   test-act:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install act
@@ -1045,11 +1090,11 @@ jobs:
   validate-typings:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Validate typings
-        uses: typesafegithub/github-actions-typing@184d97003b1300f6a10e286eb98c191e416ff02b # v2.2.1
+        uses: typesafegithub/github-actions-typing@9ddf35b71a482be7d8922b28e8d00df16b77e315 # v2.2.2
 
   all-tests-passed:
     runs-on: ubuntu-latest
@@ -1066,9 +1111,11 @@ jobs:
       - test-with-explicit-token
       - test-uvx
       - test-tool-install
-      - test-tilde-expansion-tool-dirs
       - test-python-version
       - test-activate-environment
+      - test-activate-environment-custom-path
+      - test-activate-environment-no-project
+      - test-debian-unstable
       - test-musl
       - test-cache-key-os-version
       - test-cache-local
@@ -1084,17 +1131,14 @@ jobs:
       - test-restore-cache-save-cache-false
       - test-setup-cache-restore-cache-false
       - test-restore-cache-restore-cache-false
-      - test-setup-cache-local
-      - test-restore-cache-local
-      - test-tilde-expansion-cache-local-path
-      - test-tilde-expansion-cache-dependency-glob
-      - cleanup-tilde-expansion-tests
       - test-no-python-version
       - test-custom-manifest-file
+      - test-download-from-astral-mirror-false
       - test-absolute-path
       - test-relative-path
       - test-cache-prune-force
       - test-cache-dir-from-file
+      - test-cache-python-missing-managed-install-dir
       - test-cache-python-installs
       - test-restore-python-installs
       - test-python-install-dir

.github/workflows/update-docs.yml

@@ -0,0 +1,69 @@
+name: "Update docs"
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions: {}
+
+jobs:
+  update-docs:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: true
+      - name: Get tag info
+        id: tag-info
+        run: |
+          TAG_NAME="${GITHUB_REF#refs/tags/}"
+          COMMIT_SHA=$(git rev-list -n 1 "$TAG_NAME")
+          echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
+          echo "sha=$COMMIT_SHA" >> "$GITHUB_OUTPUT"
+      - name: Update references in docs
+        run: |
+          OLD_REF=$(grep -oh 'astral-sh/setup-uv@[a-f0-9]\{40\} # v[0-9][^ ]*' README.md docs/*.md | head -1)
+          OLD_SHA=$(echo "$OLD_REF" | sed 's/astral-sh\/setup-uv@\([a-f0-9]*\) # .*/\1/')
+          OLD_VERSION=$(echo "$OLD_REF" | sed 's/astral-sh\/setup-uv@[a-f0-9]* # \(v[^ ]*\)/\1/')
+          echo "Replacing $OLD_SHA # $OLD_VERSION with $NEW_SHA # $NEW_VERSION"
+          find README.md docs/ -type f \( -name "*.md" \) -exec \
+            sed -i "s|$OLD_SHA # $OLD_VERSION|$NEW_SHA # $NEW_VERSION|g" {} +
+        env:
+          NEW_SHA: ${{ steps.tag-info.outputs.sha }}
+          NEW_VERSION: ${{ steps.tag-info.outputs.tag }}
+      - name: Check for changes
+        id: changes-exist
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+              echo "changes-exist=true" >> "$GITHUB_OUTPUT"
+          else
+              echo "changes-exist=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Commit and push changes
+        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
+        id: commit-and-push
+        continue-on-error: true
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+          git add .
+          git commit -m "docs: update version references to $NEW_VERSION"
+          git push origin HEAD:refs/heads/main
+        env:
+          NEW_VERSION: ${{ steps.tag-info.outputs.tag }}
+      - name: Create Pull Request
+        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' && steps.commit-and-push.outcome != 'success' }}
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          commit-message: "docs: update version references to ${{ steps.tag-info.outputs.tag }}"
+          title: "docs: update version references to ${{ steps.tag-info.outputs.tag }}"
+          body: |
+            Update `uses: astral-sh/setup-uv@...` references in documentation to
+            `${{ steps.tag-info.outputs.sha }} # ${{ steps.tag-info.outputs.tag }}`.
+          base: main
+          labels: "automated-pr,update-docs"
+          branch: update-docs-${{ steps.tag-info.outputs.tag }}
+          delete-branch: true

.github/workflows/update-known-checksums.yml

@@ -1,4 +1,4 @@
-name: "Update known versions"
+name: "Update known checksums"
 on:
   workflow_dispatch:
   schedule:
@@ -15,19 +15,18 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: true
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
-      - name: Update known versions
-        id: update-known-versions
+          node-version-file: .nvmrc
+          cache: npm
+      - name: Update known checksums
+        id: update-known-checksums
         run:
-          node dist/update-known-versions/index.js
+          node dist/update-known-checksums/index.cjs
           src/download/checksum/known-checksums.ts
-          version-manifest.json
-          ${{ secrets.GITHUB_TOKEN }}
       - name: Check for changes
         id: changes-exist
         run: |
@@ -48,23 +47,23 @@ jobs:
           git config user.name "$GITHUB_ACTOR"
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
           git add .
-          git commit -m "chore: update known versions for $LATEST_VERSION"
+          git commit -m "chore: update known checksums for $LATEST_VERSION"
           git push origin HEAD:refs/heads/main
         env:
-          LATEST_VERSION: ${{ steps.update-known-versions.outputs.latest-version }}
+          LATEST_VERSION: ${{ steps.update-known-checksums.outputs.latest-version }}
 
       - name: Create Pull Request
         if: ${{ steps.changes-exist.outputs.changes-exist == 'true' && steps.commit-and-push.outcome != 'success' }}
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: "chore: update known checksums"
           title:
             "chore: update known checksums for ${{
-            steps.update-known-versions.outputs.latest-version }}"
+            steps.update-known-checksums.outputs.latest-version }}"
           body:
             "chore: update known checksums for ${{
-            steps.update-known-versions.outputs.latest-version }}"
+            steps.update-known-checksums.outputs.latest-version }}"
           base: main
-          labels: "automated-pr,update-known-versions"
-          branch: update-known-versions-pr
+          labels: "automated-pr,update-known-checksums"
+          branch: update-known-checksums-pr
           delete-branch: true

.github/workflows/update-major-minor-tags.yml

@@ -1,51 +0,0 @@
----
-name: Update Major Minor Tags
-
-on:
-  push:
-    branches-ignore:
-      - "**"
-    tags:
-      - "v*.*.*"
-
-permissions: {}
-
-jobs:
-  update_major_minor_tags:
-    name: Make sure major and minor tags are up to date on a patch release
-    runs-on: ubuntu-24.04-arm
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: true # needed for git push below
-      - name: Update Major Minor Tags
-        run: |
-          set -x
-
-          cd "${GITHUB_WORKSPACE}" || exit
-
-          # Set up variables.
-          TAG="${GITHUB_REF#refs/tags/}" # v1.2.3
-          MINOR="${TAG%.*}"              # v1.2
-          MAJOR="${MINOR%.*}"            # v1
-
-          if [ "${GITHUB_REF}" = "${TAG}" ]; then
-            echo "This workflow is not triggered by tag push: GITHUB_REF=${GITHUB_REF}"
-            exit 1
-          fi
-
-          MESSAGE="Release ${TAG}"
-
-          # Set up Git.
-          git config user.name "${GITHUB_ACTOR}"
-          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
-
-          # Update MAJOR/MINOR tag
-          git tag -fa "${MAJOR}" -m "${MESSAGE}"
-          git tag -fa "${MINOR}" -m "${MESSAGE}"
-
-          # Push
-          git push --force origin "${MINOR}"
-          git push --force origin "${MAJOR}"

AGENTS.md

@@ -1 +0,0 @@
-.github/copilot-instructions.md

AGENTS.md

@@ -0,0 +1,18 @@
+# setup-uv agent notes
+
+This repository is a TypeScript-based GitHub Action for installing `uv` in GitHub Actions workflows. It also supports restoring/saving the `uv` cache and optional managed-Python caching.
+
+- The published action runs the committed bundles in `dist/`, not the TypeScript in `src/`. After any code change, run `npm run package` and commit the resulting `dist/` updates.
+- Standard local validation is:
+  1. `npm ci --ignore-scripts`
+  2. `npm run all`
+- `npm run check` uses Biome (not ESLint/Prettier) and rewrites files in place.
+- User-facing changes are usually multi-file changes. If you add or change inputs, outputs, or behavior, update `action.yml`, `action-types.yml`, the implementation in `src/`, tests in `__tests__/`, relevant docs/README, and then re-package.
+- The easiest areas to regress are version resolution and caching. When touching them, add or update tests for precedence, cache invalidation, and cross-platform path behavior.
+- Workflow edits have extra CI-only checks (`actionlint` and `zizmor`); `npm run all` does not cover them.
+- Source is authored with bundler-friendly TypeScript, but published action artifacts in `dist/` are bundled as CommonJS for maximum GitHub Actions runtime compatibility with `@actions/*` dependencies.
+- Keep these concerns separate when changing module formats:
+  - `src/` and tests may use modern ESM-friendly TypeScript patterns.
+  - `dist/` should prioritize runtime reliability over format purity.
+  - Do not switch published bundles to ESM without validating the actual committed artifacts under the target Node runtime.
+- Before finishing, make sure validation does not leave generated or formatting-only diffs behind.

README.md

@@ -26,7 +26,7 @@ Set up your GitHub Actions workflow with a specific version of [uv](https://docs
 
 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 ```
 
 If you do not specify a version, this action will look for a [required-version](https://docs.astral.sh/uv/reference/settings/#required-version)
@@ -42,7 +42,7 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed
 
 ```yaml
 - name: Install uv with all available options
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     # The version of uv to install (default: searches for version in config files, then latest)
     version: ""
@@ -59,13 +59,19 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed
     # Use uv venv to activate a venv ready to be used by later steps
     activate-environment: "false"
 
+    # Custom path for the virtual environment when using activate-environment (default: .venv in the working directory)
+    venv-path: ""
+
+    # Pass --no-project when creating the venv with activate-environment.
+    no-project: "false"
+
     # The directory to execute all commands in and look for files such as pyproject.toml
     working-directory: ""
 
     # The checksum of the uv version to install
     checksum: ""
 
-    # Used to increase the rate limit when retrieving versions and downloading uv
+    # Used when downloading uv from GitHub releases
     github-token: ${{ github.token }}
 
     # Enable uploading of the uv cache: true, false, or auto (enabled on GitHub-hosted runners, disabled on self-hosted runners)
@@ -111,11 +117,17 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed
     # Custom path to set UV_TOOL_BIN_DIR to
     tool-bin-dir: ""
 
-    # URL to the manifest file containing available versions and download URLs
+    # URL to a custom manifest file in the astral-sh/versions format
     manifest-file: ""
 
+    # Download uv from the Astral mirror instead of directly from GitHub Releases
+    download-from-astral-mirror: "true"
+
     # Add problem matchers
     add-problem-matchers: "true"
+
+    # Suppress info-level log output. Only warnings and errors are shown
+    quiet: "false"
 ```
 
 ### Outputs
@@ -136,7 +148,7 @@ This will override any python version specifications in `pyproject.toml` and `.p
 
 ```yaml
 - name: Install the latest version of uv and set the python version to 3.13t
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     python-version: 3.13t
 - run: uv pip install --python=3.13t pip
@@ -154,7 +166,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - name: Install the latest version of uv and set the python version
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Test with python ${{ matrix.python-version }}
@@ -167,11 +179,11 @@ You can set the working directory with the `working-directory` input.
 This controls where we look for `pyproject.toml`, `uv.toml` and `.python-version` files
 which are used to determine the version of uv and python to install.
 
-It also controls where [the venv gets created](#activate-environment).
+It also controls where [the venv gets created](#activate-environment), unless `venv-path` is set.
 
 ```yaml
 - name: Install uv based on the config files in the working-directory
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     working-directory: my/subproject/dir
 ```
@@ -187,10 +199,12 @@ For more advanced configuration options, see our detailed documentation:
 
 ## How it works
 
-This action downloads uv from the uv repo's official
-[GitHub Releases](https://github.com/astral-sh/uv) and uses the
-[GitHub Actions Toolkit](https://github.com/actions/toolkit) to cache it as a tool to speed up
-consecutive runs on self-hosted runners.
+By default, this action resolves uv versions from the
+[`astral-sh/versions`](https://github.com/astral-sh/versions) manifest and downloads uv from the
+official [GitHub Releases](https://github.com/astral-sh/uv).
+
+It then uses the [GitHub Actions Toolkit](https://github.com/actions/toolkit) to cache uv as a
+tool to speed up consecutive runs on self-hosted runners.
 
 The installed version of uv is then added to the runner PATH, enabling later steps to invoke it
 by name (`uv`).
@@ -202,7 +216,8 @@ by name (`uv`).
 With `setup-uv`, you can install a specific version of Python using `uv python install` rather than
 relying on `actions/setup-python`.
 
-Using `actions/setup-python` can be faster, because GitHub caches the Python versions alongside the runner.
+Using `actions/setup-python` can be faster (~1s), because GitHub includes several Python versions in the runner image
+which are available to get activated by `actions/setup-python` without having to download them.
 
 For example:
 
@@ -210,7 +225,7 @@ For example:
 - name: Checkout the repository
   uses: actions/checkout@main
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
 - name: Test
@@ -222,7 +237,7 @@ To install a specific version of Python, use
 
 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
 - name: Install Python 3.12
@@ -241,7 +256,7 @@ output:
   uses: actions/checkout@main
 - name: Install the default version of uv
   id: setup-uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 - name: Print the installed version
   run: echo "Installed uv version is ${{ steps.setup-uv.outputs.uv-version }}"
 ```
@@ -275,7 +290,7 @@ the cache will not be found and the warning `No GitHub Actions cache found for k
 While this might be irritating at first, it is expected behaviour and the cache will be created
 and reused in later workflows.
 
-The reason for the warning is, that we have to way to know if this is the first run of a new
+The reason for the warning is that we have to way to know if this is the first run of a new
 cache key or the user accidentally misconfigured the cache-dependency-glob
 or cache-suffix (see [Caching documentation](docs/caching.md)) and the cache never gets used.
 
@@ -288,7 +303,7 @@ Running `actions/checkout` after `setup-uv` **is not supported**.
 
 ### Does `setup-uv` also install my project or its dependencies automatically?
 
-No, `setup-uv` alone wont install any libraries from your `pyproject.toml` or `requirements.txt`, it only sets up `uv`.
+No, `setup-uv` alone won't install any libraries from your `pyproject.toml` or `requirements.txt`, it only sets up `uv`.
 You should run `uv sync` or `uv pip install .` separately, or use `uv run ...` to ensure necessary dependencies are installed.
 
 ### Why is a changed cache not detected and not the full cache uploaded?

__tests__/download/checksum/checksum.test.ts

@@ -4,10 +4,11 @@ import {
   validateChecksum,
 } from "../../../src/download/checksum/checksum";
 
+const validChecksum =
+  "f3da96ec7e995debee7f5d52ecd034dfb7074309a1da42f76429ecb814d813a3";
+const filePath = "__tests__/fixtures/checksumfile";
+
 test("checksum should match", async () => {
-  const validChecksum =
-    "f3da96ec7e995debee7f5d52ecd034dfb7074309a1da42f76429ecb814d813a3";
-  const filePath = "__tests__/fixtures/checksumfile";
   // string params don't matter only test the checksum mechanism, not known checksums
   await validateChecksum(
     validChecksum,
@@ -18,6 +19,16 @@ test("checksum should match", async () => {
   );
 });
 
+test("provided checksum beats known checksums", async () => {
+  await validateChecksum(
+    validChecksum,
+    filePath,
+    "x86_64",
+    "unknown-linux-gnu",
+    "0.3.0",
+  );
+});
+
 type KnownVersionFixture = { version: string; known: boolean };
 
 it.each<KnownVersionFixture>([

__tests__/download/custom-manifest.json

@@ -1,9 +0,0 @@
-[
-  {
-    "arch": "x86_64",
-    "artifactName": "uv-x86_64-unknown-linux-gnu.tar.gz",
-    "downloadUrl": "https://release.pyx.dev/0.7.12-alpha.1/uv-x86_64-unknown-linux-gnu.tar.gz",
-    "platform": "unknown-linux-gnu",
-    "version": "0.7.12-alpha.1"
-  }
-]

__tests__/download/custom-manifest.ndjson

@@ -0,0 +1 @@
+{"version":"0.9.26","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"30ccbf0a66dc8727a02b0e245c583ee970bdafecf3a443c1686e1b30ec4939e8"}]}

__tests__/download/download-version.test.ts

@@ -0,0 +1,430 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import * as semver from "semver";
+
+const mockInfo = jest.fn();
+const mockWarning = jest.fn();
+
+jest.unstable_mockModule("@actions/core", () => ({
+  debug: jest.fn(),
+  info: mockInfo,
+  warning: mockWarning,
+}));
+
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockDownloadTool = jest.fn<any>();
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockExtractTar = jest.fn<any>();
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockExtractZip = jest.fn<any>();
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockCacheDir = jest.fn<any>();
+
+jest.unstable_mockModule("@actions/tool-cache", () => ({
+  cacheDir: mockCacheDir,
+  downloadTool: mockDownloadTool,
+  evaluateVersions: (versions: string[], range: string) =>
+    semver.maxSatisfying(versions, range) ?? "",
+  extractTar: mockExtractTar,
+  extractZip: mockExtractZip,
+  find: () => "",
+  findAllVersions: () => [],
+  isExplicitVersion: (version: string) => semver.valid(version) !== null,
+}));
+
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockGetLatestVersion = jest.fn<any>();
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockGetAllVersions = jest.fn<any>();
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockGetArtifact = jest.fn<any>();
+
+jest.unstable_mockModule("../../src/download/manifest", () => ({
+  getAllVersions: mockGetAllVersions,
+  getArtifact: mockGetArtifact,
+  getLatestVersion: mockGetLatestVersion,
+}));
+
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockValidateChecksum = jest.fn<any>();
+
+jest.unstable_mockModule("../../src/download/checksum/checksum", () => ({
+  validateChecksum: mockValidateChecksum,
+}));
+
+const { downloadVersion, resolveVersion, rewriteToMirror } = await import(
+  "../../src/download/download-version"
+);
+
+describe("download-version", () => {
+  beforeEach(() => {
+    mockInfo.mockReset();
+    mockWarning.mockReset();
+    mockDownloadTool.mockReset();
+    mockExtractTar.mockReset();
+    mockExtractZip.mockReset();
+    mockCacheDir.mockReset();
+    mockGetLatestVersion.mockReset();
+    mockGetAllVersions.mockReset();
+    mockGetArtifact.mockReset();
+    mockValidateChecksum.mockReset();
+
+    mockDownloadTool.mockResolvedValue("/tmp/downloaded");
+    mockExtractTar.mockResolvedValue("/tmp/extracted");
+    mockExtractZip.mockResolvedValue("/tmp/extracted");
+    mockCacheDir.mockResolvedValue("/tmp/cached");
+  });
+
+  describe("resolveVersion", () => {
+    it("uses the default manifest to resolve latest", async () => {
+      mockGetLatestVersion.mockResolvedValue("0.9.26");
+
+      const version = await resolveVersion("latest", undefined);
+
+      expect(version).toBe("0.9.26");
+      expect(mockGetLatestVersion).toHaveBeenCalledTimes(1);
+      expect(mockGetLatestVersion).toHaveBeenCalledWith(undefined);
+    });
+
+    it("uses the default manifest to resolve available versions", async () => {
+      mockGetAllVersions.mockResolvedValue(["0.9.26", "0.9.25"]);
+
+      const version = await resolveVersion("^0.9.0", undefined);
+
+      expect(version).toBe("0.9.26");
+      expect(mockGetAllVersions).toHaveBeenCalledTimes(1);
+      expect(mockGetAllVersions).toHaveBeenCalledWith(undefined);
+    });
+
+    it("treats == exact pins as explicit versions", async () => {
+      const version = await resolveVersion("==0.9.26", undefined);
+
+      expect(version).toBe("0.9.26");
+      expect(mockGetAllVersions).not.toHaveBeenCalled();
+      expect(mockGetLatestVersion).not.toHaveBeenCalled();
+    });
+
+    it("uses latest for minimum-only ranges when using the highest strategy", async () => {
+      mockGetLatestVersion.mockResolvedValue("0.9.26");
+
+      const version = await resolveVersion(">=0.9.0", undefined, "highest");
+
+      expect(version).toBe("0.9.26");
+      expect(mockGetLatestVersion).toHaveBeenCalledTimes(1);
+      expect(mockGetLatestVersion).toHaveBeenCalledWith(undefined);
+      expect(mockGetAllVersions).not.toHaveBeenCalled();
+    });
+
+    it("uses the lowest compatible version when requested", async () => {
+      mockGetAllVersions.mockResolvedValue(["0.9.26", "0.9.25"]);
+
+      const version = await resolveVersion("^0.9.0", undefined, "lowest");
+
+      expect(version).toBe("0.9.25");
+      expect(mockGetAllVersions).toHaveBeenCalledTimes(1);
+      expect(mockGetAllVersions).toHaveBeenCalledWith(undefined);
+    });
+
+    it("uses manifest-file when provided", async () => {
+      mockGetAllVersions.mockResolvedValue(["0.9.26", "0.9.25"]);
+
+      const version = await resolveVersion(
+        "^0.9.0",
+        "https://example.com/custom.ndjson",
+      );
+
+      expect(version).toBe("0.9.26");
+      expect(mockGetAllVersions).toHaveBeenCalledWith(
+        "https://example.com/custom.ndjson",
+      );
+    });
+  });
+
+  describe("downloadVersion", () => {
+    it("fails when manifest lookup fails", async () => {
+      mockGetArtifact.mockRejectedValue(new Error("manifest unavailable"));
+
+      await expect(
+        downloadVersion(
+          "unknown-linux-gnu",
+          "x86_64",
+          "0.9.26",
+          undefined,
+          "token",
+        ),
+      ).rejects.toThrow("manifest unavailable");
+
+      expect(mockDownloadTool).not.toHaveBeenCalled();
+      expect(mockValidateChecksum).not.toHaveBeenCalled();
+    });
+
+    it("fails when no matching artifact exists in the default manifest", async () => {
+      mockGetArtifact.mockResolvedValue(undefined);
+
+      await expect(
+        downloadVersion(
+          "unknown-linux-gnu",
+          "x86_64",
+          "0.9.26",
+          undefined,
+          "token",
+        ),
+      ).rejects.toThrow(
+        "Could not find artifact for version 0.9.26, arch x86_64, platform unknown-linux-gnu in https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson .",
+      );
+
+      expect(mockDownloadTool).not.toHaveBeenCalled();
+      expect(mockValidateChecksum).not.toHaveBeenCalled();
+    });
+
+    it("uses built-in checksums for default manifest downloads", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "manifest-checksum-that-should-be-ignored",
+        downloadUrl: "https://example.com/uv.tar.gz",
+      });
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockValidateChecksum).toHaveBeenCalledWith(
+        undefined,
+        "/tmp/downloaded",
+        "x86_64",
+        "unknown-linux-gnu",
+        "0.9.26",
+      );
+    });
+
+    it("rewrites GitHub Releases URLs to the Astral mirror", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "abc123",
+        downloadUrl:
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+      });
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledWith(
+        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        undefined,
+        undefined,
+      );
+    });
+
+    it("does not send the token to non-GitHub URLs from the default manifest", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "abc123",
+        downloadUrl: "https://example.com/uv.tar.gz",
+      });
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledWith(
+        "https://example.com/uv.tar.gz",
+        undefined,
+        undefined,
+      );
+    });
+
+    it("does not send the token to GitHub lookalike hosts", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "abc123",
+        downloadUrl: "https://github.com.evil.test/uv.tar.gz",
+      });
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledWith(
+        "https://github.com.evil.test/uv.tar.gz",
+        undefined,
+        undefined,
+      );
+    });
+
+    it("falls back to GitHub Releases when the mirror fails", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "abc123",
+        downloadUrl:
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+      });
+
+      mockDownloadTool
+        .mockRejectedValueOnce(new Error("mirror unavailable"))
+        .mockResolvedValueOnce("/tmp/downloaded");
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledTimes(2);
+      expect(mockDownloadTool).toHaveBeenNthCalledWith(
+        1,
+        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        undefined,
+        undefined,
+      );
+      expect(mockDownloadTool).toHaveBeenNthCalledWith(
+        2,
+        "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        undefined,
+        "token",
+      );
+      expect(mockWarning).toHaveBeenCalledWith(
+        "Failed to download from mirror, falling back to GitHub Releases: mirror unavailable",
+      );
+    });
+
+    it("does not fall back for non-GitHub URLs", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "abc123",
+        downloadUrl: "https://example.com/uv.tar.gz",
+      });
+
+      mockDownloadTool.mockRejectedValue(new Error("download failed"));
+
+      await expect(
+        downloadVersion(
+          "unknown-linux-gnu",
+          "x86_64",
+          "0.9.26",
+          undefined,
+          "token",
+        ),
+      ).rejects.toThrow("download failed");
+
+      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
+    });
+
+    it("uses manifest-file checksum metadata when checksum input is unset", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "manifest-checksum",
+        downloadUrl: "https://example.com/custom-uv.tar.gz",
+      });
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        "",
+        "token",
+        "https://example.com/custom.ndjson",
+      );
+
+      expect(mockValidateChecksum).toHaveBeenCalledWith(
+        "manifest-checksum",
+        "/tmp/downloaded",
+        "x86_64",
+        "unknown-linux-gnu",
+        "0.9.26",
+      );
+    });
+
+    it("prefers checksum input over manifest-file checksum metadata", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "manifest-checksum",
+        downloadUrl: "https://example.com/custom-uv.tar.gz",
+      });
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        "user-checksum",
+        "token",
+        "https://example.com/custom.ndjson",
+      );
+
+      expect(mockValidateChecksum).toHaveBeenCalledWith(
+        "user-checksum",
+        "/tmp/downloaded",
+        "x86_64",
+        "unknown-linux-gnu",
+        "0.9.26",
+      );
+    });
+
+    it("skips the Astral mirror when downloadFromAstralMirror is false", async () => {
+      mockGetArtifact.mockResolvedValue({
+        archiveFormat: "tar.gz",
+        checksum: "abc123",
+        downloadUrl:
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+      });
+
+      await downloadVersion(
+        "unknown-linux-gnu",
+        "x86_64",
+        "0.9.26",
+        undefined,
+        "token",
+        undefined,
+        false,
+      );
+
+      expect(mockDownloadTool).toHaveBeenCalledWith(
+        "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        undefined,
+        "token",
+      );
+      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("rewriteToMirror", () => {
+    it("rewrites a GitHub Releases URL to the Astral mirror", () => {
+      expect(
+        rewriteToMirror(
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+        ),
+      ).toBe(
+        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
+      );
+    });
+
+    it("returns undefined for non-GitHub URLs", () => {
+      expect(rewriteToMirror("https://example.com/uv.tar.gz")).toBeUndefined();
+    });
+
+    it("returns undefined for a different GitHub repo", () => {
+      expect(
+        rewriteToMirror(
+          "https://github.com/other/repo/releases/download/v1.0/file.tar.gz",
+        ),
+      ).toBeUndefined();
+    });
+  });
+});

__tests__/download/manifest.test.ts

@@ -0,0 +1,180 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockFetch = jest.fn<any>();
+
+jest.unstable_mockModule("@actions/core", () => ({
+  debug: jest.fn(),
+  info: jest.fn(),
+}));
+
+jest.unstable_mockModule("../../src/utils/fetch", () => ({
+  fetch: mockFetch,
+}));
+
+const {
+  clearManifestCache,
+  fetchManifest,
+  getAllVersions,
+  getArtifact,
+  getLatestVersion,
+  parseManifest,
+} = await import("../../src/download/manifest");
+
+const sampleManifestResponse = `{"version":"0.9.26","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f"},{"platform":"x86_64-pc-windows-msvc","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip","archive_format":"zip","sha256":"eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036"}]}
+{"version":"0.9.25","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.25/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"606b3c6949d971709f2526fa0d9f0fd23ccf60e09f117999b406b424af18a6a6"}]}`;
+
+const multiVariantManifestResponse = `{"version":"0.9.26","artifacts":[{"platform":"aarch64-apple-darwin","variant":"python-managed","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin-managed.tar.gz","archive_format":"tar.gz","sha256":"managed-checksum"},{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.zip","archive_format":"zip","sha256":"default-checksum"}]}`;
+
+function createMockResponse(
+  ok: boolean,
+  status: number,
+  statusText: string,
+  data: string,
+) {
+  return {
+    ok,
+    status,
+    statusText,
+    text: async () => data,
+  };
+}
+
+describe("manifest", () => {
+  beforeEach(() => {
+    clearManifestCache();
+    mockFetch.mockReset();
+  });
+
+  describe("fetchManifest", () => {
+    it("fetches and parses manifest data", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleManifestResponse),
+      );
+
+      const versions = await fetchManifest();
+
+      expect(versions).toHaveLength(2);
+      expect(versions[0]?.version).toBe("0.9.26");
+      expect(versions[1]?.version).toBe("0.9.25");
+    });
+
+    it("throws on a failed fetch", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(false, 500, "Internal Server Error", ""),
+      );
+
+      await expect(fetchManifest()).rejects.toThrow(
+        "Failed to fetch manifest data: 500 Internal Server Error",
+      );
+    });
+
+    it("caches results per URL", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleManifestResponse),
+      );
+
+      await fetchManifest("https://example.com/custom.ndjson");
+      await fetchManifest("https://example.com/custom.ndjson");
+
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("getAllVersions", () => {
+    it("returns all version strings", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleManifestResponse),
+      );
+
+      const versions = await getAllVersions(
+        "https://example.com/custom.ndjson",
+      );
+
+      expect(versions).toEqual(["0.9.26", "0.9.25"]);
+    });
+  });
+
+  describe("getLatestVersion", () => {
+    it("returns the first version string", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleManifestResponse),
+      );
+
+      await expect(
+        getLatestVersion("https://example.com/custom.ndjson"),
+      ).resolves.toBe("0.9.26");
+    });
+  });
+
+  describe("getArtifact", () => {
+    beforeEach(() => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleManifestResponse),
+      );
+    });
+
+    it("finds an artifact by version and platform", async () => {
+      const artifact = await getArtifact("0.9.26", "aarch64", "apple-darwin");
+
+      expect(artifact).toEqual({
+        archiveFormat: "tar.gz",
+        checksum:
+          "fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f",
+        downloadUrl:
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz",
+      });
+    });
+
+    it("finds a windows artifact", async () => {
+      const artifact = await getArtifact("0.9.26", "x86_64", "pc-windows-msvc");
+
+      expect(artifact).toEqual({
+        archiveFormat: "zip",
+        checksum:
+          "eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036",
+        downloadUrl:
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip",
+      });
+    });
+
+    it("prefers the default variant when multiple artifacts share a platform", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", multiVariantManifestResponse),
+      );
+
+      const artifact = await getArtifact("0.9.26", "aarch64", "apple-darwin");
+
+      expect(artifact).toEqual({
+        archiveFormat: "zip",
+        checksum: "default-checksum",
+        downloadUrl:
+          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.zip",
+      });
+    });
+
+    it("returns undefined for an unknown version", async () => {
+      const artifact = await getArtifact("0.0.1", "aarch64", "apple-darwin");
+
+      expect(artifact).toBeUndefined();
+    });
+
+    it("returns undefined for an unknown platform", async () => {
+      const artifact = await getArtifact(
+        "0.9.26",
+        "aarch64",
+        "unknown-linux-musl",
+      );
+
+      expect(artifact).toBeUndefined();
+    });
+  });
+
+  describe("parseManifest", () => {
+    it("throws for malformed manifest data", () => {
+      expect(() => parseManifest('{"version":"0.1.0"', "test-source")).toThrow(
+        "Failed to parse manifest data from test-source",
+      );
+    });
+  });
+});

__tests__/utils/inputs.test.ts

@@ -1,13 +1,6 @@
-jest.mock("@actions/core", () => {
-  return {
-    debug: jest.fn(),
-    getBooleanInput: jest.fn(
-      (name: string) => (mockInputs[name] ?? "") === "true",
-    ),
-    getInput: jest.fn((name: string) => mockInputs[name] ?? ""),
-  };
-});
-
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import {
   afterEach,
   beforeEach,
@@ -17,70 +10,284 @@ import {
   jest,
 } from "@jest/globals";
 
-// Will be mutated per test before (re-)importing the module under test
 let mockInputs: Record<string, string> = {};
+const tempDirs: string[] = [];
 const ORIGINAL_HOME = process.env.HOME;
+const ORIGINAL_RUNNER_ENVIRONMENT = process.env.RUNNER_ENVIRONMENT;
+const ORIGINAL_RUNNER_TEMP = process.env.RUNNER_TEMP;
+const ORIGINAL_UV_CACHE_DIR = process.env.UV_CACHE_DIR;
+const ORIGINAL_UV_PYTHON_INSTALL_DIR = process.env.UV_PYTHON_INSTALL_DIR;
+
+const mockDebug = jest.fn();
+const mockGetBooleanInput = jest.fn(
+  (name: string) => (mockInputs[name] ?? "") === "true",
+);
+const mockGetInput = jest.fn((name: string) => mockInputs[name] ?? "");
+const mockInfo = jest.fn();
+const mockWarning = jest.fn();
+
+jest.unstable_mockModule("@actions/core", () => ({
+  debug: mockDebug,
+  getBooleanInput: mockGetBooleanInput,
+  getInput: mockGetInput,
+  info: mockInfo,
+  warning: mockWarning,
+}));
+
+const { CacheLocalSource, loadInputs } = await import("../../src/utils/inputs");
+
+function createTempProject(files: Record<string, string> = {}): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "setup-uv-inputs-test-"));
+  tempDirs.push(dir);
+
+  for (const [relativePath, content] of Object.entries(files)) {
+    const filePath = path.join(dir, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  return dir;
+}
+
+function resetEnvironment(): void {
+  jest.clearAllMocks();
+  mockInputs = {};
+  process.env.HOME = "/home/testuser";
+  delete process.env.RUNNER_ENVIRONMENT;
+  delete process.env.RUNNER_TEMP;
+  delete process.env.UV_CACHE_DIR;
+  delete process.env.UV_PYTHON_INSTALL_DIR;
+}
+
+function restoreEnvironment(): void {
+  for (const dir of tempDirs.splice(0)) {
+    fs.rmSync(dir, { force: true, recursive: true });
+  }
+
+  process.env.HOME = ORIGINAL_HOME;
+  process.env.RUNNER_ENVIRONMENT = ORIGINAL_RUNNER_ENVIRONMENT;
+  process.env.RUNNER_TEMP = ORIGINAL_RUNNER_TEMP;
+  process.env.UV_CACHE_DIR = ORIGINAL_UV_CACHE_DIR;
+  process.env.UV_PYTHON_INSTALL_DIR = ORIGINAL_UV_PYTHON_INSTALL_DIR;
+}
+
+beforeEach(resetEnvironment);
+afterEach(restoreEnvironment);
+
+describe("loadInputs", () => {
+  it("loads defaults for a github-hosted runner", () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["enable-cache"] = "auto";
+    process.env.RUNNER_ENVIRONMENT = "github-hosted";
+    process.env.RUNNER_TEMP = "/runner-temp";
+
+    const inputs = loadInputs();
+
+    expect(inputs.enableCache).toBe(true);
+    expect(inputs.cacheLocalPath).toEqual({
+      path: "/runner-temp/setup-uv-cache",
+      source: CacheLocalSource.Default,
+    });
+    expect(inputs.pythonDir).toBe("/runner-temp/uv-python-dir");
+    expect(inputs.venvPath).toBe("/workspace/.venv");
+    expect(inputs.manifestFile).toBeUndefined();
+    expect(inputs.resolutionStrategy).toBe("highest");
+  });
+
+  it("uses cache-dir from pyproject.toml when present", () => {
+    mockInputs["working-directory"] = createTempProject({
+      "pyproject.toml": `[project]
+name = "uv-project"
+version = "0.1.0"
+
+[tool.uv]
+cache-dir = "/tmp/pyproject-toml-defined-cache-path"
+`,
+    });
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheLocalPath).toEqual({
+      path: "/tmp/pyproject-toml-defined-cache-path",
+      source: CacheLocalSource.Config,
+    });
+    expect(mockInfo).toHaveBeenCalledWith(
+      expect.stringContaining("Found cache-dir in"),
+    );
+  });
+
+  it("uses UV_CACHE_DIR from the environment", () => {
+    mockInputs["working-directory"] = createTempProject();
+    process.env.UV_CACHE_DIR = "/env/cache-dir";
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheLocalPath).toEqual({
+      path: "/env/cache-dir",
+      source: CacheLocalSource.Env,
+    });
+    expect(mockInfo).toHaveBeenCalledWith(
+      "UV_CACHE_DIR is already set to /env/cache-dir",
+    );
+  });
+
+  it("uses UV_PYTHON_INSTALL_DIR from the environment", () => {
+    mockInputs["working-directory"] = "/workspace";
+    process.env.UV_PYTHON_INSTALL_DIR = "/env/python-dir";
+
+    const inputs = loadInputs();
+
+    expect(inputs.pythonDir).toBe("/env/python-dir");
+    expect(mockInfo).toHaveBeenCalledWith(
+      "UV_PYTHON_INSTALL_DIR is already set to /env/python-dir",
+    );
+  });
+
+  it("warns when parsing a malformed pyproject.toml for cache-dir", () => {
+    mockInputs["working-directory"] = createTempProject({
+      "pyproject.toml": `[project]
+name = "malformed-pyproject-toml-project"
+version = "0.1.0"
+
+[malformed-toml
+`,
+    });
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheLocalPath).toBeUndefined();
+    expect(mockWarning).toHaveBeenCalledWith(
+      expect.stringContaining("Error while parsing pyproject.toml:"),
+    );
+  });
+
+  it("throws for an invalid resolution strategy", () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["resolution-strategy"] = "middle";
+
+    expect(() => loadInputs()).toThrow(
+      "Invalid resolution-strategy: middle. Must be 'highest' or 'lowest'.",
+    );
+  });
+});
 
 describe("cacheDependencyGlob", () => {
-  beforeEach(() => {
-    jest.resetModules();
-    mockInputs = {};
-    process.env.HOME = "/home/testuser";
-  });
-
-  afterEach(() => {
-    process.env.HOME = ORIGINAL_HOME;
-  });
-
-  it("returns empty string when input not provided", async () => {
+  it("returns empty string when input not provided", () => {
     mockInputs["working-directory"] = "/workspace";
-    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
-    expect(cacheDependencyGlob).toBe("");
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheDependencyGlob).toBe("");
   });
 
-  it("resolves a single relative path", async () => {
+  it.each([
+    ["requirements.txt", "/workspace/requirements.txt"],
+    ["./uv.lock", "/workspace/uv.lock"],
+  ])("resolves %s to %s", (globInput, expected) => {
     mockInputs["working-directory"] = "/workspace";
-    mockInputs["cache-dependency-glob"] = "requirements.txt";
-    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
-    expect(cacheDependencyGlob).toBe("/workspace/requirements.txt");
+    mockInputs["cache-dependency-glob"] = globInput;
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheDependencyGlob).toBe(expected);
   });
 
-  it("strips leading ./ from relative path", async () => {
-    mockInputs["working-directory"] = "/workspace";
-    mockInputs["cache-dependency-glob"] = "./uv.lock";
-    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
-    expect(cacheDependencyGlob).toBe("/workspace/uv.lock");
-  });
-
-  it("handles multiple lines, trimming whitespace, tilde expansion and absolute paths", async () => {
+  it("handles multiple lines, trimming whitespace, tilde expansion and absolute paths", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["cache-dependency-glob"] =
       "  ~/.cache/file1\n ./rel/file2  \nfile3.txt";
-    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
-    expect(cacheDependencyGlob).toBe(
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheDependencyGlob).toBe(
       [
-        "/home/testuser/.cache/file1", // expanded tilde, absolute path unchanged
-        "/workspace/rel/file2", // ./ stripped and resolved
-        "/workspace/file3.txt", // relative path resolved
+        "/home/testuser/.cache/file1",
+        "/workspace/rel/file2",
+        "/workspace/file3.txt",
       ].join("\n"),
     );
   });
 
-  it("keeps absolute path unchanged in multiline input", async () => {
-    mockInputs["working-directory"] = "/workspace";
-    mockInputs["cache-dependency-glob"] = "/abs/path.lock\nrelative.lock";
-    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
-    expect(cacheDependencyGlob).toBe(
+  it.each([
+    [
+      "/abs/path.lock\nrelative.lock",
       ["/abs/path.lock", "/workspace/relative.lock"].join("\n"),
-    );
+    ],
+    [
+      "!/abs/path.lock\n!relative.lock",
+      ["!/abs/path.lock", "!/workspace/relative.lock"].join("\n"),
+    ],
+  ])("normalizes multiline glob %s", (globInput, expected) => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["cache-dependency-glob"] = globInput;
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheDependencyGlob).toBe(expected);
+  });
+});
+
+describe("tool directories", () => {
+  it("expands tilde for tool-bin-dir and tool-dir", () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["tool-bin-dir"] = "~/tool-bin-dir";
+    mockInputs["tool-dir"] = "~/tool-dir";
+
+    const inputs = loadInputs();
+
+    expect(inputs.toolBinDir).toBe("/home/testuser/tool-bin-dir");
+    expect(inputs.toolDir).toBe("/home/testuser/tool-dir");
+  });
+});
+
+describe("cacheLocalPath", () => {
+  it("expands tilde in cache-local-path", () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["cache-local-path"] = "~/uv-cache/cache-local-path";
+
+    const inputs = loadInputs();
+
+    expect(inputs.cacheLocalPath).toEqual({
+      path: "/home/testuser/uv-cache/cache-local-path",
+      source: CacheLocalSource.Input,
+    });
+  });
+});
+
+describe("venvPath", () => {
+  it("defaults to .venv in the working directory", () => {
+    mockInputs["working-directory"] = "/workspace";
+
+    const inputs = loadInputs();
+
+    expect(inputs.venvPath).toBe("/workspace/.venv");
   });
 
-  it("handles exclusions in relative paths correct", async () => {
+  it.each([
+    ["custom-venv", "/workspace/custom-venv"],
+    ["custom-venv/", "/workspace/custom-venv"],
+    ["/tmp/custom-venv", "/tmp/custom-venv"],
+    ["~/.venv", "/home/testuser/.venv"],
+  ])("resolves venv-path %s to %s", (venvPathInput, expected) => {
     mockInputs["working-directory"] = "/workspace";
-    mockInputs["cache-dependency-glob"] = "!/abs/path.lock\n!relative.lock";
-    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
-    expect(cacheDependencyGlob).toBe(
-      ["!/abs/path.lock", "!/workspace/relative.lock"].join("\n"),
+    mockInputs["activate-environment"] = "true";
+    mockInputs["venv-path"] = venvPathInput;
+
+    const inputs = loadInputs();
+
+    expect(inputs.venvPath).toBe(expected);
+  });
+
+  it("warns when venv-path is set but activate-environment is false", () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["venv-path"] = "custom-venv";
+
+    const inputs = loadInputs();
+
+    expect(inputs.activateEnvironment).toBe(false);
+    expect(inputs.venvPath).toBe("/workspace/custom-venv");
+    expect(mockWarning).toHaveBeenCalledWith(
+      "venv-path is only used when activate-environment is true",
     );
   });
 });

__tests__/version/requirements-file.test.ts

@@ -1,5 +1,5 @@
 import { expect, test } from "@jest/globals";
-import { getUvVersionFromFile } from "../../src/version/resolve";
+import { getUvVersionFromFile } from "../../src/version/file-parser";
 
 test("ignores dependencies starting with uv", async () => {
   const parsedVersion = getUvVersionFromFile(

__tests__/version/requirements-hashes-file.test.ts

@@ -1,5 +1,5 @@
 import { expect, test } from "@jest/globals";
-import { getUvVersionFromFile } from "../../src/version/resolve";
+import { getUvVersionFromFile } from "../../src/version/file-parser";
 
 test("ignores dependencies starting with uv", async () => {
   const parsedVersion = getUvVersionFromFile(

__tests__/version/tool-versions-file.test.ts

@@ -1,113 +1,121 @@
-jest.mock("node:fs");
-jest.mock("@actions/core", () => ({
-  warning: jest.fn(),
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+const mockReadFileSync = jest.fn();
+const mockWarning = jest.fn();
+
+jest.unstable_mockModule("node:fs", () => ({
+  default: {
+    readFileSync: mockReadFileSync,
+  },
 }));
 
-import fs from "node:fs";
-import * as core from "@actions/core";
-import { beforeEach, describe, expect, it, jest } from "@jest/globals";
-import { getUvVersionFromToolVersions } from "../../src/version/tool-versions-file";
+jest.unstable_mockModule("@actions/core", () => ({
+  warning: mockWarning,
+}));
 
-const mockedFs = fs as jest.Mocked<typeof fs>;
-const mockedCore = core as jest.Mocked<typeof core>;
+async function getVersionFromToolVersions(filePath: string) {
+  const { getUvVersionFromToolVersions } = await import(
+    "../../src/version/tool-versions-file"
+  );
+
+  return getUvVersionFromToolVersions(filePath);
+}
 
 describe("getUvVersionFromToolVersions", () => {
   beforeEach(() => {
+    jest.resetModules();
     jest.clearAllMocks();
   });
 
-  it("should return undefined for non-.tool-versions files", () => {
-    const result = getUvVersionFromToolVersions("package.json");
+  it("should return undefined for non-.tool-versions files", async () => {
+    const result = await getVersionFromToolVersions("package.json");
     expect(result).toBeUndefined();
-    expect(mockedFs.readFileSync).not.toHaveBeenCalled();
+    expect(mockReadFileSync).not.toHaveBeenCalled();
   });
 
-  it("should return version for valid uv entry", () => {
+  it("should return version for valid uv entry", async () => {
     const fileContent = "python 3.11.0\nuv 0.1.0\nnodejs 18.0.0";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.1.0");
-    expect(mockedFs.readFileSync).toHaveBeenCalledWith(
-      ".tool-versions",
-      "utf8",
-    );
+    expect(mockReadFileSync).toHaveBeenCalledWith(".tool-versions", "utf8");
   });
 
-  it("should return version for uv entry with v prefix", () => {
+  it("should return version for uv entry with v prefix", async () => {
     const fileContent = "uv v0.2.0";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.2.0");
   });
 
-  it("should handle whitespace around uv entry", () => {
+  it("should handle whitespace around uv entry", async () => {
     const fileContent = "  uv   0.3.0  ";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.3.0");
   });
 
-  it("should skip commented lines", () => {
+  it("should skip commented lines", async () => {
     const fileContent = "# uv 0.1.0\npython 3.11.0\nuv 0.2.0";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.2.0");
   });
 
-  it("should return first matching uv version", () => {
+  it("should return first matching uv version", async () => {
     const fileContent = "uv 0.1.0\npython 3.11.0\nuv 0.2.0";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.1.0");
   });
 
-  it("should return undefined when no uv entry found", () => {
+  it("should return undefined when no uv entry found", async () => {
     const fileContent = "python 3.11.0\nnodejs 18.0.0";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBeUndefined();
   });
 
-  it("should return undefined for empty file", () => {
-    mockedFs.readFileSync.mockReturnValue("");
+  it("should return undefined for empty file", async () => {
+    mockReadFileSync.mockReturnValue("");
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBeUndefined();
   });
 
-  it("should warn and return undefined for ref syntax", () => {
+  it("should warn and return undefined for ref syntax", async () => {
     const fileContent = "uv ref:main";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions(".tool-versions");
+    const result = await getVersionFromToolVersions(".tool-versions");
 
     expect(result).toBeUndefined();
-    expect(mockedCore.warning).toHaveBeenCalledWith(
+    expect(mockWarning).toHaveBeenCalledWith(
       "The ref syntax of .tool-versions is not supported. Please use a released version instead.",
     );
   });
 
-  it("should handle file path with .tool-versions extension", () => {
+  it("should handle file path with .tool-versions extension", async () => {
     const fileContent = "uv 0.1.0";
-    mockedFs.readFileSync.mockReturnValue(fileContent);
+    mockReadFileSync.mockReturnValue(fileContent);
 
-    const result = getUvVersionFromToolVersions("path/to/.tool-versions");
+    const result = await getVersionFromToolVersions("path/to/.tool-versions");
 
     expect(result).toBe("0.1.0");
-    expect(mockedFs.readFileSync).toHaveBeenCalledWith(
+    expect(mockReadFileSync).toHaveBeenCalledWith(
       "path/to/.tool-versions",
       "utf8",
     );

__tests__/version/version-request-resolver.test.ts

@@ -0,0 +1,125 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "@jest/globals";
+import { resolveVersionRequest } from "../../src/version/version-request-resolver";
+
+const tempDirs: string[] = [];
+
+function createTempProject(files: Record<string, string> = {}): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "setup-uv-version-test-"));
+  tempDirs.push(dir);
+
+  for (const [relativePath, content] of Object.entries(files)) {
+    const filePath = path.join(dir, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  return dir;
+}
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    fs.rmSync(dir, { force: true, recursive: true });
+  }
+});
+
+describe("resolveVersionRequest", () => {
+  it("prefers explicit input over version-file and workspace config", () => {
+    const workingDirectory = createTempProject({
+      ".tool-versions": "uv 0.4.0\n",
+      "pyproject.toml": `[tool.uv]\nrequired-version = "==0.5.14"\n`,
+      "uv.toml": `required-version = "==0.5.15"\n`,
+    });
+
+    const request = resolveVersionRequest({
+      version: "==0.6.0",
+      versionFile: path.join(workingDirectory, ".tool-versions"),
+      workingDirectory,
+    });
+
+    expect(request).toEqual({
+      source: "input",
+      specifier: "0.6.0",
+    });
+  });
+
+  it("uses .tool-versions when it is passed via version-file", () => {
+    const workingDirectory = createTempProject({
+      ".tool-versions": "uv 0.5.15\n",
+    });
+
+    const request = resolveVersionRequest({
+      versionFile: path.join(workingDirectory, ".tool-versions"),
+      workingDirectory,
+    });
+
+    expect(request).toEqual({
+      format: ".tool-versions",
+      source: "version-file",
+      sourcePath: path.join(workingDirectory, ".tool-versions"),
+      specifier: "0.5.15",
+    });
+  });
+
+  it("uses requirements.txt when it is passed via version-file", () => {
+    const workingDirectory = createTempProject({
+      "requirements.txt": "uv==0.6.17\nuvicorn==0.35.0\n",
+    });
+
+    const request = resolveVersionRequest({
+      versionFile: path.join(workingDirectory, "requirements.txt"),
+      workingDirectory,
+    });
+
+    expect(request).toEqual({
+      format: "requirements",
+      source: "version-file",
+      sourcePath: path.join(workingDirectory, "requirements.txt"),
+      specifier: "0.6.17",
+    });
+  });
+
+  it("prefers uv.toml over pyproject.toml during workspace discovery", () => {
+    const workingDirectory = createTempProject({
+      "pyproject.toml": `[tool.uv]\nrequired-version = "==0.5.14"\n`,
+      "uv.toml": `required-version = "==0.5.15"\n`,
+    });
+
+    const request = resolveVersionRequest({ workingDirectory });
+
+    expect(request).toEqual({
+      format: "uv.toml",
+      source: "uv.toml",
+      sourcePath: path.join(workingDirectory, "uv.toml"),
+      specifier: "0.5.15",
+    });
+  });
+
+  it("falls back to latest when no version source is found", () => {
+    const workingDirectory = createTempProject({});
+
+    const request = resolveVersionRequest({ workingDirectory });
+
+    expect(request).toEqual({
+      source: "default",
+      specifier: "latest",
+    });
+  });
+
+  it("throws when version-file does not resolve a version", () => {
+    const workingDirectory = createTempProject({
+      "requirements.txt": "uvicorn==0.35.0\n",
+    });
+
+    expect(() =>
+      resolveVersionRequest({
+        versionFile: path.join(workingDirectory, "requirements.txt"),
+        workingDirectory,
+      }),
+    ).toThrow(
+      `Could not determine uv version from file: ${path.join(workingDirectory, "requirements.txt")}`,
+    );
+  });
+});

action-types.yml

@@ -9,6 +9,10 @@ inputs:
     type: string
   activate-environment:
     type: boolean
+  venv-path:
+    type: string
+  no-project:
+    type: boolean
   working-directory:
     type: string
   checksum:
@@ -48,8 +52,12 @@ inputs:
     type: string
   manifest-file:
     type: string
+  download-from-astral-mirror:
+    type: boolean
   add-problem-matchers:
     type: boolean
+  quiet:
+    type: boolean
   resolution-strategy:
     type: enum
     allowed-values:

action.yml

@@ -15,6 +15,12 @@ inputs:
   activate-environment:
     description: "Use uv venv to activate a venv ready to be used by later steps. "
     default: "false"
+  venv-path:
+    description: "Custom path for the virtual environment when using activate-environment. Defaults to '.venv' in the working directory."
+    default: ""
+  no-project:
+    description: "Pass --no-project when creating the venv with activate-environment."
+    default: "false"
   working-directory:
     description: "The directory to execute all commands in and look for files such as pyproject.toml"
     default: ${{ github.workspace }}
@@ -23,7 +29,7 @@ inputs:
     required: false
   github-token:
     description:
-      "Used to increase the rate limit when retrieving versions and downloading uv."
+      "Used when downloading uv from GitHub releases."
     required: false
     default: ${{ github.token }}
   enable-cache:
@@ -72,11 +78,17 @@ inputs:
     description: "Custom path to set UV_TOOL_BIN_DIR to."
     required: false
   manifest-file:
-    description: "URL to the manifest file containing available versions and download URLs."
+    description: "URL to a custom manifest file in the astral-sh/versions format."
     required: false
+  download-from-astral-mirror:
+    description: "Download uv from the Astral mirror instead of directly from GitHub Releases."
+    default: "true"
   add-problem-matchers:
     description: "Add problem matchers."
     default: "true"
+  quiet:
+    description: "Suppress info-level log output. Only warnings and errors are shown."
+    default: "false"
   resolution-strategy:
     description: "Resolution strategy to use when resolving version ranges. 'highest' uses the latest compatible version, 'lowest' uses the oldest compatible version."
     default: "highest"
@@ -99,8 +111,8 @@ outputs:
     description: "A boolean value to indicate the Python cache entry was found"
 runs:
   using: "node24"
-  main: "dist/setup/index.js"
-  post: "dist/save-cache/index.js"
+  main: "dist/setup/index.cjs"
+  post: "dist/save-cache/index.cjs"
   post-if: success()
 branding:
   icon: "package"

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.3.7/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.4.15/schema.json",
   "assist": {
     "actions": {
       "source": {

docs/advanced-version-configuration.md

@@ -6,7 +6,7 @@ This document covers advanced options for configuring which version of uv to ins
 
 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version: "latest"
 ```
@@ -15,7 +15,7 @@ This document covers advanced options for configuring which version of uv to ins
 
 ```yaml
 - name: Install a specific version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version: "0.4.4"
 ```
@@ -28,21 +28,21 @@ to install the latest version that satisfies the range.
 
 ```yaml
 - name: Install a semver range of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version: ">=0.4.0"
 ```
 
 ```yaml
 - name: Pinning a minor version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version: "0.4.x"
 ```
 
 ```yaml
 - name: Install a pep440-specifier-satisfying version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version: ">=0.4.25,<0.5"
 ```
@@ -54,7 +54,7 @@ You can change this behavior using the `resolution-strategy` input:
 
 ```yaml
 - name: Install the lowest compatible version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version: ">=0.4.0"
     resolution-strategy: "lowest"
@@ -76,7 +76,7 @@ uv defined as a dependency in `pyproject.toml` or `requirements.txt`.
 
 ```yaml
 - name: Install uv based on the version defined in pyproject.toml
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version-file: "pyproject.toml"
 ```

docs/caching.md

@@ -23,7 +23,7 @@ The computed cache key is available as the `cache-key` output:
 ```yaml
 - name: Setup uv
   id: setup-uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
 - name: Print cache key
@@ -50,7 +50,7 @@ You can optionally define a custom cache key suffix.
 ```yaml
 - name: Enable caching and define a custom cache key suffix
   id: setup-uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     cache-suffix: "optional-suffix"
@@ -89,7 +89,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Define a cache dependency glob
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     cache-dependency-glob: "**/pyproject.toml"
@@ -97,7 +97,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Define a list of cache dependency globs
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     cache-dependency-glob: |
@@ -107,7 +107,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Define an absolute cache dependency glob
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     cache-dependency-glob: "/tmp/my-folder/requirements*.txt"
@@ -115,7 +115,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Never invalidate the cache
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     cache-dependency-glob: ""
@@ -128,7 +128,7 @@ By default, the cache will be restored.
 
 ```yaml
 - name: Don't restore an existing cache
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     restore-cache: false
@@ -142,7 +142,7 @@ By default, the cache will be saved.
 
 ```yaml
 - name: Don't save the cache after the run
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     save-cache: false
@@ -168,7 +168,7 @@ It defaults to `setup-uv-cache` in the `TMP` dir, `D:\a\_temp\setup-uv-cache` on
 
 ```yaml
 - name: Define a custom uv cache path
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     cache-local-path: "/path/to/cache"
 ```
@@ -187,7 +187,7 @@ input.
 
 ```yaml
 - name: Don't prune the cache before saving it
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     prune-cache: false
@@ -199,9 +199,13 @@ By default, the Python install dir (`uv python dir` / `UV_PYTHON_INSTALL_DIR`) i
 for the same reason that the dependency cache is pruned.
 If you want to cache Python installs along with your dependencies, set the `cache-python` input to `true`.
 
+Note that this only caches Python versions that uv actually installs into `UV_PYTHON_INSTALL_DIR`
+(i.e. managed Python installs). If uv uses a system Python, there may be nothing to cache.
+To force managed Python installs, set `UV_PYTHON_PREFERENCE=only-managed`.
+
 ```yaml
 - name: Cache Python installs
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     cache-python: true
@@ -209,12 +213,17 @@ If you want to cache Python installs along with your dependencies, set the `cach
 
 ## Ignore nothing to cache
 
-By default, the action will fail if caching is enabled but there is nothing to upload (the uv cache directory does not exist).
+By default, the action will fail if caching is enabled but there is nothing to upload (the uv cache directory does not exist) with an error like
+
+```console
+Error: Cache path /home/runner/.cache/uv does not exist on disk. This likely indicates that there are no dependencies to cache. Consider disabling the cache input if it is not needed.
+```
+
 If you want to ignore this, set the `ignore-nothing-to-cache` input to `true`.
 
 ```yaml
 - name: Ignore nothing to cache
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     enable-cache: true
     ignore-nothing-to-cache: true

docs/customization.md

@@ -10,7 +10,7 @@ are automatically verified by this action. The sha256 hashes can be found on the
 
 ```yaml
 - name: Install a specific version and validate the checksum
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     version: "0.3.1"
     checksum: "e11b01402ab645392c7ad6044db63d37e4fd1e745e015306993b07695ea5f9f8"
@@ -18,41 +18,35 @@ are automatically verified by this action. The sha256 hashes can be found on the
 
 ## Manifest file
 
-The `manifest-file` input allows you to specify a JSON manifest that lists available uv versions,
-architectures, and their download URLs. By default, this action uses the manifest file contained
-in this repository, which is automatically updated with each release of uv.
+By default, setup-uv reads version metadata from
+[`astral-sh/versions`](https://github.com/astral-sh/versions).
 
-The manifest file contains an array of objects, each describing a version,
-architecture, platform, and the corresponding download URL. For example:
+The `manifest-file` input lets you override that source with your own URL, for example to test
+custom uv builds or alternate download locations.
+
+### Format
+
+The manifest file must use the same format as `astral-sh/versions`: one JSON object per line, where each object represents a version and its artifacts. The versions must be sorted in descending order. For example:
 
 ```json
-[
-  {
-    "version": "0.7.13",
-    "artifactName": "uv-aarch64-apple-darwin.tar.gz",
-    "arch": "aarch64",
-    "platform": "apple-darwin",
-    "downloadUrl": "https://github.com/astral-sh/uv/releases/download/0.7.13/uv-aarch64-apple-darwin.tar.gz"
-  },
-  ...
-]
+{"version":"0.10.7","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}
+{"version":"0.10.6","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}
 ```
 
-You can supply a custom manifest file URL to define additional versions,
-architectures, or different download URLs.
-This is useful if you maintain your own uv builds or want to override the default sources.
+setup-uv currently only supports `default` as the `variant`.
+
+The `archive_format` field is currently ignored.
 
 ```yaml
 - name: Use a custom manifest file
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
-    manifest-file: "https://example.com/my-custom-manifest.json"
+    manifest-file: "https://example.com/my-custom-manifest.ndjson"
 ```
 
 > [!NOTE]
-> When you use a custom manifest file and do not set the `version` input, its default value is `latest`.
-> This means the action will install the latest version available in the custom manifest file.
-> This is different from the default behavior of installing the latest version from the official uv releases.
+> When you use a custom manifest file and do not set the `version` input, setup-uv installs the
+> latest version from that custom manifest.
 
 ## Add problem matchers
 
@@ -64,7 +58,7 @@ You can disable this by setting the `add-problem-matchers` input to `false`.
 
 ```yaml
 - name: Install the latest version of uv without problem matchers
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     add-problem-matchers: false
 ```

docs/environment-and-tools.md

@@ -9,12 +9,23 @@ This allows directly using it in later steps:
 
 ```yaml
 - name: Install the latest version of uv and activate the environment
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     activate-environment: true
 - run: uv pip install pip
 ```
 
+By default, the venv is created at `.venv` inside the `working-directory`.
+
+You can customize the venv location with `venv-path`, for example to place it in the runner temp directory:
+
+```yaml
+- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+  with:
+    activate-environment: true
+    venv-path: ${{ runner.temp }}/custom-venv
+```
+
 > [!WARNING]
 >
 > Activating the environment adds your dependencies to the `PATH`, which could break some workflows.
@@ -27,9 +38,12 @@ This allows directly using it in later steps:
 
 ## GitHub authentication token
 
-This action uses the GitHub API to fetch the uv release artifacts. To avoid hitting the GitHub API
-rate limit too quickly, an authentication token can be provided via the `github-token` input. By
-default, the `GITHUB_TOKEN` secret is used, which is automatically provided by GitHub Actions.
+By default, this action resolves available uv versions from
+[`astral-sh/versions`](https://github.com/astral-sh/versions), then downloads uv artifacts from
+GitHub Releases.
+
+You can provide a token via `github-token` to authenticate those downloads. By default, the
+`GITHUB_TOKEN` secret is used, which is automatically provided by GitHub Actions.
 
 If the default
 [permissions for the GitHub token](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
@@ -37,7 +51,7 @@ are not sufficient, you can provide a custom GitHub token with the necessary per
 
 ```yaml
 - name: Install the latest version of uv with a custom GitHub token
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
 ```
@@ -55,7 +69,7 @@ input:
 
 ```yaml
 - name: Install the latest version of uv with a custom tool dir
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     tool-dir: "/path/to/tool/dir"
 ```
@@ -74,7 +88,7 @@ If you want to change this behaviour (especially on self-hosted runners) you can
 
 ```yaml
 - name: Install the latest version of uv with a custom tool bin dir
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     tool-bin-dir: "/path/to/tool-bin/dir"
 ```
@@ -91,7 +105,7 @@ This action supports expanding the `~` character to the user's home directory fo
 
 ```yaml
 - name: Expand the tilde character
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     cache-local-path: "~/path/to/cache"
     tool-dir: "~/path/to/tool/dir"
@@ -108,7 +122,7 @@ If you want to ignore this, set the `ignore-empty-workdir` input to `true`.
 
 ```yaml
 - name: Ignore empty workdir
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     ignore-empty-workdir: true
 ```
@@ -131,7 +145,7 @@ This action sets several environment variables that influence uv's behavior and
 
 ```yaml
 - name: Example using environment variables
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
   with:
     python-version: "3.12"
     tool-dir: "/custom/tool/dir"

jest.config.js

@@ -1,9 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ["js", "ts"],
-  testMatch: ["**/*.test.ts"],
-  transform: {
-    "^.+\\.ts$": "ts-jest",
-  },
-  verbose: true,
-};

jest.config.mjs

@@ -0,0 +1,14 @@
+import { createDefaultEsmPreset } from "ts-jest";
+
+const esmPreset = createDefaultEsmPreset({
+  tsconfig: "./tsconfig.json",
+});
+
+export default {
+  ...esmPreset,
+  clearMocks: true,
+  moduleFileExtensions: ["js", "mjs", "ts"],
+  testEnvironment: "node",
+  testMatch: ["**/*.test.ts"],
+  verbose: true,
+};

package.json

@@ -2,16 +2,18 @@
   "name": "setup-uv",
   "version": "1.0.0",
   "private": true,
+  "type": "module",
   "description": "Set up your GitHub Actions workflow with a specific version of uv",
-  "main": "dist/index.js",
+  "main": "dist/setup/index.cjs",
   "scripts": {
-    "build": "tsc",
+    "build": "tsc --noEmit",
     "check": "biome check --write",
-    "package": "ncc build -o dist/setup src/setup-uv.ts && ncc build -o dist/save-cache src/save-cache.ts && ncc build -o dist/update-known-versions src/update-known-versions.ts",
-    "test": "jest",
+    "package": "node scripts/build-dist.mjs",
+    "test:unit": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js",
+    "test": "npm run build && npm run test:unit",
     "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
-    "update-known-versions": "RUNNER_TEMP=known_versions node dist/update-known-versions/index.js src/download/checksum/known-versions.ts \"$(gh auth token)\"",
-    "all": "npm run build && npm run check && npm run package && npm test"
+    "update-known-checksums": "RUNNER_TEMP=known_versions node dist/update-known-checksums/index.cjs src/download/checksum/known-checksums.ts",
+    "all": "npm run build && npm run check && npm run package && npm run test:unit"
   },
   "repository": {
     "type": "git",
@@ -26,28 +28,26 @@
   "author": "@eifinger",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^4.1.0",
-    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/glob": "^0.5.0",
-    "@actions/io": "^1.1.3",
-    "@actions/tool-cache": "^2.0.2",
-    "@octokit/core": "^7.0.6",
-    "@octokit/plugin-paginate-rest": "^14.0.0",
-    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
-    "@renovatebot/pep440": "^4.2.1",
-    "smol-toml": "^1.4.2",
-    "undici": "5.28.5"
+    "@actions/cache": "^6.0.0",
+    "@actions/core": "^3.0.0",
+    "@actions/exec": "^3.0.0",
+    "@actions/glob": "^0.6.1",
+    "@actions/io": "^3.0.2",
+    "@actions/tool-cache": "^4.0.0",
+    "@renovatebot/pep440": "^4.2.2",
+    "smol-toml": "^1.6.1",
+    "undici": "^8.3.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.3.7",
+    "@biomejs/biome": "^2.4.15",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^24.10.1",
+    "@types/node": "^25.5.0",
     "@types/semver": "^7.7.1",
     "@vercel/ncc": "^0.38.4",
-    "jest": "^30.2.0",
-    "js-yaml": "^4.1.0",
-    "ts-jest": "^29.4.5",
+    "esbuild": "^0.28.0",
+    "jest": "^30.3.0",
+    "js-yaml": "^4.1.1",
+    "ts-jest": "^29.4.11",
     "typescript": "^5.9.3"
   }
 }

scripts/build-dist.mjs

@@ -0,0 +1,33 @@
+import { rm } from "node:fs/promises";
+import { build } from "esbuild";
+
+const builds = [
+  {
+    entryPoints: ["src/setup-uv.ts"],
+    outfile: "dist/setup/index.cjs",
+    staleOutfiles: ["dist/setup/index.mjs"],
+  },
+  {
+    entryPoints: ["src/save-cache.ts"],
+    outfile: "dist/save-cache/index.cjs",
+    staleOutfiles: ["dist/save-cache/index.mjs"],
+  },
+  {
+    entryPoints: ["src/update-known-checksums.ts"],
+    outfile: "dist/update-known-checksums/index.cjs",
+    staleOutfiles: ["dist/update-known-checksums/index.mjs"],
+  },
+];
+
+for (const { staleOutfiles, ...options } of builds) {
+  await Promise.all(
+    staleOutfiles.map((outfile) => rm(outfile, { force: true })),
+  );
+  await build({
+    bundle: true,
+    format: "cjs",
+    platform: "node",
+    target: "node24",
+    ...options,
+  });
+}

src/cache/restore-cache.ts

@@ -1,15 +1,8 @@
 import * as cache from "@actions/cache";
 import * as core from "@actions/core";
 import { hashFiles } from "../hash/hash-files";
-import {
-  cacheDependencyGlob,
-  cacheLocalPath,
-  cachePython,
-  cacheSuffix,
-  pruneCache,
-  pythonDir,
-  restoreCache as shouldRestoreCache,
-} from "../utils/inputs";
+import type { SetupInputs } from "../utils/inputs";
+import * as log from "../utils/logging";
 import { getArch, getOSNameVersion, getPlatform } from "../utils/platforms";
 
 export const STATE_CACHE_KEY = "cache-key";
@@ -18,18 +11,21 @@ export const STATE_PYTHON_CACHE_MATCHED_KEY = "python-cache-matched-key";
 
 const CACHE_VERSION = "2";
 
-export async function restoreCache(pythonVersion?: string): Promise<void> {
-  const cacheKey = await computeKeys(pythonVersion);
+export async function restoreCache(
+  inputs: SetupInputs,
+  pythonVersion?: string,
+): Promise<void> {
+  const cacheKey = await computeKeys(inputs, pythonVersion);
   core.saveState(STATE_CACHE_KEY, cacheKey);
   core.setOutput("cache-key", cacheKey);
 
-  if (!shouldRestoreCache) {
-    core.info("restore-cache is false. Skipping restore cache step.");
+  if (!inputs.restoreCache) {
+    log.info("restore-cache is false. Skipping restore cache step.");
     core.setOutput("python-cache-hit", false);
     return;
   }
 
-  if (cacheLocalPath === undefined) {
+  if (inputs.cacheLocalPath === undefined) {
     throw new Error(
       "cache-local-path is not set. Cannot restore cache without a valid cache path.",
     );
@@ -37,15 +33,15 @@ export async function restoreCache(pythonVersion?: string): Promise<void> {
 
   await restoreCacheFromKey(
     cacheKey,
-    cacheLocalPath.path,
+    inputs.cacheLocalPath.path,
     STATE_CACHE_MATCHED_KEY,
     "cache-hit",
   );
 
-  if (cachePython) {
+  if (inputs.cachePython) {
     await restoreCacheFromKey(
       `${cacheKey}-python`,
-      pythonDir,
+      inputs.pythonDir,
       STATE_PYTHON_CACHE_MATCHED_KEY,
       "python-cache-hit",
     );
@@ -60,7 +56,7 @@ async function restoreCacheFromKey(
   stateKey: string,
   outputKey: string,
 ): Promise<void> {
-  core.info(
+  log.info(
     `Trying to restore cache from GitHub Actions cache with key: ${cacheKey}`,
   );
   let matchedKey: string | undefined;
@@ -68,7 +64,7 @@ async function restoreCacheFromKey(
     matchedKey = await cache.restoreCache([cachePath], cacheKey);
   } catch (err) {
     const message = (err as Error).message;
-    core.warning(message);
+    log.warning(message);
     core.setOutput(outputKey, false);
     return;
   }
@@ -76,28 +72,34 @@ async function restoreCacheFromKey(
   handleMatchResult(matchedKey, cacheKey, stateKey, outputKey);
 }
 
-async function computeKeys(pythonVersion?: string): Promise<string> {
+async function computeKeys(
+  inputs: SetupInputs,
+  pythonVersion?: string,
+): Promise<string> {
   let cacheDependencyPathHash = "-";
-  if (cacheDependencyGlob !== "") {
-    core.info(
-      `Searching files using cache dependency glob: ${cacheDependencyGlob.split("\n").join(",")}`,
+  if (inputs.cacheDependencyGlob !== "") {
+    log.info(
+      `Searching files using cache dependency glob: ${inputs.cacheDependencyGlob.split("\n").join(",")}`,
+    );
+    cacheDependencyPathHash += await hashFiles(
+      inputs.cacheDependencyGlob,
+      true,
     );
-    cacheDependencyPathHash += await hashFiles(cacheDependencyGlob, true);
     if (cacheDependencyPathHash === "-") {
-      core.warning(
-        `No file matched to [${cacheDependencyGlob.split("\n").join(",")}]. The cache will never get invalidated. Make sure you have checked out the target repository and configured the cache-dependency-glob input correctly.`,
+      log.warning(
+        `No file matched to [${inputs.cacheDependencyGlob.split("\n").join(",")}]. The cache will never get invalidated. Make sure you have checked out the target repository and configured the cache-dependency-glob input correctly.`,
       );
     }
   }
   if (cacheDependencyPathHash === "-") {
     cacheDependencyPathHash = "-no-dependency-glob";
   }
-  const suffix = cacheSuffix ? `-${cacheSuffix}` : "";
+  const suffix = inputs.cacheSuffix ? `-${inputs.cacheSuffix}` : "";
   const version = pythonVersion ?? "unknown";
   const platform = await getPlatform();
   const osNameVersion = getOSNameVersion();
-  const pruned = pruneCache ? "-pruned" : "";
-  const python = cachePython ? "-py" : "";
+  const pruned = inputs.pruneCache ? "-pruned" : "";
+  const python = inputs.cachePython ? "-py" : "";
   return `setup-uv-${CACHE_VERSION}-${getArch()}-${platform}-${osNameVersion}-${version}${pruned}${python}${cacheDependencyPathHash}${suffix}`;
 }
 
@@ -108,12 +110,12 @@ function handleMatchResult(
   outputKey: string,
 ): void {
   if (!matchedKey) {
-    core.info(`No GitHub Actions cache found for key: ${primaryKey}`);
+    log.info(`No GitHub Actions cache found for key: ${primaryKey}`);
     core.setOutput(outputKey, false);
     return;
   }
 
   core.saveState(stateKey, matchedKey);
-  core.info(`cache restored from GitHub Actions cache with key: ${matchedKey}`);
+  log.info(`cache restored from GitHub Actions cache with key: ${matchedKey}`);
   core.setOutput(outputKey, true);
 }

src/download/checksum/checksum.ts

@@ -6,33 +6,35 @@ import type { Architecture, Platform } from "../../utils/platforms";
 import { KNOWN_CHECKSUMS } from "./known-checksums";
 
 export async function validateChecksum(
-  checkSum: string | undefined,
+  checksum: string | undefined,
   downloadPath: string,
   arch: Architecture,
   platform: Platform,
   version: string,
 ): Promise<void> {
-  let isValid: boolean | undefined;
-  if (checkSum !== undefined && checkSum !== "") {
-    isValid = await validateFileCheckSum(downloadPath, checkSum);
-  } else {
-    core.debug("Checksum not provided. Checking known checksums.");
-    const key = `${arch}-${platform}-${version}`;
-    if (key in KNOWN_CHECKSUMS) {
-      const knownChecksum = KNOWN_CHECKSUMS[`${arch}-${platform}-${version}`];
-      core.debug(`Checking checksum for ${arch}-${platform}-${version}.`);
-      isValid = await validateFileCheckSum(downloadPath, knownChecksum);
-    } else {
-      core.debug(`No known checksum found for ${key}.`);
-    }
+  const key = `${arch}-${platform}-${version}`;
+  const hasProvidedChecksum = checksum !== undefined && checksum !== "";
+  const checksumToUse = hasProvidedChecksum ? checksum : KNOWN_CHECKSUMS[key];
+
+  if (checksumToUse === undefined) {
+    core.debug(`No checksum found for ${key}.`);
+    return;
   }
 
-  if (isValid === false) {
-    throw new Error(`Checksum for ${downloadPath} did not match ${checkSum}.`);
-  }
-  if (isValid === true) {
-    core.debug(`Checksum for ${downloadPath} is valid.`);
+  const checksumSource = hasProvidedChecksum
+    ? "provided checksum"
+    : `KNOWN_CHECKSUMS entry for ${key}`;
+
+  core.debug(`Validating checksum using ${checksumSource}.`);
+  const isValid = await validateFileCheckSum(downloadPath, checksumToUse);
+
+  if (!isValid) {
+    throw new Error(
+      `Checksum for ${downloadPath} did not match ${checksumToUse}.`,
+    );
   }
+
+  core.debug(`Checksum for ${downloadPath} is valid.`);
 }
 
 async function validateFileCheckSum(

src/download/checksum/update-known-checksums.ts

@@ -1,59 +1,34 @@
 import { promises as fs } from "node:fs";
-import * as tc from "@actions/tool-cache";
-import { KNOWN_CHECKSUMS } from "./known-checksums";
+
+export interface ChecksumEntry {
+  key: string;
+  checksum: string;
+}
+
 export async function updateChecksums(
   filePath: string,
-  downloadUrls: string[],
+  checksumEntries: ChecksumEntry[],
 ): Promise<void> {
-  await fs.rm(filePath);
-  await fs.appendFile(
-    filePath,
-    "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n",
-  );
-  let firstLine = true;
-  for (const downloadUrl of downloadUrls) {
-    const key = getKey(downloadUrl);
-    if (key === undefined) {
+  const deduplicatedEntries = new Map<string, string>();
+
+  for (const entry of checksumEntries) {
+    if (deduplicatedEntries.has(entry.key)) {
       continue;
     }
-    const checksum = await getOrDownloadChecksum(key, downloadUrl);
-    if (!firstLine) {
-      await fs.appendFile(filePath, ",\n");
-    }
-    await fs.appendFile(filePath, `  "${key}":\n    "${checksum}"`);
-    firstLine = false;
-  }
-  await fs.appendFile(filePath, ",\n};\n");
-}
 
-function getKey(downloadUrl: string): string | undefined {
-  // https://github.com/astral-sh/uv/releases/download/0.3.2/uv-aarch64-apple-darwin.tar.gz.sha256
-  const parts = downloadUrl.split("/");
-  const fileName = parts[parts.length - 1];
-  if (fileName.startsWith("source")) {
-    return undefined;
+    deduplicatedEntries.set(entry.key, entry.checksum);
   }
-  const name = fileName.split(".")[0].split("uv-")[1];
-  const version = parts[parts.length - 2];
-  return `${name}-${version}`;
-}
 
-async function getOrDownloadChecksum(
-  key: string,
-  downloadUrl: string,
-): Promise<string> {
-  let checksum = "";
-  if (key in KNOWN_CHECKSUMS) {
-    checksum = KNOWN_CHECKSUMS[key];
-  } else {
-    const content = await downloadAssetContent(downloadUrl);
-    checksum = content.split(" ")[0].trim();
-  }
-  return checksum;
-}
+  const body = [...deduplicatedEntries.entries()]
+    .map(([key, checksum]) => `  "${key}":\n    "${checksum}"`)
+    .join(",\n");
 
-async function downloadAssetContent(downloadUrl: string): Promise<string> {
-  const downloadPath = await tc.downloadTool(downloadUrl);
-  const content = await fs.readFile(downloadPath, "utf8");
-  return content;
+  const content =
+    "// AUTOGENERATED_DO_NOT_EDIT\n" +
+    "export const KNOWN_CHECKSUMS: { [key: string]: string } = {\n" +
+    body +
+    (body === "" ? "" : ",\n") +
+    "};\n";
+
+  await fs.writeFile(filePath, content);
 }

src/download/download-version.ts

@@ -2,20 +2,18 @@ import { promises as fs } from "node:fs";
 import * as path from "node:path";
 import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
-import type { Endpoints } from "@octokit/types";
-import * as pep440 from "@renovatebot/pep440";
-import * as semver from "semver";
-import { OWNER, REPO, TOOL_CACHE_NAME } from "../utils/constants";
-import { Octokit } from "../utils/octokit";
+import {
+  ASTRAL_MIRROR_PREFIX,
+  GITHUB_RELEASES_PREFIX,
+  TOOL_CACHE_NAME,
+  VERSIONS_MANIFEST_URL,
+} from "../utils/constants";
+import * as log from "../utils/logging";
 import type { Architecture, Platform } from "../utils/platforms";
 import { validateChecksum } from "./checksum/checksum";
-import {
-  getDownloadUrl,
-  getLatestKnownVersion as getLatestVersionInManifest,
-} from "./version-manifest";
+import { getArtifact } from "./manifest";
 
-type Release =
-  Endpoints["GET /repos/{owner}/{repo}/releases"]["response"]["data"][number];
+export { resolveVersion } from "../version/resolve";
 
 export function tryGetFromToolCache(
   arch: Architecture,
@@ -32,90 +30,117 @@ export function tryGetFromToolCache(
   return { installedPath, version: resolvedVersion };
 }
 
-export async function downloadVersionFromGithub(
+export async function downloadVersion(
   platform: Platform,
   arch: Architecture,
   version: string,
-  checkSum: string | undefined,
+  checksum: string | undefined,
   githubToken: string,
+  manifestUrl?: string,
+  downloadFromAstralMirror = true,
 ): Promise<{ version: string; cachedToolDir: string }> {
-  const artifact = `uv-${arch}-${platform}`;
-  const extension = getExtension(platform);
-  const downloadUrl = `https://github.com/${OWNER}/${REPO}/releases/download/${version}/${artifact}${extension}`;
-  return await downloadVersion(
-    downloadUrl,
-    artifact,
-    platform,
-    arch,
-    version,
-    checkSum,
-    githubToken,
-  );
-}
+  const artifact = await getArtifact(version, arch, platform, manifestUrl);
 
-export async function downloadVersionFromManifest(
-  manifestUrl: string | undefined,
-  platform: Platform,
-  arch: Architecture,
-  version: string,
-  checkSum: string | undefined,
-  githubToken: string,
-): Promise<{ version: string; cachedToolDir: string }> {
-  const downloadUrl = await getDownloadUrl(
-    manifestUrl,
-    version,
-    arch,
-    platform,
-  );
-  if (!downloadUrl) {
-    core.info(
-      `manifest-file does not contain version ${version}, arch ${arch}, platform ${platform}. Falling back to GitHub releases.`,
+  if (!artifact) {
+    throw new Error(
+      getMissingArtifactMessage(version, arch, platform, manifestUrl),
     );
-    return await downloadVersionFromGithub(
+  }
+
+  // For the default astral-sh/versions source, checksum validation relies on
+  // user input or the built-in KNOWN_CHECKSUMS table, not manifest sha256 values.
+  const resolvedChecksum =
+    manifestUrl === undefined
+      ? checksum
+      : resolveChecksum(checksum, artifact.checksum);
+
+  const mirrorUrl = downloadFromAstralMirror
+    ? rewriteToMirror(artifact.downloadUrl)
+    : undefined;
+  const downloadUrl = mirrorUrl ?? artifact.downloadUrl;
+
+  try {
+    return await downloadArtifact(
+      downloadUrl,
+      `uv-${arch}-${platform}`,
       platform,
       arch,
       version,
-      checkSum,
-      githubToken,
+      resolvedChecksum,
+      githubTokenForUrl(downloadUrl, githubToken),
+    );
+  } catch (err) {
+    if (mirrorUrl === undefined) {
+      throw err;
+    }
+
+    log.warning(
+      `Failed to download from mirror, falling back to GitHub Releases: ${(err as Error).message}`,
+    );
+
+    return await downloadArtifact(
+      artifact.downloadUrl,
+      `uv-${arch}-${platform}`,
+      platform,
+      arch,
+      version,
+      resolvedChecksum,
+      githubTokenForUrl(artifact.downloadUrl, githubToken),
     );
   }
-  return await downloadVersion(
-    downloadUrl,
-    `uv-${arch}-${platform}`,
-    platform,
-    arch,
-    version,
-    checkSum,
-    githubToken,
-  );
 }
 
-async function downloadVersion(
+/**
+ * Rewrite a GitHub Releases URL to the Astral mirror.
+ * Returns `undefined` if the URL does not match the expected GitHub prefix.
+ */
+export function rewriteToMirror(url: string): string | undefined {
+  if (!url.startsWith(GITHUB_RELEASES_PREFIX)) {
+    return undefined;
+  }
+
+  return ASTRAL_MIRROR_PREFIX + url.slice(GITHUB_RELEASES_PREFIX.length);
+}
+
+function githubTokenForUrl(
+  downloadUrl: string,
+  githubToken: string,
+): string | undefined {
+  try {
+    return new URL(downloadUrl).origin === "https://github.com"
+      ? githubToken
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+async function downloadArtifact(
   downloadUrl: string,
   artifactName: string,
   platform: Platform,
   arch: Architecture,
   version: string,
-  checkSum: string | undefined,
-  githubToken: string,
+  checksum: string | undefined,
+  githubToken: string | undefined,
 ): Promise<{ version: string; cachedToolDir: string }> {
-  core.info(`Downloading uv from "${downloadUrl}" ...`);
+  log.info(`Downloading uv from "${downloadUrl}" ...`);
   const downloadPath = await tc.downloadTool(
     downloadUrl,
     undefined,
     githubToken,
   );
-  await validateChecksum(checkSum, downloadPath, arch, platform, version);
+  await validateChecksum(checksum, downloadPath, arch, platform, version);
 
   let uvDir: string;
   if (platform === "pc-windows-msvc") {
-    // On windows extracting the zip does not create an intermediate directory
+    // On windows extracting the zip does not create an intermediate directory.
     try {
       // Try tar first as it's much faster, but only bsdtar supports zip files,
-      // so this my fail if another tar, like gnu tar, ends up being used.
+      // so this may fail if another tar, like gnu tar, ends up being used.
       uvDir = await tc.extractTar(downloadPath, undefined, "x");
     } catch (err) {
-      core.info(
+      log.info(
         `Extracting with tar failed, falling back to zip extraction: ${(err as Error).message}`,
       );
       const extension = getExtension(platform);
@@ -127,177 +152,38 @@ async function downloadVersion(
     const extractedDir = await tc.extractTar(downloadPath);
     uvDir = path.join(extractedDir, artifactName);
   }
+
   const cachedToolDir = await tc.cacheDir(
     uvDir,
     TOOL_CACHE_NAME,
     version,
     arch,
   );
-  return { cachedToolDir, version: version };
+  return { cachedToolDir, version };
+}
+
+function getMissingArtifactMessage(
+  version: string,
+  arch: Architecture,
+  platform: Platform,
+  manifestUrl?: string,
+): string {
+  if (manifestUrl === undefined) {
+    return `Could not find artifact for version ${version}, arch ${arch}, platform ${platform} in ${VERSIONS_MANIFEST_URL} .`;
+  }
+
+  return `manifest-file does not contain version ${version}, arch ${arch}, platform ${platform}.`;
+}
+
+function resolveChecksum(
+  checksum: string | undefined,
+  manifestChecksum: string,
+): string {
+  return checksum !== undefined && checksum !== ""
+    ? checksum
+    : manifestChecksum;
 }
 
 function getExtension(platform: Platform): string {
   return platform === "pc-windows-msvc" ? ".zip" : ".tar.gz";
 }
-
-export async function resolveVersion(
-  versionInput: string,
-  manifestFile: string | undefined,
-  githubToken: string,
-  resolutionStrategy: "highest" | "lowest" = "highest",
-): Promise<string> {
-  core.debug(`Resolving version: ${versionInput}`);
-  let version: string;
-  const isSimpleMinimumVersionSpecifier =
-    versionInput.includes(">") && !versionInput.includes(",");
-  const resolveVersionSpecifierToLatest =
-    isSimpleMinimumVersionSpecifier && resolutionStrategy === "highest";
-  if (resolveVersionSpecifierToLatest) {
-    core.info("Found minimum version specifier, using latest version");
-  }
-  if (manifestFile) {
-    version =
-      versionInput === "latest" || resolveVersionSpecifierToLatest
-        ? await getLatestVersionInManifest(manifestFile)
-        : versionInput;
-  } else {
-    version =
-      versionInput === "latest" || resolveVersionSpecifierToLatest
-        ? await getLatestVersion(githubToken)
-        : versionInput;
-  }
-  if (tc.isExplicitVersion(version)) {
-    core.debug(`Version ${version} is an explicit version.`);
-    if (resolveVersionSpecifierToLatest) {
-      if (!pep440.satisfies(version, versionInput)) {
-        throw new Error(`No version found for ${versionInput}`);
-      }
-    }
-    return version;
-  }
-  const availableVersions = await getAvailableVersions(githubToken);
-  core.debug(`Available versions: ${availableVersions}`);
-  const resolvedVersion =
-    resolutionStrategy === "lowest"
-      ? minSatisfying(availableVersions, version)
-      : maxSatisfying(availableVersions, version);
-  if (resolvedVersion === undefined) {
-    throw new Error(`No version found for ${version}`);
-  }
-  return resolvedVersion;
-}
-
-async function getAvailableVersions(githubToken: string): Promise<string[]> {
-  core.info("Getting available versions from GitHub API...");
-  try {
-    const octokit = new Octokit({
-      auth: githubToken,
-    });
-    return await getReleaseTagNames(octokit);
-  } catch (err) {
-    if ((err as Error).message.includes("Bad credentials")) {
-      core.info(
-        "No (valid) GitHub token provided. Falling back to anonymous. Requests might be rate limited.",
-      );
-      const octokit = new Octokit();
-      return await getReleaseTagNames(octokit);
-    }
-    throw err;
-  }
-}
-
-async function getReleaseTagNames(octokit: Octokit): Promise<string[]> {
-  const response: Release[] = await octokit.paginate(
-    octokit.rest.repos.listReleases,
-    {
-      owner: OWNER,
-      repo: REPO,
-    },
-  );
-  const releaseTagNames = response.map((release) => release.tag_name);
-  if (releaseTagNames.length === 0) {
-    throw Error(
-      "Github API request failed while getting releases. Check the GitHub status page for outages. Try again later.",
-    );
-  }
-  return releaseTagNames;
-}
-
-async function getLatestVersion(githubToken: string) {
-  core.info("Getting latest version from GitHub API...");
-  const octokit = new Octokit({
-    auth: githubToken,
-  });
-
-  let latestRelease: { tag_name: string } | undefined;
-  try {
-    latestRelease = await getLatestRelease(octokit);
-  } catch (err) {
-    if ((err as Error).message.includes("Bad credentials")) {
-      core.info(
-        "No (valid) GitHub token provided. Falling back to anonymous. Requests might be rate limited.",
-      );
-      const octokit = new Octokit();
-      latestRelease = await getLatestRelease(octokit);
-    } else {
-      core.error(
-        "Github API request failed while getting latest release. Check the GitHub status page for outages. Try again later.",
-      );
-      throw err;
-    }
-  }
-
-  if (!latestRelease) {
-    throw new Error("Could not determine latest release.");
-  }
-  core.debug(`Latest version: ${latestRelease.tag_name}`);
-  return latestRelease.tag_name;
-}
-
-async function getLatestRelease(octokit: Octokit) {
-  const { data: latestRelease } = await octokit.rest.repos.getLatestRelease({
-    owner: OWNER,
-    repo: REPO,
-  });
-  return latestRelease;
-}
-
-function maxSatisfying(
-  versions: string[],
-  version: string,
-): string | undefined {
-  const maxSemver = tc.evaluateVersions(versions, version);
-  if (maxSemver !== "") {
-    core.debug(`Found a version that satisfies the semver range: ${maxSemver}`);
-    return maxSemver;
-  }
-  const maxPep440 = pep440.maxSatisfying(versions, version);
-  if (maxPep440 !== null) {
-    core.debug(
-      `Found a version that satisfies the pep440 specifier: ${maxPep440}`,
-    );
-    return maxPep440;
-  }
-  return undefined;
-}
-
-function minSatisfying(
-  versions: string[],
-  version: string,
-): string | undefined {
-  // For semver, we need to use a different approach since tc.evaluateVersions only returns max
-  // Let's use semver directly for min satisfying
-  const minSemver = semver.minSatisfying(versions, version);
-  if (minSemver !== null) {
-    core.debug(`Found a version that satisfies the semver range: ${minSemver}`);
-    return minSemver;
-  }
-  const minPep440 = pep440.minSatisfying(versions, version);
-  if (minPep440 !== null) {
-    core.debug(
-      `Found a version that satisfies the pep440 specifier: ${minPep440}`,
-    );
-    return minPep440;
-  }
-  return undefined;
-}

src/download/manifest.ts

@@ -0,0 +1,211 @@
+import * as core from "@actions/core";
+import { VERSIONS_MANIFEST_URL } from "../utils/constants";
+import { fetch } from "../utils/fetch";
+import * as log from "../utils/logging";
+import { selectDefaultVariant } from "./variant-selection";
+
+export interface ManifestArtifact {
+  platform: string;
+  variant?: string;
+  url: string;
+  archive_format: string;
+  sha256: string;
+}
+
+export interface ManifestVersion {
+  version: string;
+  artifacts: ManifestArtifact[];
+}
+
+export interface ArtifactResult {
+  archiveFormat: string;
+  checksum: string;
+  downloadUrl: string;
+}
+
+const cachedManifestData = new Map<string, ManifestVersion[]>();
+
+export async function fetchManifest(
+  manifestUrl: string = VERSIONS_MANIFEST_URL,
+): Promise<ManifestVersion[]> {
+  const cachedVersions = cachedManifestData.get(manifestUrl);
+  if (cachedVersions !== undefined) {
+    core.debug(`Using cached manifest data from ${manifestUrl}`);
+    return cachedVersions;
+  }
+
+  log.info(`Fetching manifest data from ${manifestUrl} ...`);
+  const response = await fetch(manifestUrl, {});
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch manifest data: ${response.status} ${response.statusText}`,
+    );
+  }
+
+  const body = await response.text();
+  const versions = parseManifest(body, manifestUrl);
+  cachedManifestData.set(manifestUrl, versions);
+  return versions;
+}
+
+export function parseManifest(
+  data: string,
+  sourceDescription: string,
+): ManifestVersion[] {
+  const trimmed = data.trim();
+  if (trimmed === "") {
+    throw new Error(`Manifest at ${sourceDescription} is empty.`);
+  }
+
+  if (trimmed.startsWith("[")) {
+    throw new Error(
+      `Legacy JSON array manifests are no longer supported in ${sourceDescription}. Use the astral-sh/versions manifest format instead.`,
+    );
+  }
+
+  const versions: ManifestVersion[] = [];
+
+  for (const [index, line] of data.split("\n").entries()) {
+    const record = line.trim();
+    if (record === "") {
+      continue;
+    }
+
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(record);
+    } catch (error) {
+      throw new Error(
+        `Failed to parse manifest data from ${sourceDescription} at line ${index + 1}: ${(error as Error).message}`,
+      );
+    }
+
+    if (!isManifestVersion(parsed)) {
+      throw new Error(
+        `Invalid manifest record in ${sourceDescription} at line ${index + 1}.`,
+      );
+    }
+
+    versions.push(parsed);
+  }
+
+  if (versions.length === 0) {
+    throw new Error(`No manifest data found in ${sourceDescription}.`);
+  }
+
+  return versions;
+}
+
+export async function getLatestVersion(
+  manifestUrl: string = VERSIONS_MANIFEST_URL,
+): Promise<string> {
+  const latestVersion = (await fetchManifest(manifestUrl))[0]?.version;
+
+  if (latestVersion === undefined) {
+    throw new Error("No versions found in manifest data");
+  }
+
+  core.debug(`Latest version from manifest: ${latestVersion}`);
+  return latestVersion;
+}
+
+export async function getAllVersions(
+  manifestUrl: string = VERSIONS_MANIFEST_URL,
+): Promise<string[]> {
+  log.info(
+    `Getting available versions from ${manifestSource(manifestUrl)} ...`,
+  );
+  const versions = await fetchManifest(manifestUrl);
+  return versions.map((versionData) => versionData.version);
+}
+
+export async function getArtifact(
+  version: string,
+  arch: string,
+  platform: string,
+  manifestUrl: string = VERSIONS_MANIFEST_URL,
+): Promise<ArtifactResult | undefined> {
+  const versions = await fetchManifest(manifestUrl);
+  const versionData = versions.find(
+    (candidate) => candidate.version === version,
+  );
+  if (!versionData) {
+    core.debug(`Version ${version} not found in manifest ${manifestUrl}`);
+    return undefined;
+  }
+
+  const targetPlatform = `${arch}-${platform}`;
+  const matchingArtifacts = versionData.artifacts.filter(
+    (candidate) => candidate.platform === targetPlatform,
+  );
+
+  if (matchingArtifacts.length === 0) {
+    core.debug(
+      `Artifact for ${targetPlatform} not found in version ${version}. Available platforms: ${versionData.artifacts
+        .map((candidate) => candidate.platform)
+        .join(", ")}`,
+    );
+    return undefined;
+  }
+
+  const artifact = selectDefaultVariant(
+    matchingArtifacts,
+    `Multiple artifacts found for ${targetPlatform} in version ${version}`,
+  );
+
+  return {
+    archiveFormat: artifact.archive_format,
+    checksum: artifact.sha256,
+    downloadUrl: artifact.url,
+  };
+}
+
+export function clearManifestCache(manifestUrl?: string): void {
+  if (manifestUrl === undefined) {
+    cachedManifestData.clear();
+    return;
+  }
+
+  cachedManifestData.delete(manifestUrl);
+}
+
+function manifestSource(manifestUrl: string): string {
+  if (manifestUrl === VERSIONS_MANIFEST_URL) {
+    return VERSIONS_MANIFEST_URL;
+  }
+
+  return `manifest-file ${manifestUrl}`;
+}
+
+function isManifestVersion(value: unknown): value is ManifestVersion {
+  if (!isRecord(value)) {
+    return false;
+  }
+
+  if (typeof value.version !== "string" || !Array.isArray(value.artifacts)) {
+    return false;
+  }
+
+  return value.artifacts.every(isManifestArtifact);
+}
+
+function isManifestArtifact(value: unknown): value is ManifestArtifact {
+  if (!isRecord(value)) {
+    return false;
+  }
+
+  const variantIsValid =
+    typeof value.variant === "string" || value.variant === undefined;
+
+  return (
+    typeof value.archive_format === "string" &&
+    typeof value.platform === "string" &&
+    typeof value.sha256 === "string" &&
+    typeof value.url === "string" &&
+    variantIsValid
+  );
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}

src/download/variant-selection.ts

@@ -0,0 +1,39 @@
+interface VariantAwareEntry {
+  variant?: string;
+}
+
+export function selectDefaultVariant<T extends VariantAwareEntry>(
+  entries: T[],
+  duplicateEntryDescription: string,
+): T {
+  const firstEntry = entries[0];
+  if (firstEntry === undefined) {
+    throw new Error("selectDefaultVariant requires at least one candidate.");
+  }
+
+  if (entries.length === 1) {
+    return firstEntry;
+  }
+
+  const defaultEntries = entries.filter((entry) =>
+    isDefaultVariant(entry.variant),
+  );
+  if (defaultEntries.length === 1) {
+    return defaultEntries[0];
+  }
+
+  throw new Error(
+    `${duplicateEntryDescription} with variants ${formatVariants(entries)}. setup-uv currently requires a single default variant for duplicate platform entries.`,
+  );
+}
+
+function isDefaultVariant(variant: string | undefined): boolean {
+  return variant === undefined || variant === "default";
+}
+
+function formatVariants<T extends VariantAwareEntry>(entries: T[]): string {
+  return entries
+    .map((entry) => entry.variant ?? "default")
+    .sort((left, right) => left.localeCompare(right))
+    .join(", ");
+}

src/download/version-manifest.ts

@@ -1,91 +0,0 @@
-import { promises as fs } from "node:fs";
-import { join } from "node:path";
-import * as core from "@actions/core";
-import * as semver from "semver";
-import { fetch } from "../utils/fetch";
-
-const localManifestFile = join(__dirname, "..", "..", "version-manifest.json");
-
-interface ManifestEntry {
-  version: string;
-  artifactName: string;
-  arch: string;
-  platform: string;
-  downloadUrl: string;
-}
-
-export async function getLatestKnownVersion(
-  manifestUrl: string | undefined,
-): Promise<string> {
-  const manifestEntries = await getManifestEntries(manifestUrl);
-  return manifestEntries.reduce((a, b) =>
-    semver.gt(a.version, b.version) ? a : b,
-  ).version;
-}
-
-export async function getDownloadUrl(
-  manifestUrl: string | undefined,
-  version: string,
-  arch: string,
-  platform: string,
-): Promise<string | undefined> {
-  const manifestEntries = await getManifestEntries(manifestUrl);
-  const entry = manifestEntries.find(
-    (entry) =>
-      entry.version === version &&
-      entry.arch === arch &&
-      entry.platform === platform,
-  );
-  return entry ? entry.downloadUrl : undefined;
-}
-
-async function getManifestEntries(
-  manifestUrl: string | undefined,
-): Promise<ManifestEntry[]> {
-  let data: string;
-  if (manifestUrl !== undefined) {
-    core.info(`Fetching manifest-file from: ${manifestUrl}`);
-    const response = await fetch(manifestUrl, {});
-    if (!response.ok) {
-      throw new Error(
-        `Failed to fetch manifest-file: ${response.status} ${response.statusText}`,
-      );
-    }
-    data = await response.text();
-  } else {
-    core.info("manifest-file not provided, reading from local file.");
-    const fileContent = await fs.readFile(localManifestFile);
-    data = fileContent.toString();
-  }
-
-  return JSON.parse(data);
-}
-
-export async function updateVersionManifest(
-  manifestUrl: string,
-  downloadUrls: string[],
-): Promise<void> {
-  const manifest: ManifestEntry[] = [];
-
-  for (const downloadUrl of downloadUrls) {
-    const urlParts = downloadUrl.split("/");
-    const version = urlParts[urlParts.length - 2];
-    const artifactName = urlParts[urlParts.length - 1];
-    if (!artifactName.startsWith("uv-")) {
-      continue;
-    }
-    if (artifactName.startsWith("uv-installer")) {
-      continue;
-    }
-    const artifactParts = artifactName.split(".")[0].split("-");
-    manifest.push({
-      arch: artifactParts[1],
-      artifactName: artifactName,
-      downloadUrl: downloadUrl,
-      platform: artifactName.split(`uv-${artifactParts[1]}-`)[1].split(".")[0],
-      version: version,
-    });
-  }
-  core.debug(`Updating manifest-file: ${JSON.stringify(manifest)}`);
-  await fs.writeFile(manifestUrl, JSON.stringify(manifest));
-}

src/hash/hash-files.ts

@@ -2,8 +2,8 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as stream from "node:stream";
 import * as util from "node:util";
-import * as core from "@actions/core";
 import { create } from "@actions/glob";
+import * as log from "../utils/logging";
 
 /**
  * Hashes files matching the given glob pattern.
@@ -19,7 +19,7 @@ export async function hashFiles(
 ): Promise<string> {
   const globber = await create(pattern);
   let hasMatch = false;
-  const writeDelegate = verbose ? core.info : core.debug;
+  const writeDelegate = verbose ? log.info : log.debug;
   const result = crypto.createHash("sha256");
   let count = 0;
   for await (const file of globber.globGenerator()) {

src/save-cache.ts

@@ -9,26 +9,40 @@ import {
   STATE_PYTHON_CACHE_MATCHED_KEY,
 } from "./cache/restore-cache";
 import { STATE_UV_PATH, STATE_UV_VERSION } from "./utils/constants";
-import {
-  cacheLocalPath,
-  cachePython,
-  enableCache,
-  ignoreNothingToCache,
-  pythonDir,
-  pruneCache as shouldPruneCache,
-  saveCache as shouldSaveCache,
-} from "./utils/inputs";
+import { loadInputs, type SetupInputs } from "./utils/inputs";
+import * as log from "./utils/logging";
+
+function formatUnexpectedFailure(error: unknown): string {
+  if (error instanceof Error) {
+    return error.stack ?? error.message;
+  }
+  return String(error);
+}
+
+function failUnexpectedly(event: string, error: unknown): never {
+  core.setFailed(`${event}: ${formatUnexpectedFailure(error)}`);
+  process.exit(1);
+}
+
+process.on("uncaughtException", (error) => {
+  failUnexpectedly("Uncaught exception", error);
+});
+
+process.on("unhandledRejection", (reason) => {
+  failUnexpectedly("Unhandled promise rejection", reason);
+});
 
 export async function run(): Promise<void> {
   try {
-    if (enableCache) {
-      if (shouldSaveCache) {
-        await saveCache();
+    const inputs = loadInputs();
+    if (inputs.enableCache) {
+      if (inputs.saveCache) {
+        await saveCache(inputs);
       } else {
-        core.info("save-cache is false. Skipping save cache step.");
+        log.info("save-cache is false. Skipping save cache step.");
       }
-      // https://github.com/nodejs/node/issues/56645#issuecomment-3077594952
-      await new Promise((resolve) => setTimeout(resolve, 50));
+      // https://github.com/nodejs/node/issues/56645#issuecomment-3924958861
+      await new Promise((resolve) => setTimeout(resolve, 100));
 
       // node will stay alive if any promises are not resolved,
       // which is a possibility if HTTP requests are dangling
@@ -43,39 +57,56 @@ export async function run(): Promise<void> {
   }
 }
 
-async function saveCache(): Promise<void> {
+async function saveCache(inputs: SetupInputs): Promise<void> {
   const cacheKey = core.getState(STATE_CACHE_KEY);
   const matchedKey = core.getState(STATE_CACHE_MATCHED_KEY);
 
   if (!cacheKey) {
-    core.warning("Error retrieving cache key from state.");
+    log.warning("Error retrieving cache key from state.");
     return;
   }
   if (matchedKey === cacheKey) {
-    core.info(`Cache hit occurred on key ${cacheKey}, not saving cache.`);
+    log.info(`Cache hit occurred on key ${cacheKey}, not saving cache.`);
   } else {
-    if (shouldPruneCache) {
+    if (inputs.pruneCache) {
       await pruneCache();
     }
 
-    const actualCachePath = getUvCachePath();
-    await saveCacheToKey(
-      cacheKey,
-      actualCachePath,
-      STATE_CACHE_MATCHED_KEY,
-      "uv cache",
-      `Cache path ${actualCachePath} does not exist on disk. This likely indicates that there are no dependencies to cache. Consider disabling the cache input if it is not needed.`,
-    );
+    const actualCachePath = getUvCachePath(inputs);
+    if (!fs.existsSync(actualCachePath)) {
+      if (inputs.ignoreNothingToCache) {
+        log.info(
+          "No cacheable uv cache paths were found. Ignoring because ignore-nothing-to-cache is enabled.",
+        );
+      } else {
+        throw new Error(
+          `Cache path ${actualCachePath} does not exist on disk. This likely indicates that there are no dependencies to cache. Consider disabling the cache input if it is not needed.`,
+        );
+      }
+    } else {
+      await saveCacheToKey(
+        cacheKey,
+        actualCachePath,
+        STATE_CACHE_MATCHED_KEY,
+        "uv cache",
+      );
+    }
   }
 
-  if (cachePython) {
+  if (inputs.cachePython) {
+    if (!fs.existsSync(inputs.pythonDir)) {
+      log.warning(
+        `Python cache path ${inputs.pythonDir} does not exist on disk. Skipping Python cache save because no managed Python installation was found. If you want uv to install managed Python instead of using a system interpreter, set UV_PYTHON_PREFERENCE=only-managed.`,
+      );
+      return;
+    }
+
     const pythonCacheKey = `${cacheKey}-python`;
     await saveCacheToKey(
       pythonCacheKey,
-      pythonDir,
+      inputs.pythonDir,
       STATE_PYTHON_CACHE_MATCHED_KEY,
       "Python cache",
-      `Python cache path ${pythonDir} does not exist on disk. This likely indicates that there are no Python installations to cache. Consider disabling the cache input if it is not needed.`,
     );
   }
 }
@@ -91,27 +122,27 @@ async function pruneCache(): Promise<void> {
     execArgs.push("--force");
   }
 
-  core.info("Pruning cache...");
+  log.info("Pruning cache...");
   const uvPath = core.getState(STATE_UV_PATH);
   await exec.exec(uvPath, execArgs, options);
 }
 
-function getUvCachePath(): string {
-  if (cacheLocalPath === undefined) {
+function getUvCachePath(inputs: SetupInputs): string {
+  if (inputs.cacheLocalPath === undefined) {
     throw new Error(
       "cache-local-path is not set. Cannot save cache without a valid cache path.",
     );
   }
   if (
     process.env.UV_CACHE_DIR &&
-    process.env.UV_CACHE_DIR !== cacheLocalPath.path
+    process.env.UV_CACHE_DIR !== inputs.cacheLocalPath.path
   ) {
-    core.warning(
-      `The environment variable UV_CACHE_DIR has been changed to "${process.env.UV_CACHE_DIR}", by an action or step running after astral-sh/setup-uv. This can lead to unexpected behavior. If you expected this to happen set the cache-local-path input to "${process.env.UV_CACHE_DIR}" instead of "${cacheLocalPath.path}".`,
+    log.warning(
+      `The environment variable UV_CACHE_DIR has been changed to "${process.env.UV_CACHE_DIR}", by an action or step running after astral-sh/setup-uv. This can lead to unexpected behavior. If you expected this to happen set the cache-local-path input to "${process.env.UV_CACHE_DIR}" instead of "${inputs.cacheLocalPath.path}".`,
     );
     return process.env.UV_CACHE_DIR;
   }
-  return cacheLocalPath.path;
+  return inputs.cacheLocalPath.path;
 }
 
 async function saveCacheToKey(
@@ -119,38 +150,17 @@ async function saveCacheToKey(
   cachePath: string,
   stateKey: string,
   cacheName: string,
-  pathNotExistErrorMessage: string,
 ): Promise<void> {
   const matchedKey = core.getState(stateKey);
 
   if (matchedKey === cacheKey) {
-    core.info(
-      `${cacheName} hit occurred on key ${cacheKey}, not saving cache.`,
-    );
+    log.info(`${cacheName} hit occurred on key ${cacheKey}, not saving cache.`);
     return;
   }
 
-  core.info(`Including ${cacheName} path: ${cachePath}`);
-  if (!fs.existsSync(cachePath) && !ignoreNothingToCache) {
-    throw new Error(pathNotExistErrorMessage);
-  }
-
-  try {
-    await cache.saveCache([cachePath], cacheKey);
-    core.info(`${cacheName} saved with key: ${cacheKey}`);
-  } catch (e) {
-    if (
-      e instanceof Error &&
-      e.message ===
-        "Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved."
-    ) {
-      core.info(
-        `No cacheable ${cacheName} paths were found. Ignoring because ignore-nothing-to-save is enabled.`,
-      );
-    } else {
-      throw e;
-    }
-  }
+  log.info(`Including ${cacheName} path: ${cachePath}`);
+  await cache.saveCache([cachePath], cacheKey);
+  log.info(`${cacheName} saved with key: ${cacheKey}`);
 }
 
 run();

src/setup-uv.ts

@@ -4,41 +4,45 @@ import * as core from "@actions/core";
 import * as exec from "@actions/exec";
 import { restoreCache } from "./cache/restore-cache";
 import {
-  downloadVersionFromManifest,
-  resolveVersion,
+  downloadVersion,
   tryGetFromToolCache,
 } from "./download/download-version";
 import { STATE_UV_PATH, STATE_UV_VERSION } from "./utils/constants";
-import {
-  activateEnvironment as activateEnvironmentInput,
-  addProblemMatchers,
-  CacheLocalSource,
-  cacheLocalPath,
-  checkSum,
-  enableCache,
-  githubToken,
-  ignoreEmptyWorkdir,
-  manifestFile,
-  pythonDir,
-  pythonVersion,
-  resolutionStrategy,
-  toolBinDir,
-  toolDir,
-  versionFile as versionFileInput,
-  version as versionInput,
-  workingDirectory,
-} from "./utils/inputs";
+import { CacheLocalSource, loadInputs, type SetupInputs } from "./utils/inputs";
+import * as log from "./utils/logging";
 import {
   type Architecture,
   getArch,
   getPlatform,
   type Platform,
 } from "./utils/platforms";
-import { getUvVersionFromFile } from "./version/resolve";
+import { resolveUvVersion } from "./version/resolve";
 
-async function getPythonVersion(): Promise<string> {
-  if (pythonVersion !== "") {
-    return pythonVersion;
+const sourceDir = __dirname;
+
+function formatUnexpectedFailure(error: unknown): string {
+  if (error instanceof Error) {
+    return error.stack ?? error.message;
+  }
+  return String(error);
+}
+
+function failUnexpectedly(event: string, error: unknown): never {
+  core.setFailed(`${event}: ${formatUnexpectedFailure(error)}`);
+  process.exit(1);
+}
+
+process.on("uncaughtException", (error) => {
+  failUnexpectedly("Uncaught exception", error);
+});
+
+process.on("unhandledRejection", (reason) => {
+  failUnexpectedly("Unhandled promise rejection", reason);
+});
+
+async function getPythonVersion(inputs: SetupInputs): Promise<string> {
+  if (inputs.pythonVersion !== "") {
+    return inputs.pythonVersion;
   }
 
   let output = "";
@@ -52,7 +56,7 @@ async function getPythonVersion(): Promise<string> {
   };
 
   try {
-    const execArgs = ["python", "find", "--directory", workingDirectory];
+    const execArgs = ["python", "find", "--directory", inputs.workingDirectory];
     await exec.exec("uv", execArgs, options);
     const pythonPath = output.trim();
 
@@ -68,54 +72,55 @@ async function getPythonVersion(): Promise<string> {
 }
 
 async function run(): Promise<void> {
-  detectEmptyWorkdir();
-  const platform = await getPlatform();
-  const arch = getArch();
-
   try {
+    const inputs = loadInputs();
+    detectEmptyWorkdir(inputs);
+    const platform = await getPlatform();
+    const arch = getArch();
+
     if (platform === undefined) {
       throw new Error(`Unsupported platform: ${process.platform}`);
     }
     if (arch === undefined) {
       throw new Error(`Unsupported architecture: ${process.arch}`);
     }
-    const setupResult = await setupUv(platform, arch, checkSum, githubToken);
+    const setupResult = await setupUv(inputs, platform, arch);
 
-    addToolBinToPath();
+    addToolBinToPath(inputs);
     addUvToPathAndOutput(setupResult.uvDir);
-    setToolDir();
-    addPythonDirToPath();
-    setupPython();
-    await activateEnvironment();
-    addMatchers();
-    setCacheDir();
+    setToolDir(inputs);
+    addPythonDirToPath(inputs);
+    setupPython(inputs);
+    await activateEnvironment(inputs);
+    addMatchers(inputs);
+    setCacheDir(inputs);
 
     core.setOutput("uv-version", setupResult.version);
     core.saveState(STATE_UV_VERSION, setupResult.version);
-    core.info(`Successfully installed uv version ${setupResult.version}`);
+    log.info(`Successfully installed uv version ${setupResult.version}`);
 
-    const pythonVersion = await getPythonVersion();
-    core.setOutput("python-version", pythonVersion);
+    const detectedPythonVersion = await getPythonVersion(inputs);
+    core.setOutput("python-version", detectedPythonVersion);
 
-    if (enableCache) {
-      await restoreCache(pythonVersion);
+    if (inputs.enableCache) {
+      await restoreCache(inputs, detectedPythonVersion);
     }
-    // https://github.com/nodejs/node/issues/56645#issuecomment-3077594952
-    await new Promise((resolve) => setTimeout(resolve, 50));
+    // https://github.com/nodejs/node/issues/56645#issuecomment-3924958861
+    await new Promise((resolve) => setTimeout(resolve, 100));
     process.exit(0);
   } catch (err) {
     core.setFailed((err as Error).message);
   }
 }
 
-function detectEmptyWorkdir(): void {
-  if (fs.readdirSync(workingDirectory).length === 0) {
-    if (ignoreEmptyWorkdir) {
-      core.info(
+function detectEmptyWorkdir(inputs: SetupInputs): void {
+  if (fs.readdirSync(inputs.workingDirectory).length === 0) {
+    if (inputs.ignoreEmptyWorkdir) {
+      log.info(
         "Empty workdir detected. Ignoring because ignore-empty-workdir is enabled",
       );
     } else {
-      core.warning(
+      log.warning(
         "Empty workdir detected. This may cause unexpected behavior. You can enable ignore-empty-workdir to mute this warning.",
       );
     }
@@ -123,184 +128,156 @@ function detectEmptyWorkdir(): void {
 }
 
 async function setupUv(
+  inputs: SetupInputs,
   platform: Platform,
   arch: Architecture,
-  checkSum: string | undefined,
-  githubToken: string,
 ): Promise<{ uvDir: string; version: string }> {
-  const resolvedVersion = await determineVersion(manifestFile);
+  const resolvedVersion = await resolveUvVersion({
+    manifestFile: inputs.manifestFile,
+    resolutionStrategy: inputs.resolutionStrategy,
+    version: inputs.version,
+    versionFile: inputs.versionFile,
+    workingDirectory: inputs.workingDirectory,
+  });
   const toolCacheResult = tryGetFromToolCache(arch, resolvedVersion);
   if (toolCacheResult.installedPath) {
-    core.info(`Found uv in tool-cache for ${toolCacheResult.version}`);
+    log.info(`Found uv in tool-cache for ${toolCacheResult.version}`);
     return {
       uvDir: toolCacheResult.installedPath,
       version: toolCacheResult.version,
     };
   }
 
-  const downloadVersionResult = await downloadVersionFromManifest(
-    manifestFile,
+  const downloadResult = await downloadVersion(
     platform,
     arch,
     resolvedVersion,
-    checkSum,
-    githubToken,
+    inputs.checksum,
+    inputs.githubToken,
+    inputs.manifestFile,
+    inputs.downloadFromAstralMirror,
   );
 
   return {
-    uvDir: downloadVersionResult.cachedToolDir,
-    version: downloadVersionResult.version,
+    uvDir: downloadResult.cachedToolDir,
+    version: downloadResult.version,
   };
 }
 
-async function determineVersion(
-  manifestFile: string | undefined,
-): Promise<string> {
-  if (versionInput !== "") {
-    return await resolveVersion(
-      versionInput,
-      manifestFile,
-      githubToken,
-      resolutionStrategy,
-    );
-  }
-  if (versionFileInput !== "") {
-    const versionFromFile = getUvVersionFromFile(versionFileInput);
-    if (versionFromFile === undefined) {
-      throw new Error(
-        `Could not determine uv version from file: ${versionFileInput}`,
-      );
-    }
-    return await resolveVersion(
-      versionFromFile,
-      manifestFile,
-      githubToken,
-      resolutionStrategy,
-    );
-  }
-  const versionFromUvToml = getUvVersionFromFile(
-    `${workingDirectory}${path.sep}uv.toml`,
-  );
-  const versionFromPyproject = getUvVersionFromFile(
-    `${workingDirectory}${path.sep}pyproject.toml`,
-  );
-  if (versionFromUvToml === undefined && versionFromPyproject === undefined) {
-    core.info(
-      "Could not determine uv version from uv.toml or pyproject.toml. Falling back to latest.",
-    );
-  }
-  return await resolveVersion(
-    versionFromUvToml || versionFromPyproject || "latest",
-    manifestFile,
-    githubToken,
-    resolutionStrategy,
-  );
-}
-
 function addUvToPathAndOutput(cachedPath: string): void {
   core.setOutput("uv-path", `${cachedPath}${path.sep}uv`);
   core.saveState(STATE_UV_PATH, `${cachedPath}${path.sep}uv`);
   core.setOutput("uvx-path", `${cachedPath}${path.sep}uvx`);
   if (process.env.UV_NO_MODIFY_PATH !== undefined) {
-    core.info("UV_NO_MODIFY_PATH is set, not modifying PATH");
+    log.info("UV_NO_MODIFY_PATH is set, not modifying PATH");
   } else {
     core.addPath(cachedPath);
-    core.info(`Added ${cachedPath} to the path`);
+    log.info(`Added ${cachedPath} to the path`);
   }
 }
 
-function addToolBinToPath(): void {
-  if (toolBinDir !== undefined) {
-    core.exportVariable("UV_TOOL_BIN_DIR", toolBinDir);
-    core.info(`Set UV_TOOL_BIN_DIR to ${toolBinDir}`);
+function addToolBinToPath(inputs: SetupInputs): void {
+  if (inputs.toolBinDir !== undefined) {
+    core.exportVariable("UV_TOOL_BIN_DIR", inputs.toolBinDir);
+    log.info(`Set UV_TOOL_BIN_DIR to ${inputs.toolBinDir}`);
     if (process.env.UV_NO_MODIFY_PATH !== undefined) {
-      core.info(`UV_NO_MODIFY_PATH is set, not adding ${toolBinDir} to path`);
+      log.info(
+        `UV_NO_MODIFY_PATH is set, not adding ${inputs.toolBinDir} to path`,
+      );
     } else {
-      core.addPath(toolBinDir);
-      core.info(`Added ${toolBinDir} to the path`);
+      core.addPath(inputs.toolBinDir);
+      log.info(`Added ${inputs.toolBinDir} to the path`);
     }
   } else {
     if (process.env.UV_NO_MODIFY_PATH !== undefined) {
-      core.info("UV_NO_MODIFY_PATH is set, not adding user local bin to path");
+      log.info("UV_NO_MODIFY_PATH is set, not adding user local bin to path");
       return;
     }
     if (process.env.XDG_BIN_HOME !== undefined) {
       core.addPath(process.env.XDG_BIN_HOME);
-      core.info(`Added ${process.env.XDG_BIN_HOME} to the path`);
+      log.info(`Added ${process.env.XDG_BIN_HOME} to the path`);
     } else if (process.env.XDG_DATA_HOME !== undefined) {
       core.addPath(`${process.env.XDG_DATA_HOME}/../bin`);
-      core.info(`Added ${process.env.XDG_DATA_HOME}/../bin to the path`);
+      log.info(`Added ${process.env.XDG_DATA_HOME}/../bin to the path`);
     } else {
       core.addPath(`${process.env.HOME}/.local/bin`);
-      core.info(`Added ${process.env.HOME}/.local/bin to the path`);
+      log.info(`Added ${process.env.HOME}/.local/bin to the path`);
     }
   }
 }
 
-function setToolDir(): void {
-  if (toolDir !== undefined) {
-    core.exportVariable("UV_TOOL_DIR", toolDir);
-    core.info(`Set UV_TOOL_DIR to ${toolDir}`);
+function setToolDir(inputs: SetupInputs): void {
+  if (inputs.toolDir !== undefined) {
+    core.exportVariable("UV_TOOL_DIR", inputs.toolDir);
+    log.info(`Set UV_TOOL_DIR to ${inputs.toolDir}`);
   }
 }
 
-function addPythonDirToPath(): void {
-  core.exportVariable("UV_PYTHON_INSTALL_DIR", pythonDir);
-  core.info(`Set UV_PYTHON_INSTALL_DIR to ${pythonDir}`);
+function addPythonDirToPath(inputs: SetupInputs): void {
+  core.exportVariable("UV_PYTHON_INSTALL_DIR", inputs.pythonDir);
+  log.info(`Set UV_PYTHON_INSTALL_DIR to ${inputs.pythonDir}`);
   if (process.env.UV_NO_MODIFY_PATH !== undefined) {
-    core.info("UV_NO_MODIFY_PATH is set, not adding python dir to path");
+    log.info("UV_NO_MODIFY_PATH is set, not adding python dir to path");
   } else {
-    core.addPath(pythonDir);
-    core.info(`Added ${pythonDir} to the path`);
+    core.addPath(inputs.pythonDir);
+    log.info(`Added ${inputs.pythonDir} to the path`);
   }
 }
 
-function setupPython(): void {
-  if (pythonVersion !== "") {
-    core.exportVariable("UV_PYTHON", pythonVersion);
-    core.info(`Set UV_PYTHON to ${pythonVersion}`);
+function setupPython(inputs: SetupInputs): void {
+  if (inputs.pythonVersion !== "") {
+    core.exportVariable("UV_PYTHON", inputs.pythonVersion);
+    log.info(`Set UV_PYTHON to ${inputs.pythonVersion}`);
   }
 }
 
-async function activateEnvironment(): Promise<void> {
-  if (activateEnvironmentInput) {
+async function activateEnvironment(inputs: SetupInputs): Promise<void> {
+  if (inputs.activateEnvironment) {
     if (process.env.UV_NO_MODIFY_PATH !== undefined) {
       throw new Error(
         "UV_NO_MODIFY_PATH and activate-environment cannot be used together.",
       );
     }
-    const execArgs = ["venv", ".venv", "--directory", workingDirectory];
 
-    core.info("Activating python venv...");
-    await exec.exec("uv", execArgs);
+    log.info(`Creating and activating python venv at ${inputs.venvPath}...`);
+    const venvArgs = [
+      "venv",
+      inputs.venvPath,
+      "--directory",
+      inputs.workingDirectory,
+      "--clear",
+    ];
+    if (inputs.noProject) {
+      venvArgs.push("--no-project");
+    }
+    await exec.exec("uv", venvArgs);
 
-    const venvPath = path.resolve(`${workingDirectory}${path.sep}.venv`);
-    let venvBinPath = `${venvPath}${path.sep}bin`;
+    let venvBinPath = `${inputs.venvPath}${path.sep}bin`;
     if (process.platform === "win32") {
-      venvBinPath = `${venvPath}${path.sep}Scripts`;
+      venvBinPath = `${inputs.venvPath}${path.sep}Scripts`;
     }
     core.addPath(path.resolve(venvBinPath));
-    core.exportVariable("VIRTUAL_ENV", venvPath);
-    core.setOutput("venv", venvPath);
+    core.exportVariable("VIRTUAL_ENV", inputs.venvPath);
+    core.setOutput("venv", inputs.venvPath);
   }
 }
 
-function setCacheDir(): void {
-  if (cacheLocalPath !== undefined) {
-    if (cacheLocalPath.source === CacheLocalSource.Config) {
-      core.info(
+function setCacheDir(inputs: SetupInputs): void {
+  if (inputs.cacheLocalPath !== undefined) {
+    if (inputs.cacheLocalPath.source === CacheLocalSource.Config) {
+      log.info(
         "Using cache-dir from uv config file, not modifying UV_CACHE_DIR",
       );
       return;
     }
-    core.exportVariable("UV_CACHE_DIR", cacheLocalPath.path);
-    core.info(`Set UV_CACHE_DIR to ${cacheLocalPath.path}`);
+    core.exportVariable("UV_CACHE_DIR", inputs.cacheLocalPath.path);
+    log.info(`Set UV_CACHE_DIR to ${inputs.cacheLocalPath.path}`);
   }
 }
 
-function addMatchers(): void {
-  if (addProblemMatchers) {
-    const matchersPath = path.join(__dirname, `..${path.sep}..`, ".github");
+function addMatchers(inputs: SetupInputs): void {
+  if (inputs.addProblemMatchers) {
+    const matchersPath = path.join(sourceDir, "..", "..", ".github");
     core.info(`##[add-matcher]${path.join(matchersPath, "python.json")}`);
   }
 }

src/update-known-checksums.ts

@@ -0,0 +1,82 @@
+import * as core from "@actions/core";
+import * as semver from "semver";
+import { KNOWN_CHECKSUMS } from "./download/checksum/known-checksums";
+import {
+  type ChecksumEntry,
+  updateChecksums,
+} from "./download/checksum/update-known-checksums";
+import {
+  fetchManifest,
+  getLatestVersion,
+  type ManifestVersion,
+} from "./download/manifest";
+import * as log from "./utils/logging";
+
+const VERSION_IN_CHECKSUM_KEY_PATTERN =
+  /-(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/;
+
+async function run(): Promise<void> {
+  const checksumFilePath = process.argv.slice(2)[0];
+  if (!checksumFilePath) {
+    throw new Error(
+      "Missing checksum file path. Usage: node dist/update-known-checksums/index.cjs <checksum-file-path>",
+    );
+  }
+
+  const latestVersion = await getLatestVersion();
+  const latestKnownVersion = getLatestKnownVersionFromChecksums();
+
+  if (semver.lte(latestVersion, latestKnownVersion)) {
+    log.info(
+      `Latest release (${latestVersion}) is not newer than the latest known version (${latestKnownVersion}). Skipping update.`,
+    );
+    return;
+  }
+
+  const versions = await fetchManifest();
+  const checksumEntries = extractChecksumsFromManifest(versions);
+  await updateChecksums(checksumFilePath, checksumEntries);
+
+  core.setOutput("latest-version", latestVersion);
+}
+
+function getLatestKnownVersionFromChecksums(): string {
+  const versions = new Set<string>();
+
+  for (const key of Object.keys(KNOWN_CHECKSUMS)) {
+    const version = extractVersionFromChecksumKey(key);
+    if (version !== undefined) {
+      versions.add(version);
+    }
+  }
+
+  const latestVersion = [...versions].sort(semver.rcompare)[0];
+  if (!latestVersion) {
+    throw new Error("Could not determine latest known version from checksums.");
+  }
+
+  return latestVersion;
+}
+
+function extractVersionFromChecksumKey(key: string): string | undefined {
+  return key.match(VERSION_IN_CHECKSUM_KEY_PATTERN)?.[1];
+}
+
+function extractChecksumsFromManifest(
+  versions: ManifestVersion[],
+): ChecksumEntry[] {
+  const checksums: ChecksumEntry[] = [];
+
+  for (const version of versions) {
+    for (const artifact of version.artifacts) {
+      checksums.push({
+        checksum: artifact.sha256,
+        key: `${artifact.platform}-${version.version}`,
+      });
+    }
+  }
+
+  return checksums;
+}
+
+run();

src/update-known-versions.ts

@@ -1,63 +0,0 @@
-import * as core from "@actions/core";
-import type { Endpoints } from "@octokit/types";
-import * as semver from "semver";
-import { updateChecksums } from "./download/checksum/update-known-checksums";
-import {
-  getLatestKnownVersion,
-  updateVersionManifest,
-} from "./download/version-manifest";
-import { OWNER, REPO } from "./utils/constants";
-import { Octokit } from "./utils/octokit";
-
-type Release =
-  Endpoints["GET /repos/{owner}/{repo}/releases"]["response"]["data"][number];
-
-async function run(): Promise<void> {
-  const checksumFilePath = process.argv.slice(2)[0];
-  const versionsManifestFile = process.argv.slice(2)[1];
-  const githubToken = process.argv.slice(2)[2];
-
-  const octokit = new Octokit({
-    auth: githubToken,
-  });
-
-  const { data: latestRelease } = await octokit.rest.repos.getLatestRelease({
-    owner: OWNER,
-    repo: REPO,
-  });
-
-  const latestKnownVersion = await getLatestKnownVersion(undefined);
-
-  if (semver.lte(latestRelease.tag_name, latestKnownVersion)) {
-    core.info(
-      `Latest release (${latestRelease.tag_name}) is not newer than the latest known version (${latestKnownVersion}). Skipping update.`,
-    );
-    return;
-  }
-
-  const releases: Release[] = await octokit.paginate(
-    octokit.rest.repos.listReleases,
-    {
-      owner: OWNER,
-      repo: REPO,
-    },
-  );
-  const checksumDownloadUrls: string[] = releases.flatMap((release) =>
-    release.assets
-      .filter((asset) => asset.name.endsWith(".sha256"))
-      .map((asset) => asset.browser_download_url),
-  );
-  await updateChecksums(checksumFilePath, checksumDownloadUrls);
-
-  const artifactDownloadUrls: string[] = releases.flatMap((release) =>
-    release.assets
-      .filter((asset) => !asset.name.endsWith(".sha256"))
-      .map((asset) => asset.browser_download_url),
-  );
-
-  await updateVersionManifest(versionsManifestFile, artifactDownloadUrls);
-
-  core.setOutput("latest-version", latestRelease.tag_name);
-}
-
-run();

src/utils/config-file.ts

@@ -8,7 +8,19 @@ export function getConfigValueFromTomlFile(
   if (!fs.existsSync(filePath) || !filePath.endsWith(".toml")) {
     return undefined;
   }
+
   const fileContent = fs.readFileSync(filePath, "utf-8");
+  return getConfigValueFromTomlContent(filePath, fileContent, key);
+}
+
+export function getConfigValueFromTomlContent(
+  filePath: string,
+  fileContent: string,
+  key: string,
+): string | undefined {
+  if (!filePath.endsWith(".toml")) {
+    return undefined;
+  }
 
   if (filePath.endsWith("pyproject.toml")) {
     const tomlContent = toml.parse(fileContent) as {
@@ -16,6 +28,7 @@ export function getConfigValueFromTomlFile(
     };
     return tomlContent?.tool?.uv?.[key];
   }
+
   const tomlContent = toml.parse(fileContent) as Record<
     string,
     string | undefined

src/utils/constants.ts

@@ -1,5 +1,13 @@
-export const REPO = "uv";
-export const OWNER = "astral-sh";
 export const TOOL_CACHE_NAME = "uv";
 export const STATE_UV_PATH = "uv-path";
 export const STATE_UV_VERSION = "uv-version";
+export const VERSIONS_MANIFEST_URL =
+  "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
+
+/** GitHub Releases URL prefix for uv artifacts. */
+export const GITHUB_RELEASES_PREFIX =
+  "https://github.com/astral-sh/uv/releases/download/";
+
+/** Astral mirror URL prefix that fronts GitHub Releases for uv artifacts. */
+export const ASTRAL_MIRROR_PREFIX =
+  "https://releases.astral.sh/github/uv/releases/download/";

src/utils/fetch.ts

@@ -14,8 +14,17 @@ export function getProxyAgent() {
   return undefined;
 }
 
-export const fetch = async (url: string, opts: RequestInit) =>
-  await undiciFetch(url, {
+export const fetch = async (url: string, opts: RequestInit) => {
+  // Merge timeout signal with any existing signal from opts
+  const timeoutSignal = AbortSignal.timeout(5_000);
+  const existingSignal = opts.signal;
+  const mergedSignal = existingSignal
+    ? AbortSignal.any([timeoutSignal, existingSignal])
+    : timeoutSignal;
+
+  return await undiciFetch(url, {
     dispatcher: getProxyAgent(),
     ...opts,
+    signal: mergedSignal,
   });
+};

src/utils/inputs.ts

@@ -1,6 +1,7 @@
 import path from "node:path";
 import * as core from "@actions/core";
 import { getConfigValueFromTomlFile } from "./config-file";
+import * as log from "./logging";
 
 export enum CacheLocalSource {
   Input,
@@ -9,42 +10,133 @@ export enum CacheLocalSource {
   Default,
 }
 
-export const workingDirectory = core.getInput("working-directory");
-export const version = core.getInput("version");
-export const versionFile = getVersionFile();
-export const pythonVersion = core.getInput("python-version");
-export const activateEnvironment = core.getBooleanInput("activate-environment");
-export const checkSum = core.getInput("checksum");
-export const enableCache = getEnableCache();
-export const restoreCache = core.getInput("restore-cache") === "true";
-export const saveCache = core.getInput("save-cache") === "true";
-export const cacheSuffix = core.getInput("cache-suffix") || "";
-export const cacheLocalPath = getCacheLocalPath();
-export const cacheDependencyGlob = getCacheDependencyGlob();
-export const pruneCache = core.getInput("prune-cache") === "true";
-export const cachePython = core.getInput("cache-python") === "true";
-export const ignoreNothingToCache =
-  core.getInput("ignore-nothing-to-cache") === "true";
-export const ignoreEmptyWorkdir =
-  core.getInput("ignore-empty-workdir") === "true";
-export const toolBinDir = getToolBinDir();
-export const toolDir = getToolDir();
-export const pythonDir = getUvPythonDir();
-export const githubToken = core.getInput("github-token");
-export const manifestFile = getManifestFile();
-export const addProblemMatchers =
-  core.getInput("add-problem-matchers") === "true";
-export const resolutionStrategy = getResolutionStrategy();
+export interface CacheLocalPath {
+  path: string;
+  source: CacheLocalSource;
+}
 
-function getVersionFile(): string {
+export type ResolutionStrategy = "highest" | "lowest";
+
+export interface SetupInputs {
+  workingDirectory: string;
+  version: string;
+  versionFile: string;
+  pythonVersion: string;
+  activateEnvironment: boolean;
+  noProject: boolean;
+  venvPath: string;
+  checksum: string;
+  enableCache: boolean;
+  restoreCache: boolean;
+  saveCache: boolean;
+  cacheSuffix: string;
+  cacheLocalPath?: CacheLocalPath;
+  cacheDependencyGlob: string;
+  pruneCache: boolean;
+  cachePython: boolean;
+  ignoreNothingToCache: boolean;
+  ignoreEmptyWorkdir: boolean;
+  toolBinDir?: string;
+  toolDir?: string;
+  pythonDir: string;
+  githubToken: string;
+  manifestFile?: string;
+  downloadFromAstralMirror: boolean;
+  addProblemMatchers: boolean;
+  quiet: boolean;
+  resolutionStrategy: ResolutionStrategy;
+}
+
+export function loadInputs(): SetupInputs {
+  const workingDirectory = core.getInput("working-directory");
+  const version = core.getInput("version");
+  const versionFile = getVersionFile(workingDirectory);
+  const pythonVersion = core.getInput("python-version");
+  const activateEnvironment = core.getBooleanInput("activate-environment");
+  const noProject = core.getBooleanInput("no-project");
+  const venvPath = getVenvPath(workingDirectory, activateEnvironment);
+  const checksum = core.getInput("checksum");
+  const enableCache = getEnableCache();
+  const restoreCache = core.getInput("restore-cache") === "true";
+  const saveCache = core.getInput("save-cache") === "true";
+  const cacheSuffix = core.getInput("cache-suffix") || "";
+  const cacheLocalPath = getCacheLocalPath(
+    workingDirectory,
+    versionFile,
+    enableCache,
+  );
+  const cacheDependencyGlob = getCacheDependencyGlob(workingDirectory);
+  const pruneCache = core.getInput("prune-cache") === "true";
+  const cachePython = core.getInput("cache-python") === "true";
+  const ignoreNothingToCache =
+    core.getInput("ignore-nothing-to-cache") === "true";
+  const ignoreEmptyWorkdir = core.getInput("ignore-empty-workdir") === "true";
+  const toolBinDir = getToolBinDir(workingDirectory);
+  const toolDir = getToolDir(workingDirectory);
+  const pythonDir = getUvPythonDir();
+  const githubToken = core.getInput("github-token");
+  const manifestFile = getManifestFile();
+  const downloadFromAstralMirror =
+    core.getInput("download-from-astral-mirror") === "true";
+  const addProblemMatchers = core.getInput("add-problem-matchers") === "true";
+  const quiet = core.getInput("quiet") === "true";
+  const resolutionStrategy = getResolutionStrategy();
+
+  return {
+    activateEnvironment,
+    addProblemMatchers,
+    cacheDependencyGlob,
+    cacheLocalPath,
+    cachePython,
+    cacheSuffix,
+    checksum,
+    downloadFromAstralMirror,
+    enableCache,
+    githubToken,
+    ignoreEmptyWorkdir,
+    ignoreNothingToCache,
+    manifestFile,
+    noProject,
+    pruneCache,
+    pythonDir,
+    pythonVersion,
+    quiet,
+    resolutionStrategy,
+    restoreCache,
+    saveCache,
+    toolBinDir,
+    toolDir,
+    venvPath,
+    version,
+    versionFile,
+    workingDirectory,
+  };
+}
+
+function getVersionFile(workingDirectory: string): string {
   const versionFileInput = core.getInput("version-file");
   if (versionFileInput !== "") {
     const tildeExpanded = expandTilde(versionFileInput);
-    return resolveRelativePath(tildeExpanded);
+    return resolveRelativePath(workingDirectory, tildeExpanded);
   }
   return versionFileInput;
 }
 
+function getVenvPath(
+  workingDirectory: string,
+  activateEnvironment: boolean,
+): string {
+  const venvPathInput = core.getInput("venv-path");
+  if (venvPathInput !== "") {
+    if (!activateEnvironment) {
+      log.warning("venv-path is only used when activate-environment is true");
+    }
+    const tildeExpanded = expandTilde(venvPathInput);
+    return normalizePath(resolveRelativePath(workingDirectory, tildeExpanded));
+  }
+  return normalizePath(resolveRelativePath(workingDirectory, ".venv"));
+}
+
 function getEnableCache(): boolean {
   const enableCacheInput = core.getInput("enable-cache");
   if (enableCacheInput === "auto") {
@@ -53,11 +145,11 @@ function getEnableCache(): boolean {
   return enableCacheInput === "true";
 }
 
-function getToolBinDir(): string | undefined {
+function getToolBinDir(workingDirectory: string): string | undefined {
   const toolBinDirInput = core.getInput("tool-bin-dir");
   if (toolBinDirInput !== "") {
     const tildeExpanded = expandTilde(toolBinDirInput);
-    return resolveRelativePath(tildeExpanded);
+    return resolveRelativePath(workingDirectory, tildeExpanded);
   }
   if (process.platform === "win32") {
     if (process.env.RUNNER_TEMP !== undefined) {
@@ -70,11 +162,11 @@ function getToolBinDir(): string | undefined {
   return undefined;
 }
 
-function getToolDir(): string | undefined {
+function getToolDir(workingDirectory: string): string | undefined {
   const toolDirInput = core.getInput("tool-dir");
   if (toolDirInput !== "") {
     const tildeExpanded = expandTilde(toolDirInput);
-    return resolveRelativePath(tildeExpanded);
+    return resolveRelativePath(workingDirectory, tildeExpanded);
   }
   if (process.platform === "win32") {
     if (process.env.RUNNER_TEMP !== undefined) {
@@ -87,29 +179,31 @@ function getToolDir(): string | undefined {
   return undefined;
 }
 
-function getCacheLocalPath():
-  | {
-      path: string;
-      source: CacheLocalSource;
-    }
-  | undefined {
+function getCacheLocalPath(
+  workingDirectory: string,
+  versionFile: string,
+  enableCache: boolean,
+): CacheLocalPath | undefined {
   const cacheLocalPathInput = core.getInput("cache-local-path");
   if (cacheLocalPathInput !== "") {
     const tildeExpanded = expandTilde(cacheLocalPathInput);
     return {
-      path: resolveRelativePath(tildeExpanded),
+      path: resolveRelativePath(workingDirectory, tildeExpanded),
       source: CacheLocalSource.Input,
     };
   }
-  const cacheDirFromConfig = getCacheDirFromConfig();
+  const cacheDirFromConfig = getCacheDirFromConfig(
+    workingDirectory,
+    versionFile,
+  );
   if (cacheDirFromConfig !== undefined) {
     return { path: cacheDirFromConfig, source: CacheLocalSource.Config };
   }
   if (process.env.UV_CACHE_DIR !== undefined) {
-    core.info(`UV_CACHE_DIR is already set to ${process.env.UV_CACHE_DIR}`);
+    log.info(`UV_CACHE_DIR is already set to ${process.env.UV_CACHE_DIR}`);
     return { path: process.env.UV_CACHE_DIR, source: CacheLocalSource.Env };
   }
-  if (getEnableCache()) {
+  if (enableCache) {
     if (process.env.RUNNER_ENVIRONMENT === "github-hosted") {
       if (process.env.RUNNER_TEMP !== undefined) {
         return {
@@ -134,18 +228,21 @@ function getCacheLocalPath():
   }
 }
 
-function getCacheDirFromConfig(): string | undefined {
+function getCacheDirFromConfig(
+  workingDirectory: string,
+  versionFile: string,
+): string | undefined {
   for (const filePath of [versionFile, "uv.toml", "pyproject.toml"]) {
-    const resolvedPath = resolveRelativePath(filePath);
+    const resolvedPath = resolveRelativePath(workingDirectory, filePath);
     try {
       const cacheDir = getConfigValueFromTomlFile(resolvedPath, "cache-dir");
       if (cacheDir !== undefined) {
-        core.info(`Found cache-dir in ${resolvedPath}: ${cacheDir}`);
+        log.info(`Found cache-dir in ${resolvedPath}: ${cacheDir}`);
         return cacheDir;
       }
     } catch (err) {
       const message = (err as Error).message;
-      core.warning(`Error while parsing ${filePath}: ${message}`);
+      log.warning(`Error while parsing ${filePath}: ${message}`);
       return undefined;
     }
   }
@@ -154,7 +251,7 @@ function getCacheDirFromConfig(): string | undefined {
 
 export function getUvPythonDir(): string {
   if (process.env.UV_PYTHON_INSTALL_DIR !== undefined) {
-    core.info(
+    log.info(
       `UV_PYTHON_INSTALL_DIR is already set to ${process.env.UV_PYTHON_INSTALL_DIR}`,
     );
     return process.env.UV_PYTHON_INSTALL_DIR;
@@ -162,9 +259,8 @@ export function getUvPythonDir(): string {
   if (process.env.RUNNER_ENVIRONMENT !== "github-hosted") {
     if (process.platform === "win32") {
       return `${process.env.APPDATA}${path.sep}uv${path.sep}python`;
-    } else {
-      return `${process.env.HOME}${path.sep}.local${path.sep}share${path.sep}uv${path.sep}python`;
     }
+    return `${process.env.HOME}${path.sep}.local${path.sep}share${path.sep}uv${path.sep}python`;
   }
   if (process.env.RUNNER_TEMP !== undefined) {
     return `${process.env.RUNNER_TEMP}${path.sep}uv-python-dir`;
@@ -174,14 +270,14 @@ export function getUvPythonDir(): string {
   );
 }
 
-function getCacheDependencyGlob(): string {
+function getCacheDependencyGlob(workingDirectory: string): string {
   const cacheDependencyGlobInput = core.getInput("cache-dependency-glob");
   if (cacheDependencyGlobInput !== "") {
     return cacheDependencyGlobInput
       .split("\n")
       .map((part) => part.trim())
       .map((part) => expandTilde(part))
-      .map((part) => resolveRelativePath(part))
+      .map((part) => resolveRelativePath(workingDirectory, part))
       .join("\n");
   }
   return cacheDependencyGlobInput;
@@ -194,7 +290,23 @@ function expandTilde(input: string): string {
   return input;
 }
 
-function resolveRelativePath(inputPath: string): string {
+function normalizePath(inputPath: string): string {
+  const normalized = path.normalize(inputPath);
+  const root = path.parse(normalized).root;
+
+  // Remove any trailing path separators, except when the whole path is the root.
+  let trimmed = normalized;
+  while (trimmed.length > root.length && trimmed.endsWith(path.sep)) {
+    trimmed = trimmed.slice(0, -1);
+  }
+
+  return trimmed;
+}
+
+function resolveRelativePath(
+  workingDirectory: string,
+  inputPath: string,
+): string {
   const hasNegation = inputPath.startsWith("!");
   const pathWithoutNegation = hasNegation ? inputPath.substring(1) : inputPath;
 
@@ -214,7 +326,7 @@ function getManifestFile(): string | undefined {
   return undefined;
 }
 
-function getResolutionStrategy(): "highest" | "lowest" {
+function getResolutionStrategy(): ResolutionStrategy {
   const resolutionStrategyInput = core.getInput("resolution-strategy");
   if (resolutionStrategyInput === "lowest") {
     return "lowest";

src/utils/logging.ts

@@ -0,0 +1,21 @@
+import * as core from "@actions/core";
+
+let quiet: boolean | undefined;
+
+function isQuiet(): boolean {
+  if (quiet === undefined) {
+    quiet =
+      typeof core.getInput === "function" && core.getInput("quiet") === "true";
+  }
+  return quiet;
+}
+
+export function info(msg: string): void {
+  if (!isQuiet()) {
+    core.info(msg);
+  }
+}
+
+export const warning = core.warning;
+export const error = core.error;
+export const debug = core.debug;

src/utils/octokit.ts

@@ -1,34 +0,0 @@
-import type { OctokitOptions } from "@octokit/core";
-import { Octokit as Core } from "@octokit/core";
-import {
-  type PaginateInterface,
-  paginateRest,
-} from "@octokit/plugin-paginate-rest";
-import { legacyRestEndpointMethods } from "@octokit/plugin-rest-endpoint-methods";
-import { fetch as customFetch } from "./fetch";
-
-export type { RestEndpointMethodTypes } from "@octokit/plugin-rest-endpoint-methods";
-
-const DEFAULTS = {
-  baseUrl: "https://api.github.com",
-  userAgent: "setup-uv",
-};
-
-const OctokitWithPlugins = Core.plugin(paginateRest, legacyRestEndpointMethods);
-
-export const Octokit = OctokitWithPlugins.defaults(function buildDefaults(
-  options: OctokitOptions,
-): OctokitOptions {
-  return {
-    ...DEFAULTS,
-    ...options,
-    request: {
-      fetch: customFetch,
-      ...options.request,
-    },
-  };
-});
-
-export type Octokit = InstanceType<typeof OctokitWithPlugins> & {
-  paginate: PaginateInterface;
-};

src/utils/platforms.ts

@@ -13,6 +13,7 @@ export type Architecture =
   | "x86_64"
   | "aarch64"
   | "s390x"
+  | "riscv64gc"
   | "powerpc64le";
 
 export function getArch(): Architecture | undefined {
@@ -21,6 +22,7 @@ export function getArch(): Architecture | undefined {
     arm64: "aarch64",
     ia32: "i686",
     ppc64: "powerpc64le",
+    riscv64: "riscv64gc",
     s390x: "s390x",
     x64: "x86_64",
   };
@@ -106,10 +108,16 @@ function getLinuxOSNameVersion(): string {
       const content = fs.readFileSync(file, "utf8");
       const id = parseOsReleaseValue(content, "ID");
       const versionId = parseOsReleaseValue(content, "VERSION_ID");
+      // Fallback for rolling releases (debian:unstable/testing, arch, etc.)
+      // that don't have VERSION_ID but have VERSION_CODENAME
+      const versionCodename = parseOsReleaseValue(content, "VERSION_CODENAME");
 
       if (id && versionId) {
         return `${id}-${versionId}`;
       }
+      if (id && versionCodename) {
+        return `${id}-${versionCodename}`;
+      }
     } catch {
       // Try next file
     }

src/version/file-parser.ts

@@ -0,0 +1,101 @@
+import fs from "node:fs";
+import { getConfigValueFromTomlContent } from "../utils/config-file";
+import * as log from "../utils/logging";
+import {
+  getUvVersionFromParsedPyproject,
+  getUvVersionFromRequirementsText,
+  parsePyprojectContent,
+} from "./requirements-file";
+import { normalizeVersionSpecifier } from "./specifier";
+import { getUvVersionFromToolVersions } from "./tool-versions-file";
+import type { ParsedVersionFile, VersionFileFormat } from "./types";
+
+interface VersionFileParser {
+  format: VersionFileFormat;
+  parse(filePath: string): string | undefined;
+  supports(filePath: string): boolean;
+}
+
+const VERSION_FILE_PARSERS: VersionFileParser[] = [
+  {
+    format: ".tool-versions",
+    parse: (filePath) => getUvVersionFromToolVersions(filePath),
+    supports: (filePath) => filePath.endsWith(".tool-versions"),
+  },
+  {
+    format: "uv.toml",
+    parse: (filePath) => {
+      const fileContent = fs.readFileSync(filePath, "utf-8");
+      return getConfigValueFromTomlContent(
+        filePath,
+        fileContent,
+        "required-version",
+      );
+    },
+    supports: (filePath) => filePath.endsWith("uv.toml"),
+  },
+  {
+    format: "pyproject.toml",
+    parse: (filePath) => {
+      const fileContent = fs.readFileSync(filePath, "utf-8");
+      const pyproject = parsePyprojectContent(fileContent);
+      const requiredVersion = pyproject.tool?.uv?.["required-version"];
+
+      if (requiredVersion !== undefined) {
+        return requiredVersion;
+      }
+
+      return getUvVersionFromParsedPyproject(pyproject);
+    },
+    supports: (filePath) => filePath.endsWith("pyproject.toml"),
+  },
+  {
+    format: "requirements",
+    parse: (filePath) => {
+      const fileContent = fs.readFileSync(filePath, "utf-8");
+      return getUvVersionFromRequirementsText(fileContent);
+    },
+    supports: (filePath) => filePath.endsWith(".txt"),
+  },
+];
+
+export function getParsedVersionFile(
+  filePath: string,
+): ParsedVersionFile | undefined {
+  log.info(`Trying to find version for uv in: ${filePath}`);
+
+  if (!fs.existsSync(filePath)) {
+    log.info(`Could not find file: ${filePath}`);
+    return undefined;
+  }
+
+  const parser = getVersionFileParser(filePath);
+  if (parser === undefined) {
+    return undefined;
+  }
+
+  try {
+    const specifier = parser.parse(filePath);
+    if (specifier === undefined) {
+      return undefined;
+    }
+
+    const normalizedSpecifier = normalizeVersionSpecifier(specifier);
+    log.info(`Found version for uv in ${filePath}: ${normalizedSpecifier}`);
+    return {
+      format: parser.format,
+      specifier: normalizedSpecifier,
+    };
+  } catch (error) {
+    log.warning(`Error while parsing ${filePath}: ${(error as Error).message}`);
+    return undefined;
+  }
+}
+
+export function getUvVersionFromFile(filePath: string): string | undefined {
+  return getParsedVersionFile(filePath)?.specifier;
+}
+
+function getVersionFileParser(filePath: string): VersionFileParser | undefined {
+  return VERSION_FILE_PARSERS.find((parser) => parser.supports(filePath));
+}

src/version/requirements-file.ts

@@ -5,31 +5,23 @@ export function getUvVersionFromRequirementsFile(
   filePath: string,
 ): string | undefined {
   const fileContent = fs.readFileSync(filePath, "utf-8");
+
   if (filePath.endsWith(".txt")) {
-    return getUvVersionFromAllDependencies(fileContent.split("\n"));
+    return getUvVersionFromRequirementsText(fileContent);
   }
-  const dependencies = parsePyprojectDependencies(fileContent);
-  return getUvVersionFromAllDependencies(dependencies);
+
+  return getUvVersionFromPyprojectContent(fileContent);
 }
-function getUvVersionFromAllDependencies(
-  allDependencies: string[],
+
+export function getUvVersionFromRequirementsText(
+  fileContent: string,
 ): string | undefined {
-  return allDependencies
-    .find((dep: string) => dep.match(/^uv[=<>~!]/))
-    ?.match(/^uv([=<>~!]+\S*)/)?.[1]
-    .trim();
+  return getUvVersionFromAllDependencies(fileContent.split("\n"));
 }
 
-interface Pyproject {
-  project?: {
-    dependencies?: string[];
-    "optional-dependencies"?: Record<string, string[]>;
-  };
-  "dependency-groups"?: Record<string, Array<string | object>>;
-}
-
-function parsePyprojectDependencies(pyprojectContent: string): string[] {
-  const pyproject: Pyproject = toml.parse(pyprojectContent);
+export function getUvVersionFromParsedPyproject(
+  pyproject: Pyproject,
+): string | undefined {
   const dependencies: string[] = pyproject?.project?.dependencies || [];
   const optionalDependencies: string[] = Object.values(
     pyproject?.project?.["optional-dependencies"] || {},
@@ -39,5 +31,39 @@ function parsePyprojectDependencies(pyprojectContent: string): string[] {
   )
     .flat()
     .filter((item: string | object) => typeof item === "string");
-  return dependencies.concat(optionalDependencies, devDependencies);
+
+  return getUvVersionFromAllDependencies(
+    dependencies.concat(optionalDependencies, devDependencies),
+  );
+}
+
+export function getUvVersionFromPyprojectContent(
+  pyprojectContent: string,
+): string | undefined {
+  const pyproject = parsePyprojectContent(pyprojectContent);
+  return getUvVersionFromParsedPyproject(pyproject);
+}
+
+export interface Pyproject {
+  project?: {
+    dependencies?: string[];
+    "optional-dependencies"?: Record<string, string[]>;
+  };
+  "dependency-groups"?: Record<string, Array<string | object>>;
+  tool?: {
+    uv?: Record<string, string | undefined>;
+  };
+}
+
+export function parsePyprojectContent(pyprojectContent: string): Pyproject {
+  return toml.parse(pyprojectContent) as Pyproject;
+}
+
+function getUvVersionFromAllDependencies(
+  allDependencies: string[],
+): string | undefined {
+  return allDependencies
+    .find((dep: string) => dep.match(/^uv[=<>~!]/))
+    ?.match(/^uv([=<>~!]+\S*)/)?.[1]
+    .trim();
 }

src/version/resolve.ts

@@ -1,34 +1,184 @@
-import fs from "node:fs";
 import * as core from "@actions/core";
-import { getConfigValueFromTomlFile } from "../utils/config-file";
-import { getUvVersionFromRequirementsFile } from "./requirements-file";
-import { getUvVersionFromToolVersions } from "./tool-versions-file";
+import * as tc from "@actions/tool-cache";
+import * as pep440 from "@renovatebot/pep440";
+import * as semver from "semver";
+import { getAllVersions, getLatestVersion } from "../download/manifest";
+import type { ResolutionStrategy } from "../utils/inputs";
+import * as log from "../utils/logging";
+import {
+  type ParsedVersionSpecifier,
+  parseVersionSpecifier,
+} from "./specifier";
+import type { ResolveUvVersionOptions } from "./types";
+import { resolveVersionRequest } from "./version-request-resolver";
 
-export function getUvVersionFromFile(filePath: string): string | undefined {
-  core.info(`Trying to find version for uv in: ${filePath}`);
-  if (!fs.existsSync(filePath)) {
-    core.info(`Could not find file: ${filePath}`);
-    return undefined;
-  }
-  let uvVersion: string | undefined;
-  try {
-    uvVersion = getUvVersionFromToolVersions(filePath);
-    if (uvVersion === undefined) {
-      uvVersion = getConfigValueFromTomlFile(filePath, "required-version");
-    }
-    if (uvVersion === undefined) {
-      uvVersion = getUvVersionFromRequirementsFile(filePath);
-    }
-  } catch (err) {
-    const message = (err as Error).message;
-    core.warning(`Error while parsing ${filePath}: ${message}`);
-    return undefined;
-  }
-  if (uvVersion?.startsWith("==")) {
-    uvVersion = uvVersion.slice(2);
-  }
-  if (uvVersion !== undefined) {
-    core.info(`Found version for uv in ${filePath}: ${uvVersion}`);
-  }
-  return uvVersion;
+interface ConcreteVersionResolutionContext {
+  manifestUrl?: string;
+  parsedSpecifier: ParsedVersionSpecifier;
+  resolutionStrategy: ResolutionStrategy;
+}
+
+interface ConcreteVersionResolver {
+  resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined>;
+}
+
+class ExactVersionResolver implements ConcreteVersionResolver {
+  async resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined> {
+    if (context.parsedSpecifier.kind !== "exact") {
+      return undefined;
+    }
+
+    core.debug(
+      `Version ${context.parsedSpecifier.normalized} is an explicit version.`,
+    );
+    return context.parsedSpecifier.normalized;
+  }
+}
+
+class LatestVersionResolver implements ConcreteVersionResolver {
+  async resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined> {
+    const shouldUseLatestVersion =
+      context.parsedSpecifier.kind === "latest" ||
+      (context.parsedSpecifier.kind === "range" &&
+        context.parsedSpecifier.isSimpleMinimumVersionSpecifier &&
+        context.resolutionStrategy === "highest");
+
+    if (!shouldUseLatestVersion) {
+      return undefined;
+    }
+
+    if (
+      context.parsedSpecifier.kind === "range" &&
+      context.parsedSpecifier.isSimpleMinimumVersionSpecifier
+    ) {
+      log.info("Found minimum version specifier, using latest version");
+    }
+
+    const latestVersion = await getLatestVersion(context.manifestUrl);
+
+    if (
+      context.parsedSpecifier.kind === "range" &&
+      context.parsedSpecifier.isSimpleMinimumVersionSpecifier &&
+      !pep440.satisfies(latestVersion, context.parsedSpecifier.raw)
+    ) {
+      throw new Error(`No version found for ${context.parsedSpecifier.raw}`);
+    }
+
+    return latestVersion;
+  }
+}
+
+class RangeVersionResolver implements ConcreteVersionResolver {
+  async resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined> {
+    if (context.parsedSpecifier.kind !== "range") {
+      return undefined;
+    }
+
+    const availableVersions = await getAllVersions(context.manifestUrl);
+    core.debug(`Available versions: ${availableVersions}`);
+
+    const resolvedVersion =
+      context.resolutionStrategy === "lowest"
+        ? minSatisfying(availableVersions, context.parsedSpecifier.normalized)
+        : maxSatisfying(availableVersions, context.parsedSpecifier.normalized);
+
+    if (resolvedVersion === undefined) {
+      throw new Error(`No version found for ${context.parsedSpecifier.raw}`);
+    }
+
+    return resolvedVersion;
+  }
+}
+
+const CONCRETE_VERSION_RESOLVERS: ConcreteVersionResolver[] = [
+  new ExactVersionResolver(),
+  new LatestVersionResolver(),
+  new RangeVersionResolver(),
+];
+
+export async function resolveUvVersion(
+  options: ResolveUvVersionOptions,
+): Promise<string> {
+  const request = resolveVersionRequest(options);
+  const resolutionStrategy = options.resolutionStrategy ?? "highest";
+  const version = await resolveVersion(
+    request.specifier,
+    options.manifestFile,
+    resolutionStrategy,
+  );
+
+  return version;
+}
+
+export async function resolveVersion(
+  versionInput: string,
+  manifestUrl: string | undefined,
+  resolutionStrategy: ResolutionStrategy = "highest",
+): Promise<string> {
+  core.debug(`Resolving version: ${versionInput}`);
+
+  const context: ConcreteVersionResolutionContext = {
+    manifestUrl,
+    parsedSpecifier: parseVersionSpecifier(versionInput),
+    resolutionStrategy,
+  };
+
+  for (const resolver of CONCRETE_VERSION_RESOLVERS) {
+    const version = await resolver.resolve(context);
+    if (version !== undefined) {
+      return version;
+    }
+  }
+
+  throw new Error(`No version found for ${versionInput}`);
+}
+
+function maxSatisfying(
+  versions: string[],
+  version: string,
+): string | undefined {
+  const maxSemver = tc.evaluateVersions(versions, version);
+  if (maxSemver !== "") {
+    core.debug(`Found a version that satisfies the semver range: ${maxSemver}`);
+    return maxSemver;
+  }
+
+  const maxPep440 = pep440.maxSatisfying(versions, version);
+  if (maxPep440 !== null) {
+    core.debug(
+      `Found a version that satisfies the pep440 specifier: ${maxPep440}`,
+    );
+    return maxPep440;
+  }
+
+  return undefined;
+}
+
+function minSatisfying(
+  versions: string[],
+  version: string,
+): string | undefined {
+  const minSemver = semver.minSatisfying(versions, version);
+  if (minSemver !== null) {
+    core.debug(`Found a version that satisfies the semver range: ${minSemver}`);
+    return minSemver;
+  }
+
+  const minPep440 = pep440.minSatisfying(versions, version);
+  if (minPep440 !== null) {
+    core.debug(
+      `Found a version that satisfies the pep440 specifier: ${minPep440}`,
+    );
+    return minPep440;
+  }
+
+  return undefined;
 }

src/version/specifier.ts

@@ -0,0 +1,59 @@
+import * as tc from "@actions/tool-cache";
+
+export type ParsedVersionSpecifier =
+  | {
+      kind: "exact";
+      normalized: string;
+      raw: string;
+    }
+  | {
+      kind: "latest";
+      normalized: "latest";
+      raw: string;
+    }
+  | {
+      isSimpleMinimumVersionSpecifier: boolean;
+      kind: "range";
+      normalized: string;
+      raw: string;
+    };
+
+export function normalizeVersionSpecifier(specifier: string): string {
+  const trimmedSpecifier = specifier.trim();
+
+  if (trimmedSpecifier.startsWith("==")) {
+    return trimmedSpecifier.slice(2);
+  }
+
+  return trimmedSpecifier;
+}
+
+export function parseVersionSpecifier(
+  specifier: string,
+): ParsedVersionSpecifier {
+  const raw = specifier.trim();
+  const normalized = normalizeVersionSpecifier(raw);
+
+  if (normalized === "latest") {
+    return {
+      kind: "latest",
+      normalized: "latest",
+      raw,
+    };
+  }
+
+  if (tc.isExplicitVersion(normalized)) {
+    return {
+      kind: "exact",
+      normalized,
+      raw,
+    };
+  }
+
+  return {
+    isSimpleMinimumVersionSpecifier: raw.includes(">") && !raw.includes(","),
+    kind: "range",
+    normalized,
+    raw,
+  };
+}

src/version/types.ts

@@ -0,0 +1,34 @@
+import type { ResolutionStrategy } from "../utils/inputs";
+
+export type VersionSource =
+  | "input"
+  | "version-file"
+  | "uv.toml"
+  | "pyproject.toml"
+  | "default";
+
+export type VersionFileFormat =
+  | ".tool-versions"
+  | "pyproject.toml"
+  | "requirements"
+  | "uv.toml";
+
+export interface ParsedVersionFile {
+  format: VersionFileFormat;
+  specifier: string;
+}
+
+export interface ResolveUvVersionOptions {
+  manifestFile?: string;
+  resolutionStrategy?: ResolutionStrategy;
+  version?: string;
+  versionFile?: string;
+  workingDirectory: string;
+}
+
+export interface VersionRequest {
+  format?: VersionFileFormat;
+  source: VersionSource;
+  sourcePath?: string;
+  specifier: string;
+}

src/version/version-request-resolver.ts

@@ -0,0 +1,158 @@
+import * as path from "node:path";
+import * as log from "../utils/logging";
+import { getParsedVersionFile } from "./file-parser";
+import { normalizeVersionSpecifier } from "./specifier";
+import type {
+  ParsedVersionFile,
+  ResolveUvVersionOptions,
+  VersionRequest,
+} from "./types";
+
+export interface VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined;
+}
+
+export class VersionRequestContext {
+  readonly version: string | undefined;
+  readonly versionFile: string | undefined;
+  readonly workingDirectory: string;
+
+  private readonly parsedFiles = new Map<
+    string,
+    ParsedVersionFile | undefined
+  >();
+
+  constructor(
+    version: string | undefined,
+    versionFile: string | undefined,
+    workingDirectory: string,
+  ) {
+    this.version = version;
+    this.versionFile = versionFile;
+    this.workingDirectory = workingDirectory;
+  }
+
+  getVersionFile(filePath: string): ParsedVersionFile | undefined {
+    const cachedResult = this.parsedFiles.get(filePath);
+    if (cachedResult !== undefined || this.parsedFiles.has(filePath)) {
+      return cachedResult;
+    }
+
+    const result = getParsedVersionFile(filePath);
+    this.parsedFiles.set(filePath, result);
+    return result;
+  }
+
+  getWorkspaceCandidates(): Array<{
+    source: "pyproject.toml" | "uv.toml";
+    sourcePath: string;
+  }> {
+    return [
+      {
+        source: "uv.toml",
+        sourcePath: path.join(this.workingDirectory, "uv.toml"),
+      },
+      {
+        source: "pyproject.toml",
+        sourcePath: path.join(this.workingDirectory, "pyproject.toml"),
+      },
+    ];
+  }
+}
+
+export class ExplicitInputVersionResolver implements VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined {
+    if (context.version === undefined) {
+      return undefined;
+    }
+
+    return {
+      source: "input",
+      specifier: normalizeVersionSpecifier(context.version),
+    };
+  }
+}
+
+export class VersionFileVersionResolver implements VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined {
+    if (context.versionFile === undefined) {
+      return undefined;
+    }
+
+    const versionFile = context.getVersionFile(context.versionFile);
+    if (versionFile === undefined) {
+      throw new Error(
+        `Could not determine uv version from file: ${context.versionFile}`,
+      );
+    }
+
+    return {
+      format: versionFile.format,
+      source: "version-file",
+      sourcePath: context.versionFile,
+      specifier: versionFile.specifier,
+    };
+  }
+}
+
+export class WorkspaceVersionResolver implements VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined {
+    for (const candidate of context.getWorkspaceCandidates()) {
+      const versionFile = context.getVersionFile(candidate.sourcePath);
+      if (versionFile === undefined) {
+        continue;
+      }
+
+      return {
+        format: versionFile.format,
+        source: candidate.source,
+        sourcePath: candidate.sourcePath,
+        specifier: versionFile.specifier,
+      };
+    }
+
+    log.info(
+      "Could not determine uv version from uv.toml or pyproject.toml. Falling back to latest.",
+    );
+    return undefined;
+  }
+}
+
+export class LatestVersionResolver implements VersionRequestResolver {
+  resolve(): VersionRequest {
+    return {
+      source: "default",
+      specifier: "latest",
+    };
+  }
+}
+
+const VERSION_REQUEST_RESOLVERS: VersionRequestResolver[] = [
+  new ExplicitInputVersionResolver(),
+  new VersionFileVersionResolver(),
+  new WorkspaceVersionResolver(),
+  new LatestVersionResolver(),
+];
+
+export function resolveVersionRequest(
+  options: ResolveUvVersionOptions,
+): VersionRequest {
+  const context = new VersionRequestContext(
+    emptyToUndefined(options.version),
+    emptyToUndefined(options.versionFile),
+    options.workingDirectory,
+  );
+
+  for (const resolver of VERSION_REQUEST_RESOLVERS) {
+    const request = resolver.resolve(context);
+    if (request !== undefined) {
+      return request;
+    }
+  }
+
+  throw new Error("Could not resolve a requested uv version.");
+}
+
+function emptyToUndefined(value: string | undefined): string | undefined {
+  return value === undefined || value === "" ? undefined : value;
+}

tsconfig.json

@@ -1,12 +1,12 @@
 {
   "compilerOptions": {
-    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
-    "module": "nodenext" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
-    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
-    "outDir": "./lib" /* Redirect output structure to the directory. */,
-    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
-    "strict": true /* Enable all strict type-checking options. */,
-    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
+    "esModuleInterop": true,
+    "isolatedModules": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "noImplicitAny": true,
+    "strict": true,
+    "target": "ES2022"
   },
-  "exclude": ["node_modules", "**/*.test.ts"]
+  "include": ["src/**/*.ts"]
 }