docs: clarify threat model authority boundary

simplify
docs: add repository threat model
2026-06-22 20:42:36 +00:00 · 2026-06-19 17:53:50 +01:00 · 2026-06-17 15:03:39 +01:00 · 2026-06-17 11:53:07 +01:00 · 2026-05-11 08:14:58 +02:00 · 2026-05-09 08:17:00 +02:00
34 changed files with 4415 additions and 2488 deletions
@@ -47,7 +47,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
        with:
          languages: ${{ matrix.language }}
          source-root: src
@@ -59,7 +59,7 @@ jobs:
      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
      #   make release

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
@@ -19,6 +19,8 @@ jobs:
      pull-requests: read
    steps:
      - name: 🚀 Run Release Drafter
-        uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v7.1.1
+        uses: release-drafter/release-drafter@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7.2.0
+        with:
+          commitish: ${{ github.sha }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,113 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version (e.g., 8.1.0)"
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  validate-release:
+    name: Validate release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Validate version and draft release
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version }}
+          TAG: v${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Version must match MAJOR.MINOR.PATCH (e.g., 8.1.0)"
+            exit 1
+          fi
+
+          RELEASE_JSON=$(gh release view "$TAG" --json isDraft,targetCommitish 2>&1) || {
+            echo "::error::No release found for $TAG"
+            exit 1
+          }
+
+          IS_DRAFT=$(echo "$RELEASE_JSON" | jq -r '.isDraft')
+          TARGET=$(echo "$RELEASE_JSON" | jq -r '.targetCommitish')
+
+          if [[ "$IS_DRAFT" != "true" ]]; then
+            echo "::error::Release $TAG already exists and is not a draft"
+            exit 1
+          fi
+
+          if [[ "$TARGET" != "$GITHUB_SHA" ]]; then
+            echo "::error::Draft release target ($TARGET) does not match current commit ($GITHUB_SHA)"
+            exit 1
+          fi
+
+  release-gate:
+    # N.B. This name should not change, it is used for downstream checks.
+    name: release-gate
+    needs:
+      - validate-release
+    runs-on: ubuntu-latest
+    environment:
+      name: release-gate
+    steps:
+      - run: echo "Release approved"
+
+  create-deployment:
+    name: create-deployment
+    needs:
+      - validate-release
+      - release-gate
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    steps:
+      - run: echo "Release deployment created"
+
+  release:
+    name: Release
+    needs:
+      - validate-release
+      - release-gate
+      - create-deployment
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Publish release
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version }}
+          TAG: v${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Version must match MAJOR.MINOR.PATCH (e.g., 8.1.0)"
+            exit 1
+          fi
+
+          RELEASE_JSON=$(gh release view "$TAG" --json isDraft,targetCommitish 2>&1) || {
+            echo "::error::No release found for $TAG"
+            exit 1
+          }
+
+          IS_DRAFT=$(echo "$RELEASE_JSON" | jq -r '.isDraft')
+          TARGET=$(echo "$RELEASE_JSON" | jq -r '.targetCommitish')
+
+          if [[ "$IS_DRAFT" != "true" ]]; then
+            echo "::error::Release $TAG already exists and is not a draft"
+            exit 1
+          fi
+
+          if [[ "$TARGET" != "$GITHUB_SHA" ]]; then
+            echo "::error::Draft release target ($TARGET) does not match current commit ($GITHUB_SHA)"
+            exit 1
+          fi
+
+          echo "Publishing draft release $TAG"
+          gh release edit "$TAG" --draft=false
@@ -27,8 +27,8 @@ jobs:
      - name: Actionlint
        uses: eifinger/actionlint-action@7802e0cc3ab3f81cbffb36fb0bf1a3621d994b89 # v1.10.1
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -430,6 +430,49 @@ jobs:
          PY
        shell: bash

+  test-activate-environment-no-project:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Create incompatible pyproject.toml
+        run: |
+          cat > pyproject.toml <<'EOF'
+          [project]
+          name = "test-no-project"
+          version = "0.1.0"
+
+          [dependency-groups]
+          dev = [
+              "-e file:///${PROJECT_ROOT}/projects/pkg",
+          ]
+          EOF
+        shell: bash
+      - name: Install latest version with no-project
+        id: setup-uv
+        uses: ./
+        with:
+          python-version: 3.13.1t
+          activate-environment: true
+          no-project: true
+      - name: Verify packages can be installed
+        run: uv pip install pip
+        shell: bash
+      - name: Verify output venv is set
+        run: |
+          if [ -z "$UV_VENV" ]; then
+            echo "output venv is not set"
+            exit 1
+          fi
+          if [ ! -d "$UV_VENV" ]; then
+            echo "output venv not point to a directory: $UV_VENV"
+            exit 1
+          fi
+        shell: bash
+        env:
+          UV_VENV: ${{ steps.setup-uv.outputs.venv }}
+
  test-debian-unstable:
    runs-on: ubuntu-latest
    container: debian:unstable
@@ -1057,6 +1100,7 @@ jobs:
      - test-python-version
      - test-activate-environment
      - test-activate-environment-custom-path
+      - test-activate-environment-no-project
      - test-debian-unstable
      - test-musl
      - test-cache-key-os-version
@@ -0,0 +1,69 @@
+name: "Update docs"
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions: {}
+
+jobs:
+  update-docs:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: true
+      - name: Get tag info
+        id: tag-info
+        run: |
+          TAG_NAME="${GITHUB_REF#refs/tags/}"
+          COMMIT_SHA=$(git rev-list -n 1 "$TAG_NAME")
+          echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
+          echo "sha=$COMMIT_SHA" >> "$GITHUB_OUTPUT"
+      - name: Update references in docs
+        run: |
+          OLD_REF=$(grep -oh 'astral-sh/setup-uv@[a-f0-9]\{40\} # v[0-9][^ ]*' README.md docs/*.md | head -1)
+          OLD_SHA=$(echo "$OLD_REF" | sed 's/astral-sh\/setup-uv@\([a-f0-9]*\) # .*/\1/')
+          OLD_VERSION=$(echo "$OLD_REF" | sed 's/astral-sh\/setup-uv@[a-f0-9]* # \(v[^ ]*\)/\1/')
+          echo "Replacing $OLD_SHA # $OLD_VERSION with $NEW_SHA # $NEW_VERSION"
+          find README.md docs/ -type f \( -name "*.md" \) -exec \
+            sed -i "s|$OLD_SHA # $OLD_VERSION|$NEW_SHA # $NEW_VERSION|g" {} +
+        env:
+          NEW_SHA: ${{ steps.tag-info.outputs.sha }}
+          NEW_VERSION: ${{ steps.tag-info.outputs.tag }}
+      - name: Check for changes
+        id: changes-exist
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+              echo "changes-exist=true" >> "$GITHUB_OUTPUT"
+          else
+              echo "changes-exist=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Commit and push changes
+        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
+        id: commit-and-push
+        continue-on-error: true
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+          git add .
+          git commit -m "docs: update version references to $NEW_VERSION"
+          git push origin HEAD:refs/heads/main
+        env:
+          NEW_VERSION: ${{ steps.tag-info.outputs.tag }}
+      - name: Create Pull Request
+        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' && steps.commit-and-push.outcome != 'success' }}
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          commit-message: "docs: update version references to ${{ steps.tag-info.outputs.tag }}"
+          title: "docs: update version references to ${{ steps.tag-info.outputs.tag }}"
+          body: |
+            Update `uses: astral-sh/setup-uv@...` references in documentation to
+            `${{ steps.tag-info.outputs.sha }} # ${{ steps.tag-info.outputs.tag }}`.
+          base: main
+          labels: "automated-pr,update-docs"
+          branch: update-docs-${{ steps.tag-info.outputs.tag }}
+          delete-branch: true
@@ -18,7 +18,7 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: true
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
@@ -54,7 +54,7 @@ jobs:

      - name: Create Pull Request
        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' && steps.commit-and-push.outcome != 'success' }}
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          commit-message: "chore: update known checksums"
          title:
@@ -7,7 +7,7 @@ This repository is a TypeScript-based GitHub Action for installing `uv` in GitHu
  1. `npm ci --ignore-scripts`
  2. `npm run all`
 - `npm run check` uses Biome (not ESLint/Prettier) and rewrites files in place.
- User-facing changes are usually multi-file changes. If you add or change inputs, outputs, or behavior, update `action.yml`, the implementation in `src/`, tests in `__tests__/`, relevant docs/README, and then re-package.
+- User-facing changes are usually multi-file changes. If you add or change inputs, outputs, or behavior, update `action.yml`, `action-types.yml`, the implementation in `src/`, tests in `__tests__/`, relevant docs/README, and then re-package.
 - The easiest areas to regress are version resolution and caching. When touching them, add or update tests for precedence, cache invalidation, and cross-platform path behavior.
 - Workflow edits have extra CI-only checks (`actionlint` and `zizmor`); `npm run all` does not cover them.
 - Source is authored with bundler-friendly TypeScript, but published action artifacts in `dist/` are bundled as CommonJS for maximum GitHub Actions runtime compatibility with `@actions/*` dependencies.
@@ -26,7 +26,7 @@ Set up your GitHub Actions workflow with a specific version of [uv](https://docs

 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 ```

 If you do not specify a version, this action will look for a [required-version](https://docs.astral.sh/uv/reference/settings/#required-version)
@@ -42,7 +42,7 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed

 ```yaml
 - name: Install uv with all available options
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    # The version of uv to install (default: searches for version in config files, then latest)
    version: ""
@@ -62,6 +62,9 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed
    # Custom path for the virtual environment when using activate-environment (default: .venv in the working directory)
    venv-path: ""

+    # Pass --no-project when creating the venv with activate-environment.
+    no-project: "false"
+
    # The directory to execute all commands in and look for files such as pyproject.toml
    working-directory: ""

@@ -139,7 +142,7 @@ This will override any python version specifications in `pyproject.toml` and `.p

 ```yaml
 - name: Install the latest version of uv and set the python version to 3.13t
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    python-version: 3.13t
 - run: uv pip install --python=3.13t pip
@@ -157,7 +160,7 @@ jobs:
    steps:
      - uses: actions/checkout@v5
      - name: Install the latest version of uv and set the python version
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Test with python ${{ matrix.python-version }}
@@ -174,7 +177,7 @@ It also controls where [the venv gets created](#activate-environment), unless `v

 ```yaml
 - name: Install uv based on the config files in the working-directory
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    working-directory: my/subproject/dir
 ```
@@ -216,7 +219,7 @@ For example:
 - name: Checkout the repository
  uses: actions/checkout@main
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
 - name: Test
@@ -228,7 +231,7 @@ To install a specific version of Python, use

 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
 - name: Install Python 3.12
@@ -247,7 +250,7 @@ output:
  uses: actions/checkout@main
 - name: Install the default version of uv
  id: setup-uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 - name: Print the installed version
  run: echo "Installed uv version is ${{ steps.setup-uv.outputs.uv-version }}"
 ```
@@ -95,6 +95,35 @@ describe("download-version", () => {
      expect(mockGetAllVersions).toHaveBeenCalledWith(undefined);
    });

+    it("treats == exact pins as explicit versions", async () => {
+      const version = await resolveVersion("==0.9.26", undefined);
+
+      expect(version).toBe("0.9.26");
+      expect(mockGetAllVersions).not.toHaveBeenCalled();
+      expect(mockGetLatestVersion).not.toHaveBeenCalled();
+    });
+
+    it("uses latest for minimum-only ranges when using the highest strategy", async () => {
+      mockGetLatestVersion.mockResolvedValue("0.9.26");
+
+      const version = await resolveVersion(">=0.9.0", undefined, "highest");
+
+      expect(version).toBe("0.9.26");
+      expect(mockGetLatestVersion).toHaveBeenCalledTimes(1);
+      expect(mockGetLatestVersion).toHaveBeenCalledWith(undefined);
+      expect(mockGetAllVersions).not.toHaveBeenCalled();
+    });
+
+    it("uses the lowest compatible version when requested", async () => {
+      mockGetAllVersions.mockResolvedValue(["0.9.26", "0.9.25"]);
+
+      const version = await resolveVersion("^0.9.0", undefined, "lowest");
+
+      expect(version).toBe("0.9.25");
+      expect(mockGetAllVersions).toHaveBeenCalledTimes(1);
+      expect(mockGetAllVersions).toHaveBeenCalledWith(undefined);
+    });
+
    it("uses manifest-file when provided", async () => {
      mockGetAllVersions.mockResolvedValue(["0.9.26", "0.9.25"]);

@@ -1,5 +1,5 @@
 import { expect, test } from "@jest/globals";
-import { getUvVersionFromFile } from "../../src/version/resolve";
+import { getUvVersionFromFile } from "../../src/version/file-parser";

 test("ignores dependencies starting with uv", async () => {
  const parsedVersion = getUvVersionFromFile(
@@ -1,5 +1,5 @@
 import { expect, test } from "@jest/globals";
-import { getUvVersionFromFile } from "../../src/version/resolve";
+import { getUvVersionFromFile } from "../../src/version/file-parser";

 test("ignores dependencies starting with uv", async () => {
  const parsedVersion = getUvVersionFromFile(
@@ -0,0 +1,125 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "@jest/globals";
+import { resolveVersionRequest } from "../../src/version/version-request-resolver";
+
+const tempDirs: string[] = [];
+
+function createTempProject(files: Record<string, string> = {}): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "setup-uv-version-test-"));
+  tempDirs.push(dir);
+
+  for (const [relativePath, content] of Object.entries(files)) {
+    const filePath = path.join(dir, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  return dir;
+}
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    fs.rmSync(dir, { force: true, recursive: true });
+  }
+});
+
+describe("resolveVersionRequest", () => {
+  it("prefers explicit input over version-file and workspace config", () => {
+    const workingDirectory = createTempProject({
+      ".tool-versions": "uv 0.4.0\n",
+      "pyproject.toml": `[tool.uv]\nrequired-version = "==0.5.14"\n`,
+      "uv.toml": `required-version = "==0.5.15"\n`,
+    });
+
+    const request = resolveVersionRequest({
+      version: "==0.6.0",
+      versionFile: path.join(workingDirectory, ".tool-versions"),
+      workingDirectory,
+    });
+
+    expect(request).toEqual({
+      source: "input",
+      specifier: "0.6.0",
+    });
+  });
+
+  it("uses .tool-versions when it is passed via version-file", () => {
+    const workingDirectory = createTempProject({
+      ".tool-versions": "uv 0.5.15\n",
+    });
+
+    const request = resolveVersionRequest({
+      versionFile: path.join(workingDirectory, ".tool-versions"),
+      workingDirectory,
+    });
+
+    expect(request).toEqual({
+      format: ".tool-versions",
+      source: "version-file",
+      sourcePath: path.join(workingDirectory, ".tool-versions"),
+      specifier: "0.5.15",
+    });
+  });
+
+  it("uses requirements.txt when it is passed via version-file", () => {
+    const workingDirectory = createTempProject({
+      "requirements.txt": "uv==0.6.17\nuvicorn==0.35.0\n",
+    });
+
+    const request = resolveVersionRequest({
+      versionFile: path.join(workingDirectory, "requirements.txt"),
+      workingDirectory,
+    });
+
+    expect(request).toEqual({
+      format: "requirements",
+      source: "version-file",
+      sourcePath: path.join(workingDirectory, "requirements.txt"),
+      specifier: "0.6.17",
+    });
+  });
+
+  it("prefers uv.toml over pyproject.toml during workspace discovery", () => {
+    const workingDirectory = createTempProject({
+      "pyproject.toml": `[tool.uv]\nrequired-version = "==0.5.14"\n`,
+      "uv.toml": `required-version = "==0.5.15"\n`,
+    });
+
+    const request = resolveVersionRequest({ workingDirectory });
+
+    expect(request).toEqual({
+      format: "uv.toml",
+      source: "uv.toml",
+      sourcePath: path.join(workingDirectory, "uv.toml"),
+      specifier: "0.5.15",
+    });
+  });
+
+  it("falls back to latest when no version source is found", () => {
+    const workingDirectory = createTempProject({});
+
+    const request = resolveVersionRequest({ workingDirectory });
+
+    expect(request).toEqual({
+      source: "default",
+      specifier: "latest",
+    });
+  });
+
+  it("throws when version-file does not resolve a version", () => {
+    const workingDirectory = createTempProject({
+      "requirements.txt": "uvicorn==0.35.0\n",
+    });
+
+    expect(() =>
+      resolveVersionRequest({
+        versionFile: path.join(workingDirectory, "requirements.txt"),
+        workingDirectory,
+      }),
+    ).toThrow(
+      `Could not determine uv version from file: ${path.join(workingDirectory, "requirements.txt")}`,
+    );
+  });
+});
@@ -11,6 +11,8 @@ inputs:
    type: boolean
  venv-path:
    type: string
+  no-project:
+    type: boolean
  working-directory:
    type: string
  checksum:
@@ -18,6 +18,9 @@ inputs:
  venv-path:
    description: "Custom path for the virtual environment when using activate-environment. Defaults to '.venv' in the working directory."
    default: ""
+  no-project:
+    description: "Pass --no-project when creating the venv with activate-environment."
+    default: "false"
  working-directory:
    description: "The directory to execute all commands in and look for files such as pyproject.toml"
    default: ${{ github.workspace }}
@@ -62947,6 +62947,12 @@ function getConfigValueFromTomlFile(filePath, key) {
    return void 0;
  }
  const fileContent = import_node_fs2.default.readFileSync(filePath, "utf-8");
+  return getConfigValueFromTomlContent(filePath, fileContent, key);
+}
+function getConfigValueFromTomlContent(filePath, fileContent, key) {
+  if (!filePath.endsWith(".toml")) {
+    return void 0;
+  }
  if (filePath.endsWith("pyproject.toml")) {
    const tomlContent2 = parse2(fileContent);
    return tomlContent2?.tool?.uv?.[key];
@@ -62962,6 +62968,7 @@ function loadInputs() {
  const versionFile = getVersionFile(workingDirectory);
  const pythonVersion = getInput("python-version");
  const activateEnvironment = getBooleanInput("activate-environment");
+  const noProject = getBooleanInput("no-project");
  const venvPath = getVenvPath(workingDirectory, activateEnvironment);
  const checksum = getInput("checksum");
  const enableCache = getEnableCache();
@@ -62998,6 +63005,7 @@ function loadInputs() {
    ignoreEmptyWorkdir,
    ignoreNothingToCache,
    manifestFile,
+    noProject,
    pruneCache: pruneCache2,
    pythonDir,
    pythonVersion,
@@ -44949,6 +44949,204 @@ var semver = __toESM(require_semver(), 1);

 // src/download/checksum/known-checksums.ts
 var KNOWN_CHECKSUMS = {
+  "aarch64-apple-darwin-0.11.13": "196a58aa24da89144187670df7c407358028984537fbc2f8f2d8f7a2604980df",
+  "aarch64-pc-windows-msvc-0.11.13": "07c3c997020430a9f287fc05ff4c63fd5744eec49df5392a34731ed1a0971f2e",
+  "aarch64-unknown-linux-gnu-0.11.13": "12366407dc1fdba5179b10bd69c11ebfc2eff25791366089c0b2f5701056efc5",
+  "aarch64-unknown-linux-musl-0.11.13": "bea8a97b1b3ed41491e075c1f474e7f0249582aa3f62849c4e874b5f34ddc95e",
+  "arm-unknown-linux-musleabihf-0.11.13": "ee282adf170eb845821309ca6038fdd87a93dd25326f96efe6ea58a1b66a9064",
+  "armv7-unknown-linux-gnueabihf-0.11.13": "4761e38e3d5ca62e87ef13bc35ba169e6ebd126472482095405367b31be88945",
+  "armv7-unknown-linux-musleabihf-0.11.13": "d54342a96dda65339b4f7b9e6bb7a27b81aeeffca14e5dfa7911d00fe4a3ead9",
+  "i686-pc-windows-msvc-0.11.13": "a9b2d96a118a401c7dc5b717752a074b6324ddc9b36dcb2b60466a4e2912a3ba",
+  "i686-unknown-linux-gnu-0.11.13": "630774d3fd255a219a6eef58f004201737c60f4b282777fb99e599cd90567fe4",
+  "i686-unknown-linux-musl-0.11.13": "52cb28c81ca43ea5184f944c31555981cb29c03c2497fa848541af5ee4d8448f",
+  "powerpc64le-unknown-linux-gnu-0.11.13": "7f302104ea18a01381fe58434b593f887c4f10bc523ad50781de408fbec54354",
+  "riscv64gc-unknown-linux-gnu-0.11.13": "3264ce97b34d5c8d37c1e67821a74960ca89237e001253309a3cda25fb416040",
+  "riscv64gc-unknown-linux-musl-0.11.13": "44f23b8e59fd8628fb68383e4cbdf78c3cff02ed86d3dcea5605ebd7757ca363",
+  "s390x-unknown-linux-gnu-0.11.13": "e0e5e0a652650900d97f6a660bae526601033d9d071ca5dd9ca735442161ebed",
+  "x86_64-apple-darwin-0.11.13": "99aad3f4956f5b92efd83eca6d87bf03e10688899487ad541f904c9c25c61dc1",
+  "x86_64-pc-windows-msvc-0.11.13": "0953ac2ef4fbe47ad469bfa80b658a577a02c4d73a2fb9c4c7c70dda432efded",
+  "x86_64-unknown-linux-gnu-0.11.13": "f830ea3d38ae1492acf53cb7f2cd0f81d6ae22b42d2d7310a6c7d42c451e1a43",
+  "x86_64-unknown-linux-musl-0.11.13": "5635afc285df86ce6f05f3f22335f9548b0026e58531904482c9670a1c1c65d9",
+  "aarch64-apple-darwin-0.11.12": "bb7c6ef869ec00cd1452f4884acf23d00b153c356ba9197ae99a1bc1ceadb7f3",
+  "aarch64-pc-windows-msvc-0.11.12": "393de1abc2f663cb9dd24405c7a7b31119e2a734609a233d9b89415821f39bf9",
+  "aarch64-unknown-linux-gnu-0.11.12": "d6e3e5183e71bbd40400da3d2913743cefb98835d8312a5e7908c33865597515",
+  "aarch64-unknown-linux-musl-0.11.12": "b70e87f15f12d750d218042c4ed36e41de0757eab249d332ee2e242e4174b5d5",
+  "arm-unknown-linux-musleabihf-0.11.12": "c1991e652c345395eff3e43aaa0f2ce5d7f0c7ed0dd5a72dcb0a3c109289ac11",
+  "armv7-unknown-linux-gnueabihf-0.11.12": "432e6a96ecc976861dc884d96ac3aa3cc305abc3bb49d3204544477d4a290c64",
+  "armv7-unknown-linux-musleabihf-0.11.12": "a8855302bad162af78c8fa53f402128a3496b7806dc7201252e7f123eefed8b9",
+  "i686-pc-windows-msvc-0.11.12": "98efe2a4cb9529724639aac488c43b28753e738b0f4c679d3e2dea150e5a9b20",
+  "i686-unknown-linux-gnu-0.11.12": "22dbbbcd9088ad3ddefce9be142ce2b127b3950718222413e3890f7fbf4a567d",
+  "i686-unknown-linux-musl-0.11.12": "fc5ff3fef5facf01a664f0942f372988804bda1bb8c7f9e9642d9d29398cf129",
+  "powerpc64le-unknown-linux-gnu-0.11.12": "36619f91357b240648caed6557fe893922c7986319c070f4feb225e8f3180b49",
+  "riscv64gc-unknown-linux-gnu-0.11.12": "9bdcac006731a2094ad002d93c4fe84a259484e4d35566e29fcb76962961cef9",
+  "riscv64gc-unknown-linux-musl-0.11.12": "80012ba0aa3b21561c96edda003add87d9111daf3425e5cc3243957ca76ba396",
+  "s390x-unknown-linux-gnu-0.11.12": "c9ae09f73066fb9c48beaec2ab4ad2407ce94354c5224e2982196577d6bf4581",
+  "x86_64-apple-darwin-0.11.12": "32fb217e6181384bf6534b31adcc66cd552eff98643c4bb35832be8552486912",
+  "x86_64-pc-windows-msvc-0.11.12": "e46956a6b088a0382101c797eef945c1b03826e629e968d434cf838d42d85b6b",
+  "x86_64-unknown-linux-gnu-0.11.12": "9acdecddacba550ee616c02bb4616d894352022550c5977524556fd5077ce1d4",
+  "x86_64-unknown-linux-musl-0.11.12": "591a7557f5ba7e51565f338dd4c50cebc12820ec2ebb8403a4304685f8d53ab9",
+  "aarch64-apple-darwin-0.11.11": "3a185bf8f46a7b7c8b910d111825907b1638d0ae503cb3c333ae205772354046",
+  "aarch64-pc-windows-msvc-0.11.11": "3d8f05de7ed9de885299565f78832a13e443be51de86260f25edb7cfd0fa05f6",
+  "aarch64-unknown-linux-gnu-0.11.11": "155fe4d3b3cb4bfce118ab4b1380f71515ae874d13d9858171b4f9c26e16684d",
+  "aarch64-unknown-linux-musl-0.11.11": "0fc9a49b3900f77ffaccf3ff69a70ddbc1d479e70ac5d8fd6416a7577b03c5a1",
+  "arm-unknown-linux-musleabihf-0.11.11": "ef98cbcd50a62d063958740194497a44fc1dc07867b6fe001db1ab2e621f1f2e",
+  "armv7-unknown-linux-gnueabihf-0.11.11": "c102609d34c06bdec87896d738a0e91df21f71faf21ae4379c7a1d7c961879e1",
+  "armv7-unknown-linux-musleabihf-0.11.11": "6660651927263c587769697572f4843ac6ea91b2b2d24be1b9c8465e87d05b46",
+  "i686-pc-windows-msvc-0.11.11": "c230fccbe5737e1a54a2f77ff3116c88fbee21c9b437323907618931b767410e",
+  "i686-unknown-linux-gnu-0.11.11": "4be5e9901e87f90a9eb5ee11a08a8df2f637df76f3a2dcb11778991b7db9d9a2",
+  "i686-unknown-linux-musl-0.11.11": "d2ded13fbaf59f5f1d3363c47a7cafb73cb7454db1e16cea13365bc28c75522d",
+  "powerpc64le-unknown-linux-gnu-0.11.11": "5348415c8606e5efac5cb293d83d2ae71e43a2dcabf677c6a4cac965c1982c74",
+  "riscv64gc-unknown-linux-gnu-0.11.11": "0eadf068918b960e7bf62eda83613c08d99f0d002b8d475d3383993191554d04",
+  "riscv64gc-unknown-linux-musl-0.11.11": "0ee27ce77e32496bc46e01f1cbb730d13647cbca41934a5871bf2fe5fdc5ba39",
+  "s390x-unknown-linux-gnu-0.11.11": "f19c950a93b1f5af4108267743f3de61346250b35c60cc552fb4187b534af770",
+  "x86_64-apple-darwin-0.11.11": "57a1a8085b4088fbcbd5080c0c30723ba6d0692c89cd071c08a4209e8da602d1",
+  "x86_64-pc-windows-msvc-0.11.11": "2f75a0db2c3530b6b3c24434dc38137f61ff1f4e5f2d7b4ddc5bcd142cf58b65",
+  "x86_64-unknown-linux-gnu-0.11.11": "a767848254391855c96df271e9ca8b7f72dd172d310460447853d25d907b9ae0",
+  "x86_64-unknown-linux-musl-0.11.11": "80521f18ba83109acd17e0730bd8ff898c3426aa62252c627d63418b353e788a",
+  "aarch64-apple-darwin-0.11.10": "e93d6af7dfff7071edd16342ba9eeccfc28d8a7deaa5707efeecf63a63a74453",
+  "aarch64-pc-windows-msvc-0.11.10": "3d5878cfc55106083ada1e41cccdde477413701eb9d34767e8ad973bb0863de6",
+  "aarch64-unknown-linux-gnu-0.11.10": "91d5f4583539640765662ef86edcf3bf4db07439b622c7bed50c961240162046",
+  "aarch64-unknown-linux-musl-0.11.10": "14c21bef6b54d268c6583d851095a543e6cb03a8e4bdca9a44ab91532b14cbc2",
+  "arm-unknown-linux-musleabihf-0.11.10": "bea66b5dcfb3460a9a2c399033b071ec4a825ff3bf27c3fedc666dcbdc2354dd",
+  "armv7-unknown-linux-gnueabihf-0.11.10": "ba259f6c14b5653f1b36400fb8c7862e499a4537201edda76991f2b044014fdb",
+  "armv7-unknown-linux-musleabihf-0.11.10": "9d6e2ea60fae542e2bd9b36f44672e99fd941f7da0898533bc274329b001a055",
+  "i686-pc-windows-msvc-0.11.10": "d56ad43d355d6c40fee4009d0fb7e6710416ce9b25bebf12a4127e51b3595b3c",
+  "i686-unknown-linux-gnu-0.11.10": "ade0a830fd0b4b67c373c8ed1e46e5af2e312032ebbe15438beddeb5b1e4d8f3",
+  "i686-unknown-linux-musl-0.11.10": "fb2ba8c938247f82908acf6ad41a19935b36d0fe7bbe6945ac1ba1f6044756fc",
+  "powerpc64le-unknown-linux-gnu-0.11.10": "dfe5b338e2ebc1e5a2850a17bce35edb8e47550c221d9245c007eaf3003cb6ed",
+  "riscv64gc-unknown-linux-gnu-0.11.10": "0c8776a0814bf7e32e025d13c733c3a800171a16fba77d1c21e6f10be6a28d8b",
+  "riscv64gc-unknown-linux-musl-0.11.10": "8ae35c10dfcae262dee07c93a3d8d10c2ce597d4a152ba1a2f1385395a286ec3",
+  "s390x-unknown-linux-gnu-0.11.10": "66dfdc5a216a9fbd7c2541a66f753544dddbcbb2f7a597c9bbc91d10af534c7d",
+  "x86_64-apple-darwin-0.11.10": "8fd091211089973f528e147166e3af683ab4ecebd4312a55d0d17d87adbde67a",
+  "x86_64-pc-windows-msvc-0.11.10": "7a0c424c7bc55a74751f13592235953ebbe182fa00355f7ae3fb7ab734a51638",
+  "x86_64-unknown-linux-gnu-0.11.10": "077e1a0777bcf516e02f4ef245e269c8d1baa780438e4c50e09c5c997f85538a",
+  "x86_64-unknown-linux-musl-0.11.10": "e3e78e7698d72c133c5ce851a6d60ee83afdc4c0edced382af9fd1f8e11d0105",
+  "aarch64-apple-darwin-0.11.9": "7d02e5f206dcfb555284f8f6b8547890f0b8eb8987f44e9a0a2378cd23338733",
+  "aarch64-pc-windows-msvc-0.11.9": "93de7822f6214c704ec15db1b4d33eabd3709a0303ec068723d9f5f5aa99e9e7",
+  "aarch64-unknown-linux-gnu-0.11.9": "6d22be8d0d675668f657cee802a1344ea7941403f59eb2a6645ef316f69b4309",
+  "aarch64-unknown-linux-musl-0.11.9": "31abb258d8ec2196993b82e746365717a86e3d3d55502b4c60f384540bf16306",
+  "arm-unknown-linux-musleabihf-0.11.9": "60fd2f75fa0a927ce0373a9289e9490351be3142b00fb0e8da082ed652c7f23c",
+  "armv7-unknown-linux-gnueabihf-0.11.9": "074f216882a79506f56f65413932dba9032ca6100285a562c48965688857970e",
+  "armv7-unknown-linux-musleabihf-0.11.9": "0ebca62577232bab2c152fdd0fa81f78a28f8fd1f4f09689347759332aae996d",
+  "i686-pc-windows-msvc-0.11.9": "9dbb9bf746f00dd379e7e1bd544a5e1b48a5f36408f75a7f8c6c89a7a5e5506a",
+  "i686-unknown-linux-gnu-0.11.9": "84418c97aeadbbdb0b80090c43e29149c3d5c4a70c76ecffb738cd4a05d515d2",
+  "i686-unknown-linux-musl-0.11.9": "f724d184888a52714229584536a3219f0c2fa416944fd476b52c7f597d9b3625",
+  "powerpc64le-unknown-linux-gnu-0.11.9": "cbcdb1b6ee99ca69a572b75544dab484cd34e29109962f5945bb95ccd85d0d52",
+  "riscv64gc-unknown-linux-gnu-0.11.9": "a825d1e6b62ca69971c50e6e356ebe478f7616a7873d9f7d7e17fb3efacabef2",
+  "riscv64gc-unknown-linux-musl-0.11.9": "486b67c16381bb75d74daa86c091b36273cde617e0a2678e0b685b89047a6e6f",
+  "s390x-unknown-linux-gnu-0.11.9": "caa3a59d49003d52c841625885bd60c87a957ed6173070af59c2ef7b4845b727",
+  "x86_64-apple-darwin-0.11.9": "a974a0226ac5d3706ebaf660d3587b0dfb93ef9cf1fd146f97d40cd4ad69db98",
+  "x86_64-pc-windows-msvc-0.11.9": "facbf9637c373761a96fa63c537d6c46581d357a65af01eacfd8c6319e6fb14e",
+  "x86_64-unknown-linux-gnu-0.11.9": "5c43f82077ff0cd5aec588286cbabd89913e4d045bd4e8aa60b20b3ecffc36e3",
+  "x86_64-unknown-linux-musl-0.11.9": "ac3e5051edbf30613b0f90d1c18d4807fea6b246f37490799fee0c1284a658b2",
+  "aarch64-apple-darwin-0.11.8": "c729adb365114e844dd7f9316313a7ed6443b89bb5681d409eebac78b0bd06c8",
+  "aarch64-pc-windows-msvc-0.11.8": "bb48716e74e4998993f15bc57a55e4d0d73ccbd27a66d7cbed37605f7c67d747",
+  "aarch64-unknown-linux-gnu-0.11.8": "eee8dd658d20e5ac85fec9c2326b6cbc9d83a1eef09ef07433e58698ac849591",
+  "aarch64-unknown-linux-musl-0.11.8": "29418befb64f926a2dba3473e8e69acd00b36fb845d85344ef11321a993ad8f5",
+  "arm-unknown-linux-musleabihf-0.11.8": "858f50a1164e9d2e3d1641a5f9d81a8b098025bd4f40011882df4f6b7d6ee393",
+  "armv7-unknown-linux-gnueabihf-0.11.8": "b0674ede45b797362f34af0a75d6391e844992ae92a9c181a353e3892af4c325",
+  "armv7-unknown-linux-musleabihf-0.11.8": "eda6e549a1d3bea67de6550e84b05d75e5538350bf50ba229840ec92063f153e",
+  "i686-pc-windows-msvc-0.11.8": "59520c34c3c29a901bb490d4bec55a8e1d46c75d2fbad238871e18de733b4201",
+  "i686-unknown-linux-gnu-0.11.8": "4a82441b70adc3886a4f9c29a1070f104ed73c7e68d14cfa6d6343a8ce0c4ccc",
+  "i686-unknown-linux-musl-0.11.8": "56b8e8874ba09194c580583697c09cbe6c31626e5bb4cfb1f8bfbf4998a8d6c6",
+  "powerpc64le-unknown-linux-gnu-0.11.8": "7b66bcc99237d19fb25d8b1bcbc1f973f735027d49e7cb9ffa22cd539fefccbc",
+  "riscv64gc-unknown-linux-gnu-0.11.8": "dd43289c567fda3ca59ec714ffca09125f1149289448667f36a4bb7c29c859be",
+  "riscv64gc-unknown-linux-musl-0.11.8": "c06b5bbbfecb258f869b18168abb46ef974a76c786fa9350923b1cf38d1661a0",
+  "s390x-unknown-linux-gnu-0.11.8": "068eb3f47d0760d50cd2e0fc59cc2c09eb12a4ec8bb12c269f3aef706bf4dc1a",
+  "x86_64-apple-darwin-0.11.8": "c59d73bf34b58bc8e33a11629f7a255c11789fd00f03cd3e68ab2d1603645de9",
+  "x86_64-pc-windows-msvc-0.11.8": "c84629a56e0706b69a47ea35862208af827cb6fbfa1d0ca763c52c67594637e8",
+  "x86_64-unknown-linux-gnu-0.11.8": "56dd1b66701ecb62fe896abb919444e4b83c5e8645cca953e6ddd496ff8a0feb",
+  "x86_64-unknown-linux-musl-0.11.8": "de82507d12e31cfc86c1c776238f7c248e48e40d996dedc812d64fdd31c6ed12",
+  "aarch64-apple-darwin-0.11.7": "66e37d91f839e12481d7b932a1eccbfe732560f42c1cfb89faddfa2454534ba8",
+  "aarch64-pc-windows-msvc-0.11.7": "1387e1c94e15196351196b79fce4c1e6f4b30f19cdaaf9ff85fbd6b046018aa2",
+  "aarch64-unknown-linux-gnu-0.11.7": "f2ee1cde9aabb4c6e43bd3f341dadaf42189a54e001e521346dc31547310e284",
+  "aarch64-unknown-linux-musl-0.11.7": "46647dc16cbb7d6700f762fdd7a67d220abe18570914732bc310adc91308d272",
+  "arm-unknown-linux-musleabihf-0.11.7": "238974610607541ccdb3b8f4ad161d4f2a4b018d749dc9d358b0965d9a1ddd0f",
+  "armv7-unknown-linux-gnueabihf-0.11.7": "7aa9ddc128f58c0e667227feb84e0aac3bb65301604c5f6f2ab0f442aaaafd99",
+  "armv7-unknown-linux-musleabihf-0.11.7": "77a237761579125b822d604973a2d4afb62b10a8f066db4f793906deec66b017",
+  "i686-pc-windows-msvc-0.11.7": "04652b46b1be90a753e686b839e109a79af3d032ba96d3616c162dffdbe89e5c",
+  "i686-unknown-linux-gnu-0.11.7": "9c77e5b5f2ad4151c6dc29db5511af549e205dbd6e836e544c80ebfadd7a07ec",
+  "i686-unknown-linux-musl-0.11.7": "b067ce3e92d04425bc11b84dc350f97447d3e8dffafccb7ebebde54a56bfc619",
+  "powerpc64le-unknown-linux-gnu-0.11.7": "6ac23c519d1b06297e1e8753c96911fadee5abab4ca35b8c17da30e3e927d8ac",
+  "riscv64gc-unknown-linux-gnu-0.11.7": "2052356c7388d26dc4dfcf2d44e28b3f800785371f37c5f37d179181fe377659",
+  "riscv64gc-unknown-linux-musl-0.11.7": "219a25e413efb62c8ef3efb3593f1f01d9a3c22d1facf3b9c0d80b7caf3a5e56",
+  "s390x-unknown-linux-gnu-0.11.7": "760152aa9e769712d52b6c65a8d7b86ed3aac25a24892cf5998a522d84942f9e",
+  "x86_64-apple-darwin-0.11.7": "0a4bc8fcde4974ea3560be21772aeecab600a6f43fa6e58169f9fa7b3b71d302",
+  "x86_64-pc-windows-msvc-0.11.7": "fe0c7815acf4fc45f8a5eff58ed3cf7ae2e15c3cf1dceadbd10c816ec1690cc1",
+  "x86_64-unknown-linux-gnu-0.11.7": "6681d691eb7f9c00ac6a3af54252f7ab29ae72f0c8f95bdc7f9d1401c23ea868",
+  "x86_64-unknown-linux-musl-0.11.7": "64ddb5f1087649e3f75aa50d139aa4f36ddde728a5295a141e0fa9697bfb7b0f",
+  "aarch64-apple-darwin-0.11.6": "4b69a4e366ec38cd5f305707de95e12951181c448679a00dce2a78868dfc9f5b",
+  "aarch64-pc-windows-msvc-0.11.6": "bee7b25a7a999f17291810242b47565c3ef2b9205651a0fd02a086f261a7e167",
+  "aarch64-unknown-linux-gnu-0.11.6": "d5be4bf7015ea000378cb3c3aba53ba81a8673458ace9c7fa25a0be005b74802",
+  "aarch64-unknown-linux-musl-0.11.6": "d14ebd6f200047264152daaf97b8bd36c7885a5033e9e8bba8366cb0049c0d00",
+  "arm-unknown-linux-musleabihf-0.11.6": "4410a9489e0a29ce8f86fc8604b75a3dd821e9e52734282cbb413b4e19c5c70a",
+  "armv7-unknown-linux-gnueabihf-0.11.6": "9758d49c200c211ccb2c9cbf43877102031c3457e80b6c3cb9da1e4c00119d2a",
+  "armv7-unknown-linux-musleabihf-0.11.6": "0677423d98cea5011d346d7d4a33a53360b99a51a04df4b45f67d43a8308c831",
+  "i686-pc-windows-msvc-0.11.6": "c5569da150166363389a719553d87f99e0c29e542b2c31bc8bd4aeeb8eb83d99",
+  "i686-unknown-linux-gnu-0.11.6": "b4bf8d78478b573c1816b17ec86da7ade14242cd68ac092c1701c5b4a75dc228",
+  "i686-unknown-linux-musl-0.11.6": "ca31705d93f48313d5ffdc23da165e680c6c5389d9a2cc62b85a1ed495e0331f",
+  "powerpc64le-unknown-linux-gnu-0.11.6": "153397d3d82e45e68fb1f4a40ee9898245ec8ed86fd03fcaacaf6e793316acf7",
+  "riscv64gc-unknown-linux-gnu-0.11.6": "0e3ead8667b51b07b5fb9d114bcd1914a5fe3159e6959a584dc2f89c6724e123",
+  "riscv64gc-unknown-linux-musl-0.11.6": "87d5932bffef3b7b9cba4a2a042f95edf75cd34555fc80cfa98cc5a4426635f9",
+  "s390x-unknown-linux-gnu-0.11.6": "6e3d4338da2db2c63326721f1eb3b4f32d9bde24aeff11208d397e1aeba8678e",
+  "x86_64-apple-darwin-0.11.6": "8e0ed5035eaa28c7c8cd2a46b5b9a05bfff1ef01dbdc090a010eb8fdf193a457",
+  "x86_64-pc-windows-msvc-0.11.6": "99aa60edd017a256dbf378f372d1cff3292dbc6696e0ea01716d9158d773ab77",
+  "x86_64-unknown-linux-gnu-0.11.6": "0c6bab77a67a445dc849ed5e8ee8d3cb333b6e2eba863643ce1e228075f27943",
+  "x86_64-unknown-linux-musl-0.11.6": "aa342a53abe42364093506d7704214d2cdca30b916843e520bc67759a5d20132",
+  "aarch64-apple-darwin-0.11.5": "470993e87503874c7c48861daa308b48a7c367e117235bbecf19368b9fdd35b2",
+  "aarch64-pc-windows-msvc-0.11.5": "9b9b99a985cccf249225aaad76412823e9d9736d605dc2252151172a7f6ab3db",
+  "aarch64-unknown-linux-gnu-0.11.5": "3e9b525d686ae4f3682412bce21536366a5c79616a41055530319c501c883169",
+  "aarch64-unknown-linux-musl-0.11.5": "d73860013061c62d6a89f3370527d4c407214038af331147773ae2fd8f6394c1",
+  "arm-unknown-linux-musleabihf-0.11.5": "dcfb4dc15f46eae90ac6d64e7dfc91d8bc0b16816f53b9f8d58ccc8a1220dbb8",
+  "armv7-unknown-linux-gnueabihf-0.11.5": "818d86386fb57ca4182f39df25dd6160e97300d5ba362bc44e25d8adc904776c",
+  "armv7-unknown-linux-musleabihf-0.11.5": "2cae8baae2c1b42249e656e16f5fe733189b0760ee93995be024f9cc5e72eb19",
+  "i686-pc-windows-msvc-0.11.5": "2057ccf3dba9ed23755df92318a08ab221e9e088385c667292acc09d9cc477c6",
+  "i686-unknown-linux-gnu-0.11.5": "2d340e2e5b3354ee7208bb8f2bbf4d2347d7ffdf2af733c21bee98746e34076d",
+  "i686-unknown-linux-musl-0.11.5": "ffe2bc9e0c4fdc18f69b7c5bc016a03fa17028d42620ab2b024ad5bb22cd3f3d",
+  "powerpc64le-unknown-linux-gnu-0.11.5": "c4dabaaa36a13989ab04389263064ca5c27093eb2e7c851ab62d50b6312d9800",
+  "riscv64gc-unknown-linux-gnu-0.11.5": "6ae3ec3cf1aab72604bc6aa8486faf4b473066422c49d9c42ea8366ff3039de4",
+  "riscv64gc-unknown-linux-musl-0.11.5": "d4686fb144563a40e791fc3f010a91e57fdce9cac7a03b8a14a972c25be4464c",
+  "s390x-unknown-linux-gnu-0.11.5": "1309f1e462462dab2da6a55c37012a228d1c06a55c5b43f8ef901ba1599d9e12",
+  "x86_64-apple-darwin-0.11.5": "b8964bed538143f9016d807e421e28f0237a29589851fc79e8159751ac64779a",
+  "x86_64-pc-windows-msvc-0.11.5": "3fa5b6ea9de9256a035e0471f5ef0bb5d95344659723d6eb063e27c76431515d",
+  "x86_64-unknown-linux-gnu-0.11.5": "0d87793f733f327849ebf9cf51b576cfb08328e22af73061405e4bec96ae84d1",
+  "x86_64-unknown-linux-musl-0.11.5": "ee8a52743ce3979e52872b49c5e58ffa541048cb95132142bff23fe5608d73ea",
+  "aarch64-apple-darwin-0.11.4": "9b9cb6c6f58c3246dbf3351ed4e97c500bc3266f5f237d2fd620b66e1c31dc56",
+  "aarch64-pc-windows-msvc-0.11.4": "708b1c210109e50ff520bcd9b6d29cbd8cee584bb55e84d3d1941bf75ab0893d",
+  "aarch64-unknown-linux-gnu-0.11.4": "f5aa91bba0b98d85a4e5262e2847f9ab2273c754f6374dff62b37ef18c65a2e7",
+  "aarch64-unknown-linux-musl-0.11.4": "a02ec7667d7bb1d33cdb7e1de22f7e4242967e3df7e350bac6212515e3bce8ac",
+  "arm-unknown-linux-musleabihf-0.11.4": "5bbc59d8c3d5fdade88fca47e4c18298e44a367e178e97e11466b22e992edae2",
+  "armv7-unknown-linux-gnueabihf-0.11.4": "9d2299155b65988643a55777c638408a0df8e65f606933d1e44691ada72ff106",
+  "armv7-unknown-linux-musleabihf-0.11.4": "43b1e02f8f4b27fd1d085fb14a246638bb607af32408cb13c5c3b3fb47db027f",
+  "i686-pc-windows-msvc-0.11.4": "661588b3607e6d5bb78551f596772a0d04a930ce128189c90800d07f6fca1998",
+  "i686-unknown-linux-gnu-0.11.4": "4248773a2574c3b697588655d7bf14f97baa744c3e156585230e5c711befa6ff",
+  "i686-unknown-linux-musl-0.11.4": "0323c08c1e7455cdf65c89296eda28bad9051cb09d16ea3ce1d0bf718143449e",
+  "powerpc64le-unknown-linux-gnu-0.11.4": "3ddb764538a5dcb4967d7375fde193ce5391e37ddd4d1242012d04cf3848479f",
+  "riscv64gc-unknown-linux-gnu-0.11.4": "93db93607a824d677c47003ee828936913cfdeb2c871bb34cd79c3ec4481e2b1",
+  "riscv64gc-unknown-linux-musl-0.11.4": "78f0d7f92244ce3d7a7a0df5fab2495450bcb18600b59acf1755e77cafed2300",
+  "s390x-unknown-linux-gnu-0.11.4": "07361e1fb32e870841a27d3d7b0b20c4a81e0cc25eeb8b9115425bfd227d2d05",
+  "x86_64-apple-darwin-0.11.4": "c326edaf3fd492f53d1c58777f3459c0d87bf9dae8d89e80aec4b0da6622dcf3",
+  "x86_64-pc-windows-msvc-0.11.4": "26d84455a40b0272b2ab4785cad298ff2c89cd0765b482e9f85b5a1bd880a863",
+  "x86_64-unknown-linux-gnu-0.11.4": "12f9a192bb32d70470aa22cbd2a193d1323a3f58f6ac5f9e3866aaca760c98c6",
+  "x86_64-unknown-linux-musl-0.11.4": "36ce1c5d8997db9b6a24d0f41646d5509b6d1d8b9448c7325f8248a6ea5d4b00",
+  "aarch64-apple-darwin-0.11.3": "2bc3d0c7bf2bd08325b1e170abac6f7e5b3346e1d4eab3370d17cefec934996f",
+  "aarch64-pc-windows-msvc-0.11.3": "e99c56f9ab5e1e1ddcaea3e2389990c94baf38e0d7cb2148de08baf2d3261d49",
+  "aarch64-unknown-linux-gnu-0.11.3": "711382e3158433f06b11d99afb440f4416359fc3c84558886d8ed8826a921bff",
+  "aarch64-unknown-linux-musl-0.11.3": "8ecec82cb9a744d5fabff6d16d7777218a7730f699d2aa0d2f751c17858e2efa",
+  "arm-unknown-linux-musleabihf-0.11.3": "3d021046a94ad11f12b9d83f36442a1a28e92e7149c3f79ba2951c96653dafac",
+  "armv7-unknown-linux-gnueabihf-0.11.3": "13c9a0f5f624275ccd36db2896607f4fee3585f420734b16f6c66d70e32aa458",
+  "armv7-unknown-linux-musleabihf-0.11.3": "260a88e2f00daab0363a745fde036a7881002d7a81094388f31925acb284110b",
+  "i686-pc-windows-msvc-0.11.3": "036fa39fa5ea3cb86c127324924b913b5858e8d91c4cb413edacfc3123001696",
+  "i686-unknown-linux-gnu-0.11.3": "b9410c8dae2fa0d4939af5b0ee7272d5591bd55890e8274dcf7f1aea84bfe043",
+  "i686-unknown-linux-musl-0.11.3": "afe533fd409105e753d844490c65a4375e75bfb3812e49122684f996bed9e90a",
+  "powerpc64le-unknown-linux-gnu-0.11.3": "5cdcadf4d50a5354312bc8ef37c2a6cfab4e2f13ccdf8380d3012b927b4ded95",
+  "riscv64gc-unknown-linux-gnu-0.11.3": "8271e07ed9695870f4b0ae5ec722e3ae08fff280068f08bc6a8ca76c67d7fefa",
+  "riscv64gc-unknown-linux-musl-0.11.3": "b750fc8393ced9939448849b05e94de6bf1e998bb7030c4ebe744b47b372bce9",
+  "s390x-unknown-linux-gnu-0.11.3": "6dc4f555a5f6515f7fddb281422d2a8a3943853dae5de837bbb5d996d7576c71",
+  "x86_64-apple-darwin-0.11.3": "b0e05e0b43a000fdc2132ee3f3400ba5dee427bc2337d3ec4eb8cf4f3d5722af",
+  "x86_64-pc-windows-msvc-0.11.3": "ae681c0aaec7cc96af184648cb88d73f8393ed60fa5880abdd6bdb910f9b227c",
+  "x86_64-unknown-linux-gnu-0.11.3": "c0f3236f146e55472663cfbcc9be3042a9f1092275bbe3fe2a56a6cbfd3da5ce",
+  "x86_64-unknown-linux-musl-0.11.3": "8b40cf16b849634b81a530a3d0a0bcae5f24996ef9ae782976fd69b6266d3b8e",
  "aarch64-apple-darwin-0.11.2": "4beaa9550f93ef7f0fc02f7c28c9c48cd61fe30db00f5ac8947e0a425c3fb282",
  "aarch64-pc-windows-msvc-0.11.2": "ffdded8338205f53727b51d404563a5ac8eaa9aea53279a7b7c42177e11d478c",
  "aarch64-unknown-linux-gnu-0.11.2": "04792cac761c4a6ba78267f36f2af541b7f92196d42ac55d21d3ff6b0f5ab6a5",
@@ -6,7 +6,7 @@ This document covers advanced options for configuring which version of uv to ins

 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version: "latest"
 ```
@@ -15,7 +15,7 @@ This document covers advanced options for configuring which version of uv to ins

 ```yaml
 - name: Install a specific version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version: "0.4.4"
 ```
@@ -28,21 +28,21 @@ to install the latest version that satisfies the range.

 ```yaml
 - name: Install a semver range of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version: ">=0.4.0"
 ```

 ```yaml
 - name: Pinning a minor version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version: "0.4.x"
 ```

 ```yaml
 - name: Install a pep440-specifier-satisfying version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version: ">=0.4.25,<0.5"
 ```
@@ -54,7 +54,7 @@ You can change this behavior using the `resolution-strategy` input:

 ```yaml
 - name: Install the lowest compatible version of uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version: ">=0.4.0"
    resolution-strategy: "lowest"
@@ -76,7 +76,7 @@ uv defined as a dependency in `pyproject.toml` or `requirements.txt`.

 ```yaml
 - name: Install uv based on the version defined in pyproject.toml
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version-file: "pyproject.toml"
 ```
@@ -23,7 +23,7 @@ The computed cache key is available as the `cache-key` output:
 ```yaml
 - name: Setup uv
  id: setup-uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
 - name: Print cache key
@@ -50,7 +50,7 @@ You can optionally define a custom cache key suffix.
 ```yaml
 - name: Enable caching and define a custom cache key suffix
  id: setup-uv
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    cache-suffix: "optional-suffix"
@@ -89,7 +89,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Define a cache dependency glob
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    cache-dependency-glob: "**/pyproject.toml"
@@ -97,7 +97,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Define a list of cache dependency globs
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    cache-dependency-glob: |
@@ -107,7 +107,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Define an absolute cache dependency glob
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    cache-dependency-glob: "/tmp/my-folder/requirements*.txt"
@@ -115,7 +115,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Never invalidate the cache
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    cache-dependency-glob: ""
@@ -128,7 +128,7 @@ By default, the cache will be restored.

 ```yaml
 - name: Don't restore an existing cache
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    restore-cache: false
@@ -142,7 +142,7 @@ By default, the cache will be saved.

 ```yaml
 - name: Don't save the cache after the run
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    save-cache: false
@@ -168,7 +168,7 @@ It defaults to `setup-uv-cache` in the `TMP` dir, `D:\a\_temp\setup-uv-cache` on

 ```yaml
 - name: Define a custom uv cache path
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    cache-local-path: "/path/to/cache"
 ```
@@ -187,7 +187,7 @@ input.

 ```yaml
 - name: Don't prune the cache before saving it
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    prune-cache: false
@@ -205,7 +205,7 @@ To force managed Python installs, set `UV_PYTHON_PREFERENCE=only-managed`.

 ```yaml
 - name: Cache Python installs
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    cache-python: true
@@ -213,12 +213,17 @@ To force managed Python installs, set `UV_PYTHON_PREFERENCE=only-managed`.

 ## Ignore nothing to cache

-By default, the action will fail if caching is enabled but there is nothing to upload (the uv cache directory does not exist).
+By default, the action will fail if caching is enabled but there is nothing to upload (the uv cache directory does not exist) with an error like
+
+```console
+Error: Cache path /home/runner/.cache/uv does not exist on disk. This likely indicates that there are no dependencies to cache. Consider disabling the cache input if it is not needed.
+```
+
 If you want to ignore this, set the `ignore-nothing-to-cache` input to `true`.

 ```yaml
 - name: Ignore nothing to cache
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    enable-cache: true
    ignore-nothing-to-cache: true
@@ -10,7 +10,7 @@ are automatically verified by this action. The sha256 hashes can be found on the

 ```yaml
 - name: Install a specific version and validate the checksum
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    version: "0.3.1"
    checksum: "e11b01402ab645392c7ad6044db63d37e4fd1e745e015306993b07695ea5f9f8"
@@ -39,7 +39,7 @@ The `archive_format` field is currently ignored.

 ```yaml
 - name: Use a custom manifest file
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    manifest-file: "https://example.com/my-custom-manifest.ndjson"
 ```
@@ -58,7 +58,7 @@ You can disable this by setting the `add-problem-matchers` input to `false`.

 ```yaml
 - name: Install the latest version of uv without problem matchers
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    add-problem-matchers: false
 ```
@@ -9,7 +9,7 @@ This allows directly using it in later steps:

 ```yaml
 - name: Install the latest version of uv and activate the environment
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    activate-environment: true
 - run: uv pip install pip
@@ -20,7 +20,7 @@ By default, the venv is created at `.venv` inside the `working-directory`.
 You can customize the venv location with `venv-path`, for example to place it in the runner temp directory:

 ```yaml
- uses: astral-sh/setup-uv@v7
+- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    activate-environment: true
    venv-path: ${{ runner.temp }}/custom-venv
@@ -51,7 +51,7 @@ are not sufficient, you can provide a custom GitHub token with the necessary per

 ```yaml
 - name: Install the latest version of uv with a custom GitHub token
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
 ```
@@ -69,7 +69,7 @@ input:

 ```yaml
 - name: Install the latest version of uv with a custom tool dir
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    tool-dir: "/path/to/tool/dir"
 ```
@@ -88,7 +88,7 @@ If you want to change this behaviour (especially on self-hosted runners) you can

 ```yaml
 - name: Install the latest version of uv with a custom tool bin dir
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    tool-bin-dir: "/path/to/tool-bin/dir"
 ```
@@ -105,7 +105,7 @@ This action supports expanding the `~` character to the user's home directory fo

 ```yaml
 - name: Expand the tilde character
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    cache-local-path: "~/path/to/cache"
    tool-dir: "~/path/to/tool/dir"
@@ -122,7 +122,7 @@ If you want to ignore this, set the `ignore-empty-workdir` input to `true`.

 ```yaml
 - name: Ignore empty workdir
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    ignore-empty-workdir: true
 ```
@@ -145,7 +145,7 @@ This action sets several environment variables that influence uv's behavior and

 ```yaml
 - name: Example using environment variables
-  uses: astral-sh/setup-uv@v7
+  uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
  with:
    python-version: "3.12"
    tool-dir: "/custom/tool/dir"
@@ -0,0 +1,81 @@
+# setup-uv Repository Threat Model
+
+## Overview
+
+`setup-uv` is a GitHub Action that installs or reuses `uv`, changes later-step paths and environment, may discover and execute a Python interpreter, may create or clear a virtual environment, and may restore or save caches. It runs with the workflow job's filesystem, network, token, secrets, OIDC, artifact, and release authority.
+
+The consumer runtime is the selected ref's committed action metadata, bundles, and runner-interpreted companion files; source alone is not evidence of shipped behavior. Privileged automation that generates, updates, or publishes those artifacts is also in scope.
+
+The assets are job credentials; integrity of installed executables, interpreter, environment, checkout, runner, artifacts, and caches; isolation between jobs sharing caches or persistent runners; integrity of published action refs; and workflow compute/storage availability.
+
+Material failures are unauthorized executable selection, credential disclosure, premature execution of lower-authority content, filesystem escape or destructive path use, cross-authority cache/runner persistence, and unauthorized publication.
+
+## Threat Model, Trust Boundaries, and Assumptions
+
+### Authority and trust boundaries
+
+| Actor or input | Trust decision |
+|---|---|
+| Maintainers, repository/configuration administrators, and GitHub infrastructure | Trusted roots for source, bundles, workflows, refs, rulesets, environments, runner protocol, hosted isolation, and cache service. A lower-authority path into these roots is in scope; their compromise alone is not a repository bug. |
+| Consumer workflow authors and runner operators | Control the action ref, trigger, runner, permissions, secrets, proxy, environment, inputs, paths, globs, and custom sources. These are trusted choices unless derived from lower-authority event data. Selecting a custom manifest delegates metadata and executable authority; selecting a path authorizes normal operations on it and intended referents. |
+| Selected checkout, project authors, and pull-request contributors | The consumer delegates project/version files, interpreter discovery state, virtual environments, symlinks, cache inputs, and code execution within `setup-uv`'s process environment. Checkout-controlled behavior is trusted unless it overrides an explicit workflow choice or crosses an independent cache, runner, remote, or publication boundary. |
+| Remote metadata and artifacts | Default official endpoints, TLS roots, and an operator proxy are trusted mutable authorities. A custom manifest authorizes its URLs and hashes; a hash supplied by that same authority detects corruption, not malice. |
+| Cache and runner-state producers/consumers | Same-principal state is trusted by default. Integrity attacks require a lower-authority producer and higher-authority consumer. Confidentiality can flow the opposite way because lower-authority refs may read eligible higher-authority caches. Shared self-hosted state creates a boundary only when principals and authority differ. |
+| GitHub-managed automation | Dependency, coding-agent, and review workflows may exist outside the committed tree. Treat them as external principals and obtain their effective trigger, actor, token, environment, ref, and write/secret authority from live evidence. |
+
+### Assumptions
+
+- Running the selected `uv` and checkout-selected Python interpreters is intended. Project execution is out of scope unless it bypasses an explicit workflow choice or crosses an independent cache, runner, remote, or publication boundary.
+- Mutable official manifests, ranges, `latest`, and unprotected refs are not attacker control. A protected ref or independent checksum matters only if the selected bundle actually enforces it.
+- Same-user changes to paths, environment, proxies, or tool/cache state are not separate attacks. Demonstrate a cross-principal or lower-to-higher boundary.
+- Content merged through a trust path that can also merge executable code is not a lower-authority source; require a narrower writer or post-review mutation path.
+- Running `setup-uv` on an untrusted checkout with higher authority is a consumer trust decision; checkout-selected code may inherit the action environment.
+- Authorized paths include expected symlink/junction referents. Absolute paths and paths outside the workspace are supported; an escape requires independent control crossing an unauthorized boundary.
+- Hosted runners are assumed ephemeral and isolated. Persistence or hostile co-tenancy on self-hosted runners must be demonstrated.
+- Branch/tag rules, environments, token defaults, cache visibility, fork policy, dynamic workflows, and runner allocation are external state. Re-query required approvals/checks, bypass actors, tag movement, deployment reviewers/principals, release targets, and effective permissions for each attack path.
+- Web-application classes such as sessions, CSRF, XSS, SQL injection, and tenant isolation are not applicable.
+
+### Security invariants
+
+1. **Published runtime:** review `action.yml`, committed `dist/*.cjs`, and runner-interpreted shipped files; source-only fixes do not protect consumers.
+2. **Executable identity:** precedence is workflow version, version file, project configuration, then `latest`. Manifest authority, platform, variant, URL, checksum, mirror fallback, extraction, and cache placement must bind the intended artifact. A tool-cache hit bypasses download validation and depends on cache provenance.
+3. **Credential recipients:** tokens and URL credentials may reach only workflow-authorized origins, redirects, paths, and logs. Metadata authority does not imply token-recipient authority.
+4. **Executable boundaries:** checkout-selected interpreters are authorized by default. Explicit workflow selections must win, and independent cache, runner, or remote state must not substitute executables or gain additional authority.
+5. **Paths and action channels:** path/environment changes, virtual-environment clearing, outputs, state, and problem matchers must affect only authorized targets and keep untrusted values as data.
+6. **Cache boundaries:** keys, scope, restore paths, and executable content must prevent lower-to-higher poisoning; cache contents and post-action path re-resolution must prevent higher-to-lower disclosure, destructive pruning, or persistence.
+7. **Workflow and release authority:** unreviewed code or mutable tooling must not acquire write, secret, OIDC, artifact, deployment, tag, or publication authority. Only the intended reviewed bundles and commit may be released.
+8. **Availability:** independently controlled manifests, archives, globs, traversal, and caches must stay within the accepted one-job resource-failure model.
+
+### Finding gate
+
+Before reporting, identify the attacker and victim principals; exact controlled input; scanned action and checkout refs; runtime reachability in committed bundles; effective token, secrets/OIDC, environment gates, cache scope, and runner persistence; applicable defaults and opt-ins; validation performed or skipped; declared trust roots; baseline versus incremental capability; and concrete impact. Reproduce platform-specific behavior and distinguish the scanned ref from other versions.
+
+Missing independent attacker control, a violated guarantee, committed-runtime reachability, incremental capability, or practical impact is `NOT_APPLICABLE`, `INTENDED_BEHAVIOR`, `CORRECTNESS`, `DEFENSE_IN_DEPTH`, or `NEEDS_EVIDENCE`, not a security severity.
+
+## Attack Surface, Mitigations, and Attacker Stories
+
+| Surface | Security-relevant behavior and controls | Reportable attacker story |
+|---|---|---|
+| Published action and build/release supply chain | Consumers execute committed bundles and embedded dependencies. Verify source/bundle alignment, lockfile integrity, dependency-install policy, reproducible/generated-diff checks, immutable action pins, branch enforcement, and publication target checks. | A lower-authority contributor or dependency changes shipped code, or release automation publishes a different commit, by bypassing an effective review, branch, or release control. |
+| Version, manifest, proxy, and network selection | Project files may select an official version by documented precedence. Custom manifests may select URLs, hashes, variants, and platforms and may reach arbitrary network locations. Parsing should reject malformed, ambiguous, unsupported, or incorrectly typed records; verify HTTPS, time/size bounds, proxy behavior, and selected-ref defaults. | Lower-authority event/project data violates a promised fixed version, escapes the selected manifest, probes runner-only services, causes material resource use, selects attacker bytes, or redirects later credentials. Operator selection of a custom authority is not itself a finding. |
+| Artifact URL, token, checksum, extraction, and tool cache | Mirror fallback must preserve identity and checksum policy. Origin gating should restrict tokens; redirect handling should strip authorization across unauthorized hosts and reject downgrade. Verify checksum precedence and reject missing/empty hashes when policy requires validation. Independent hashes must precede extraction. Native helpers come from `PATH`; tool-cache hits skip network/hash validation. | An attacker receives a usable token outside delegated authority, bypasses an independent pin, exploits archive/link traversal, substitutes the cached executable, or poisons shared tool state later executed with higher authority. Same-authority manifest hashes and same-user cache changes do not establish the boundary. |
+| Interpreter, PATH, virtual environment, and action channels | Checkout-selected interpreters, virtual environments, paths, symlinks, and helpers are delegated project authority. Explicit workflow choices must bind; the action also changes later-step paths/environment, emits state/outputs, invokes native helpers, and consumes cache/runner state. | Independent cache, runner, or remote content substitutes an executable; an explicit workflow choice is bypassed; or action channels cross an authority boundary. Same-checkout interpreter, path, and helper effects are not findings. |
+| GitHub uv/Python caches and post action | Cache keys should partition platform, interpreter, dependency, and policy state and restore without unsafe fallback. Determine cache defaults, visibility, and the exact hit/miss path from the selected ref and GitHub policy; an exact hit may suppress post save/prune. Post processing re-reads inputs/config/environment and may save re-resolved uv or Python paths. | A lower producer supplies executable content to a higher consumer; a higher producer exposes private data to a lower cache reader; or a later successful step retargets a cache miss toward sensitive files, destructive pruning, or cross-job persistence. Existing equal-authority code with the same secrets often gains no new confidentiality. |
+| CI, updater, dynamic automation, and release workflows | PR workflows intentionally execute contributor code. Verify effective permissions, fork behavior, credential persistence, mutable tooling, security-upload authority, and whether checks are required. Updaters convert remote data into source under write authority. Distinguish ruleset-required deployment from human review present only in a workflow DAG. | Unreviewed code gains write/secret/OIDC/artifact authority; remote metadata becomes executable generated source; a dynamic workflow has unexpected authority; or an actor satisfies a deployment/tag rule without the intended review and publishes a malicious ref. |
+| Availability and logging | Manifests, version enumeration, archives, globs, hashing, caches, and remote strings can consume resources or influence logs. Verify size/count/expansion bounds, timeouts, retries, top-level error handling, and that parsing never executes data. | Independently controlled input causes reliable material workflow cost, disk/memory exhaustion, or meaningful log/output manipulation. A bounded one-job failure or operator-selected broad input is usually Low or correctness. |
+| Lower-priority classes | Shell injection is constrained where child execution uses argv, but workflow shell blocks still require quoting review. Prototype pollution requires a dangerous merge/sink. Secret-shaped strings require proof of a genuine usable secret. Documentation drift, range surprises, malformed trusted config, and test-only code normally lack a security boundary. | Report only when a concrete lower-authority value reaches an execution, credential, persistent-state, publication, or material-availability sink. |
+
+## Severity Calibration (Critical, High, Medium, Low)
+
+Severity follows the complete attack graph and incremental capability, not the presence of words such as token, checksum, cache, manifest, archive, Python, PATH, release, or OIDC.
+
+| Severity | Threshold | Representative examples |
+|---|---|---|
+| **Critical** | A low-prerequisite remote/lower-authority attacker compromises default distribution or installation across many consumers, publishes trusted malicious action artifacts, or gains broad credentials/runner control under safe defaults without first compromising a declared trust root. | Bypass an effective hash/origin control to distribute an automatically executed malicious binary at scale; reach publication authority to ship malicious bundles or move trusted refs without required approval; exploit default-accepted archive content for host overwrite or cross-job execution across hosted runners. |
+| **High** | A demonstrated lower-authority input crosses an execution, confidentiality, integrity, or persistence boundary in a privileged job and gains substantial capability. | Independent shared-state interpreter substitution in a write/OIDC release job; shared cache poisoning later executed with secrets; high-value cache disclosure to an untrusted ref; usable write-token disclosure; independent-pin bypass; archive/cache escape into sensitive state. |
+| **Medium** | A real but constrained crossing causes limited credential/filesystem impact, reliable remote denial of service, scoped persistence, or premature execution in a realistic uncommon configuration. | Limited executable substitution from independent cache/runner state in a read-only job; same-repository cache confusion or disclosure; reliable hosted-runner exhaustion; disclosure of a usable read-only private token; output manipulation without publication or high-value credentials. |
+| **Low** | A genuine weak boundary causes narrow disclosure, log/annotation spoofing, defense-in-depth weakness, exotic cache aliasing without a privileged consumer, or limited waste. | Confusing logs with no execution effect; bounded job failure; limited overwrite of nonexecuted cache data; disclosure of a path/URL without private data or follow-on capability. |
+
+Trust-root compromise may have Critical impact but is not a repository Critical without a lower-authority path into that root or an independent control that should have survived. High requires exact trigger, refs, effective authority, sink, and committed runtime; it cannot rely only on a trusted operator choosing malicious inputs, same-user state changes, or code already intentionally executed with equal authority. A separate privileged consumer, broad secret, persistent trusted state, publication path, or cross-repository boundary can raise Medium to High.
+
+Normally non-reportable without additional evidence: expected mutability of ranges, `latest`, official/custom sources, or unprotected refs; documented project version selection; checkout-selected interpreters, paths, virtual environments, symlinks, and helpers; deliberate operator selection of manifests, proxies, checksums, or paths; same-principal cache/path changes; requested `uv` or dependency execution; trusted-runner `PATH` lookup; test/developer-only code without a shipped or privileged-workflow path; behavior fixed in the scanned ref; and correctness/compatibility/documentation issues without incremental confidentiality, integrity, persistence, or availability impact.
@@ -1,5 +1,401 @@
 // AUTOGENERATED_DO_NOT_EDIT
 export const KNOWN_CHECKSUMS: { [key: string]: string } = {
+  "aarch64-apple-darwin-0.11.13":
+    "196a58aa24da89144187670df7c407358028984537fbc2f8f2d8f7a2604980df",
+  "aarch64-pc-windows-msvc-0.11.13":
+    "07c3c997020430a9f287fc05ff4c63fd5744eec49df5392a34731ed1a0971f2e",
+  "aarch64-unknown-linux-gnu-0.11.13":
+    "12366407dc1fdba5179b10bd69c11ebfc2eff25791366089c0b2f5701056efc5",
+  "aarch64-unknown-linux-musl-0.11.13":
+    "bea8a97b1b3ed41491e075c1f474e7f0249582aa3f62849c4e874b5f34ddc95e",
+  "arm-unknown-linux-musleabihf-0.11.13":
+    "ee282adf170eb845821309ca6038fdd87a93dd25326f96efe6ea58a1b66a9064",
+  "armv7-unknown-linux-gnueabihf-0.11.13":
+    "4761e38e3d5ca62e87ef13bc35ba169e6ebd126472482095405367b31be88945",
+  "armv7-unknown-linux-musleabihf-0.11.13":
+    "d54342a96dda65339b4f7b9e6bb7a27b81aeeffca14e5dfa7911d00fe4a3ead9",
+  "i686-pc-windows-msvc-0.11.13":
+    "a9b2d96a118a401c7dc5b717752a074b6324ddc9b36dcb2b60466a4e2912a3ba",
+  "i686-unknown-linux-gnu-0.11.13":
+    "630774d3fd255a219a6eef58f004201737c60f4b282777fb99e599cd90567fe4",
+  "i686-unknown-linux-musl-0.11.13":
+    "52cb28c81ca43ea5184f944c31555981cb29c03c2497fa848541af5ee4d8448f",
+  "powerpc64le-unknown-linux-gnu-0.11.13":
+    "7f302104ea18a01381fe58434b593f887c4f10bc523ad50781de408fbec54354",
+  "riscv64gc-unknown-linux-gnu-0.11.13":
+    "3264ce97b34d5c8d37c1e67821a74960ca89237e001253309a3cda25fb416040",
+  "riscv64gc-unknown-linux-musl-0.11.13":
+    "44f23b8e59fd8628fb68383e4cbdf78c3cff02ed86d3dcea5605ebd7757ca363",
+  "s390x-unknown-linux-gnu-0.11.13":
+    "e0e5e0a652650900d97f6a660bae526601033d9d071ca5dd9ca735442161ebed",
+  "x86_64-apple-darwin-0.11.13":
+    "99aad3f4956f5b92efd83eca6d87bf03e10688899487ad541f904c9c25c61dc1",
+  "x86_64-pc-windows-msvc-0.11.13":
+    "0953ac2ef4fbe47ad469bfa80b658a577a02c4d73a2fb9c4c7c70dda432efded",
+  "x86_64-unknown-linux-gnu-0.11.13":
+    "f830ea3d38ae1492acf53cb7f2cd0f81d6ae22b42d2d7310a6c7d42c451e1a43",
+  "x86_64-unknown-linux-musl-0.11.13":
+    "5635afc285df86ce6f05f3f22335f9548b0026e58531904482c9670a1c1c65d9",
+  "aarch64-apple-darwin-0.11.12":
+    "bb7c6ef869ec00cd1452f4884acf23d00b153c356ba9197ae99a1bc1ceadb7f3",
+  "aarch64-pc-windows-msvc-0.11.12":
+    "393de1abc2f663cb9dd24405c7a7b31119e2a734609a233d9b89415821f39bf9",
+  "aarch64-unknown-linux-gnu-0.11.12":
+    "d6e3e5183e71bbd40400da3d2913743cefb98835d8312a5e7908c33865597515",
+  "aarch64-unknown-linux-musl-0.11.12":
+    "b70e87f15f12d750d218042c4ed36e41de0757eab249d332ee2e242e4174b5d5",
+  "arm-unknown-linux-musleabihf-0.11.12":
+    "c1991e652c345395eff3e43aaa0f2ce5d7f0c7ed0dd5a72dcb0a3c109289ac11",
+  "armv7-unknown-linux-gnueabihf-0.11.12":
+    "432e6a96ecc976861dc884d96ac3aa3cc305abc3bb49d3204544477d4a290c64",
+  "armv7-unknown-linux-musleabihf-0.11.12":
+    "a8855302bad162af78c8fa53f402128a3496b7806dc7201252e7f123eefed8b9",
+  "i686-pc-windows-msvc-0.11.12":
+    "98efe2a4cb9529724639aac488c43b28753e738b0f4c679d3e2dea150e5a9b20",
+  "i686-unknown-linux-gnu-0.11.12":
+    "22dbbbcd9088ad3ddefce9be142ce2b127b3950718222413e3890f7fbf4a567d",
+  "i686-unknown-linux-musl-0.11.12":
+    "fc5ff3fef5facf01a664f0942f372988804bda1bb8c7f9e9642d9d29398cf129",
+  "powerpc64le-unknown-linux-gnu-0.11.12":
+    "36619f91357b240648caed6557fe893922c7986319c070f4feb225e8f3180b49",
+  "riscv64gc-unknown-linux-gnu-0.11.12":
+    "9bdcac006731a2094ad002d93c4fe84a259484e4d35566e29fcb76962961cef9",
+  "riscv64gc-unknown-linux-musl-0.11.12":
+    "80012ba0aa3b21561c96edda003add87d9111daf3425e5cc3243957ca76ba396",
+  "s390x-unknown-linux-gnu-0.11.12":
+    "c9ae09f73066fb9c48beaec2ab4ad2407ce94354c5224e2982196577d6bf4581",
+  "x86_64-apple-darwin-0.11.12":
+    "32fb217e6181384bf6534b31adcc66cd552eff98643c4bb35832be8552486912",
+  "x86_64-pc-windows-msvc-0.11.12":
+    "e46956a6b088a0382101c797eef945c1b03826e629e968d434cf838d42d85b6b",
+  "x86_64-unknown-linux-gnu-0.11.12":
+    "9acdecddacba550ee616c02bb4616d894352022550c5977524556fd5077ce1d4",
+  "x86_64-unknown-linux-musl-0.11.12":
+    "591a7557f5ba7e51565f338dd4c50cebc12820ec2ebb8403a4304685f8d53ab9",
+  "aarch64-apple-darwin-0.11.11":
+    "3a185bf8f46a7b7c8b910d111825907b1638d0ae503cb3c333ae205772354046",
+  "aarch64-pc-windows-msvc-0.11.11":
+    "3d8f05de7ed9de885299565f78832a13e443be51de86260f25edb7cfd0fa05f6",
+  "aarch64-unknown-linux-gnu-0.11.11":
+    "155fe4d3b3cb4bfce118ab4b1380f71515ae874d13d9858171b4f9c26e16684d",
+  "aarch64-unknown-linux-musl-0.11.11":
+    "0fc9a49b3900f77ffaccf3ff69a70ddbc1d479e70ac5d8fd6416a7577b03c5a1",
+  "arm-unknown-linux-musleabihf-0.11.11":
+    "ef98cbcd50a62d063958740194497a44fc1dc07867b6fe001db1ab2e621f1f2e",
+  "armv7-unknown-linux-gnueabihf-0.11.11":
+    "c102609d34c06bdec87896d738a0e91df21f71faf21ae4379c7a1d7c961879e1",
+  "armv7-unknown-linux-musleabihf-0.11.11":
+    "6660651927263c587769697572f4843ac6ea91b2b2d24be1b9c8465e87d05b46",
+  "i686-pc-windows-msvc-0.11.11":
+    "c230fccbe5737e1a54a2f77ff3116c88fbee21c9b437323907618931b767410e",
+  "i686-unknown-linux-gnu-0.11.11":
+    "4be5e9901e87f90a9eb5ee11a08a8df2f637df76f3a2dcb11778991b7db9d9a2",
+  "i686-unknown-linux-musl-0.11.11":
+    "d2ded13fbaf59f5f1d3363c47a7cafb73cb7454db1e16cea13365bc28c75522d",
+  "powerpc64le-unknown-linux-gnu-0.11.11":
+    "5348415c8606e5efac5cb293d83d2ae71e43a2dcabf677c6a4cac965c1982c74",
+  "riscv64gc-unknown-linux-gnu-0.11.11":
+    "0eadf068918b960e7bf62eda83613c08d99f0d002b8d475d3383993191554d04",
+  "riscv64gc-unknown-linux-musl-0.11.11":
+    "0ee27ce77e32496bc46e01f1cbb730d13647cbca41934a5871bf2fe5fdc5ba39",
+  "s390x-unknown-linux-gnu-0.11.11":
+    "f19c950a93b1f5af4108267743f3de61346250b35c60cc552fb4187b534af770",
+  "x86_64-apple-darwin-0.11.11":
+    "57a1a8085b4088fbcbd5080c0c30723ba6d0692c89cd071c08a4209e8da602d1",
+  "x86_64-pc-windows-msvc-0.11.11":
+    "2f75a0db2c3530b6b3c24434dc38137f61ff1f4e5f2d7b4ddc5bcd142cf58b65",
+  "x86_64-unknown-linux-gnu-0.11.11":
+    "a767848254391855c96df271e9ca8b7f72dd172d310460447853d25d907b9ae0",
+  "x86_64-unknown-linux-musl-0.11.11":
+    "80521f18ba83109acd17e0730bd8ff898c3426aa62252c627d63418b353e788a",
+  "aarch64-apple-darwin-0.11.10":
+    "e93d6af7dfff7071edd16342ba9eeccfc28d8a7deaa5707efeecf63a63a74453",
+  "aarch64-pc-windows-msvc-0.11.10":
+    "3d5878cfc55106083ada1e41cccdde477413701eb9d34767e8ad973bb0863de6",
+  "aarch64-unknown-linux-gnu-0.11.10":
+    "91d5f4583539640765662ef86edcf3bf4db07439b622c7bed50c961240162046",
+  "aarch64-unknown-linux-musl-0.11.10":
+    "14c21bef6b54d268c6583d851095a543e6cb03a8e4bdca9a44ab91532b14cbc2",
+  "arm-unknown-linux-musleabihf-0.11.10":
+    "bea66b5dcfb3460a9a2c399033b071ec4a825ff3bf27c3fedc666dcbdc2354dd",
+  "armv7-unknown-linux-gnueabihf-0.11.10":
+    "ba259f6c14b5653f1b36400fb8c7862e499a4537201edda76991f2b044014fdb",
+  "armv7-unknown-linux-musleabihf-0.11.10":
+    "9d6e2ea60fae542e2bd9b36f44672e99fd941f7da0898533bc274329b001a055",
+  "i686-pc-windows-msvc-0.11.10":
+    "d56ad43d355d6c40fee4009d0fb7e6710416ce9b25bebf12a4127e51b3595b3c",
+  "i686-unknown-linux-gnu-0.11.10":
+    "ade0a830fd0b4b67c373c8ed1e46e5af2e312032ebbe15438beddeb5b1e4d8f3",
+  "i686-unknown-linux-musl-0.11.10":
+    "fb2ba8c938247f82908acf6ad41a19935b36d0fe7bbe6945ac1ba1f6044756fc",
+  "powerpc64le-unknown-linux-gnu-0.11.10":
+    "dfe5b338e2ebc1e5a2850a17bce35edb8e47550c221d9245c007eaf3003cb6ed",
+  "riscv64gc-unknown-linux-gnu-0.11.10":
+    "0c8776a0814bf7e32e025d13c733c3a800171a16fba77d1c21e6f10be6a28d8b",
+  "riscv64gc-unknown-linux-musl-0.11.10":
+    "8ae35c10dfcae262dee07c93a3d8d10c2ce597d4a152ba1a2f1385395a286ec3",
+  "s390x-unknown-linux-gnu-0.11.10":
+    "66dfdc5a216a9fbd7c2541a66f753544dddbcbb2f7a597c9bbc91d10af534c7d",
+  "x86_64-apple-darwin-0.11.10":
+    "8fd091211089973f528e147166e3af683ab4ecebd4312a55d0d17d87adbde67a",
+  "x86_64-pc-windows-msvc-0.11.10":
+    "7a0c424c7bc55a74751f13592235953ebbe182fa00355f7ae3fb7ab734a51638",
+  "x86_64-unknown-linux-gnu-0.11.10":
+    "077e1a0777bcf516e02f4ef245e269c8d1baa780438e4c50e09c5c997f85538a",
+  "x86_64-unknown-linux-musl-0.11.10":
+    "e3e78e7698d72c133c5ce851a6d60ee83afdc4c0edced382af9fd1f8e11d0105",
+  "aarch64-apple-darwin-0.11.9":
+    "7d02e5f206dcfb555284f8f6b8547890f0b8eb8987f44e9a0a2378cd23338733",
+  "aarch64-pc-windows-msvc-0.11.9":
+    "93de7822f6214c704ec15db1b4d33eabd3709a0303ec068723d9f5f5aa99e9e7",
+  "aarch64-unknown-linux-gnu-0.11.9":
+    "6d22be8d0d675668f657cee802a1344ea7941403f59eb2a6645ef316f69b4309",
+  "aarch64-unknown-linux-musl-0.11.9":
+    "31abb258d8ec2196993b82e746365717a86e3d3d55502b4c60f384540bf16306",
+  "arm-unknown-linux-musleabihf-0.11.9":
+    "60fd2f75fa0a927ce0373a9289e9490351be3142b00fb0e8da082ed652c7f23c",
+  "armv7-unknown-linux-gnueabihf-0.11.9":
+    "074f216882a79506f56f65413932dba9032ca6100285a562c48965688857970e",
+  "armv7-unknown-linux-musleabihf-0.11.9":
+    "0ebca62577232bab2c152fdd0fa81f78a28f8fd1f4f09689347759332aae996d",
+  "i686-pc-windows-msvc-0.11.9":
+    "9dbb9bf746f00dd379e7e1bd544a5e1b48a5f36408f75a7f8c6c89a7a5e5506a",
+  "i686-unknown-linux-gnu-0.11.9":
+    "84418c97aeadbbdb0b80090c43e29149c3d5c4a70c76ecffb738cd4a05d515d2",
+  "i686-unknown-linux-musl-0.11.9":
+    "f724d184888a52714229584536a3219f0c2fa416944fd476b52c7f597d9b3625",
+  "powerpc64le-unknown-linux-gnu-0.11.9":
+    "cbcdb1b6ee99ca69a572b75544dab484cd34e29109962f5945bb95ccd85d0d52",
+  "riscv64gc-unknown-linux-gnu-0.11.9":
+    "a825d1e6b62ca69971c50e6e356ebe478f7616a7873d9f7d7e17fb3efacabef2",
+  "riscv64gc-unknown-linux-musl-0.11.9":
+    "486b67c16381bb75d74daa86c091b36273cde617e0a2678e0b685b89047a6e6f",
+  "s390x-unknown-linux-gnu-0.11.9":
+    "caa3a59d49003d52c841625885bd60c87a957ed6173070af59c2ef7b4845b727",
+  "x86_64-apple-darwin-0.11.9":
+    "a974a0226ac5d3706ebaf660d3587b0dfb93ef9cf1fd146f97d40cd4ad69db98",
+  "x86_64-pc-windows-msvc-0.11.9":
+    "facbf9637c373761a96fa63c537d6c46581d357a65af01eacfd8c6319e6fb14e",
+  "x86_64-unknown-linux-gnu-0.11.9":
+    "5c43f82077ff0cd5aec588286cbabd89913e4d045bd4e8aa60b20b3ecffc36e3",
+  "x86_64-unknown-linux-musl-0.11.9":
+    "ac3e5051edbf30613b0f90d1c18d4807fea6b246f37490799fee0c1284a658b2",
+  "aarch64-apple-darwin-0.11.8":
+    "c729adb365114e844dd7f9316313a7ed6443b89bb5681d409eebac78b0bd06c8",
+  "aarch64-pc-windows-msvc-0.11.8":
+    "bb48716e74e4998993f15bc57a55e4d0d73ccbd27a66d7cbed37605f7c67d747",
+  "aarch64-unknown-linux-gnu-0.11.8":
+    "eee8dd658d20e5ac85fec9c2326b6cbc9d83a1eef09ef07433e58698ac849591",
+  "aarch64-unknown-linux-musl-0.11.8":
+    "29418befb64f926a2dba3473e8e69acd00b36fb845d85344ef11321a993ad8f5",
+  "arm-unknown-linux-musleabihf-0.11.8":
+    "858f50a1164e9d2e3d1641a5f9d81a8b098025bd4f40011882df4f6b7d6ee393",
+  "armv7-unknown-linux-gnueabihf-0.11.8":
+    "b0674ede45b797362f34af0a75d6391e844992ae92a9c181a353e3892af4c325",
+  "armv7-unknown-linux-musleabihf-0.11.8":
+    "eda6e549a1d3bea67de6550e84b05d75e5538350bf50ba229840ec92063f153e",
+  "i686-pc-windows-msvc-0.11.8":
+    "59520c34c3c29a901bb490d4bec55a8e1d46c75d2fbad238871e18de733b4201",
+  "i686-unknown-linux-gnu-0.11.8":
+    "4a82441b70adc3886a4f9c29a1070f104ed73c7e68d14cfa6d6343a8ce0c4ccc",
+  "i686-unknown-linux-musl-0.11.8":
+    "56b8e8874ba09194c580583697c09cbe6c31626e5bb4cfb1f8bfbf4998a8d6c6",
+  "powerpc64le-unknown-linux-gnu-0.11.8":
+    "7b66bcc99237d19fb25d8b1bcbc1f973f735027d49e7cb9ffa22cd539fefccbc",
+  "riscv64gc-unknown-linux-gnu-0.11.8":
+    "dd43289c567fda3ca59ec714ffca09125f1149289448667f36a4bb7c29c859be",
+  "riscv64gc-unknown-linux-musl-0.11.8":
+    "c06b5bbbfecb258f869b18168abb46ef974a76c786fa9350923b1cf38d1661a0",
+  "s390x-unknown-linux-gnu-0.11.8":
+    "068eb3f47d0760d50cd2e0fc59cc2c09eb12a4ec8bb12c269f3aef706bf4dc1a",
+  "x86_64-apple-darwin-0.11.8":
+    "c59d73bf34b58bc8e33a11629f7a255c11789fd00f03cd3e68ab2d1603645de9",
+  "x86_64-pc-windows-msvc-0.11.8":
+    "c84629a56e0706b69a47ea35862208af827cb6fbfa1d0ca763c52c67594637e8",
+  "x86_64-unknown-linux-gnu-0.11.8":
+    "56dd1b66701ecb62fe896abb919444e4b83c5e8645cca953e6ddd496ff8a0feb",
+  "x86_64-unknown-linux-musl-0.11.8":
+    "de82507d12e31cfc86c1c776238f7c248e48e40d996dedc812d64fdd31c6ed12",
+  "aarch64-apple-darwin-0.11.7":
+    "66e37d91f839e12481d7b932a1eccbfe732560f42c1cfb89faddfa2454534ba8",
+  "aarch64-pc-windows-msvc-0.11.7":
+    "1387e1c94e15196351196b79fce4c1e6f4b30f19cdaaf9ff85fbd6b046018aa2",
+  "aarch64-unknown-linux-gnu-0.11.7":
+    "f2ee1cde9aabb4c6e43bd3f341dadaf42189a54e001e521346dc31547310e284",
+  "aarch64-unknown-linux-musl-0.11.7":
+    "46647dc16cbb7d6700f762fdd7a67d220abe18570914732bc310adc91308d272",
+  "arm-unknown-linux-musleabihf-0.11.7":
+    "238974610607541ccdb3b8f4ad161d4f2a4b018d749dc9d358b0965d9a1ddd0f",
+  "armv7-unknown-linux-gnueabihf-0.11.7":
+    "7aa9ddc128f58c0e667227feb84e0aac3bb65301604c5f6f2ab0f442aaaafd99",
+  "armv7-unknown-linux-musleabihf-0.11.7":
+    "77a237761579125b822d604973a2d4afb62b10a8f066db4f793906deec66b017",
+  "i686-pc-windows-msvc-0.11.7":
+    "04652b46b1be90a753e686b839e109a79af3d032ba96d3616c162dffdbe89e5c",
+  "i686-unknown-linux-gnu-0.11.7":
+    "9c77e5b5f2ad4151c6dc29db5511af549e205dbd6e836e544c80ebfadd7a07ec",
+  "i686-unknown-linux-musl-0.11.7":
+    "b067ce3e92d04425bc11b84dc350f97447d3e8dffafccb7ebebde54a56bfc619",
+  "powerpc64le-unknown-linux-gnu-0.11.7":
+    "6ac23c519d1b06297e1e8753c96911fadee5abab4ca35b8c17da30e3e927d8ac",
+  "riscv64gc-unknown-linux-gnu-0.11.7":
+    "2052356c7388d26dc4dfcf2d44e28b3f800785371f37c5f37d179181fe377659",
+  "riscv64gc-unknown-linux-musl-0.11.7":
+    "219a25e413efb62c8ef3efb3593f1f01d9a3c22d1facf3b9c0d80b7caf3a5e56",
+  "s390x-unknown-linux-gnu-0.11.7":
+    "760152aa9e769712d52b6c65a8d7b86ed3aac25a24892cf5998a522d84942f9e",
+  "x86_64-apple-darwin-0.11.7":
+    "0a4bc8fcde4974ea3560be21772aeecab600a6f43fa6e58169f9fa7b3b71d302",
+  "x86_64-pc-windows-msvc-0.11.7":
+    "fe0c7815acf4fc45f8a5eff58ed3cf7ae2e15c3cf1dceadbd10c816ec1690cc1",
+  "x86_64-unknown-linux-gnu-0.11.7":
+    "6681d691eb7f9c00ac6a3af54252f7ab29ae72f0c8f95bdc7f9d1401c23ea868",
+  "x86_64-unknown-linux-musl-0.11.7":
+    "64ddb5f1087649e3f75aa50d139aa4f36ddde728a5295a141e0fa9697bfb7b0f",
+  "aarch64-apple-darwin-0.11.6":
+    "4b69a4e366ec38cd5f305707de95e12951181c448679a00dce2a78868dfc9f5b",
+  "aarch64-pc-windows-msvc-0.11.6":
+    "bee7b25a7a999f17291810242b47565c3ef2b9205651a0fd02a086f261a7e167",
+  "aarch64-unknown-linux-gnu-0.11.6":
+    "d5be4bf7015ea000378cb3c3aba53ba81a8673458ace9c7fa25a0be005b74802",
+  "aarch64-unknown-linux-musl-0.11.6":
+    "d14ebd6f200047264152daaf97b8bd36c7885a5033e9e8bba8366cb0049c0d00",
+  "arm-unknown-linux-musleabihf-0.11.6":
+    "4410a9489e0a29ce8f86fc8604b75a3dd821e9e52734282cbb413b4e19c5c70a",
+  "armv7-unknown-linux-gnueabihf-0.11.6":
+    "9758d49c200c211ccb2c9cbf43877102031c3457e80b6c3cb9da1e4c00119d2a",
+  "armv7-unknown-linux-musleabihf-0.11.6":
+    "0677423d98cea5011d346d7d4a33a53360b99a51a04df4b45f67d43a8308c831",
+  "i686-pc-windows-msvc-0.11.6":
+    "c5569da150166363389a719553d87f99e0c29e542b2c31bc8bd4aeeb8eb83d99",
+  "i686-unknown-linux-gnu-0.11.6":
+    "b4bf8d78478b573c1816b17ec86da7ade14242cd68ac092c1701c5b4a75dc228",
+  "i686-unknown-linux-musl-0.11.6":
+    "ca31705d93f48313d5ffdc23da165e680c6c5389d9a2cc62b85a1ed495e0331f",
+  "powerpc64le-unknown-linux-gnu-0.11.6":
+    "153397d3d82e45e68fb1f4a40ee9898245ec8ed86fd03fcaacaf6e793316acf7",
+  "riscv64gc-unknown-linux-gnu-0.11.6":
+    "0e3ead8667b51b07b5fb9d114bcd1914a5fe3159e6959a584dc2f89c6724e123",
+  "riscv64gc-unknown-linux-musl-0.11.6":
+    "87d5932bffef3b7b9cba4a2a042f95edf75cd34555fc80cfa98cc5a4426635f9",
+  "s390x-unknown-linux-gnu-0.11.6":
+    "6e3d4338da2db2c63326721f1eb3b4f32d9bde24aeff11208d397e1aeba8678e",
+  "x86_64-apple-darwin-0.11.6":
+    "8e0ed5035eaa28c7c8cd2a46b5b9a05bfff1ef01dbdc090a010eb8fdf193a457",
+  "x86_64-pc-windows-msvc-0.11.6":
+    "99aa60edd017a256dbf378f372d1cff3292dbc6696e0ea01716d9158d773ab77",
+  "x86_64-unknown-linux-gnu-0.11.6":
+    "0c6bab77a67a445dc849ed5e8ee8d3cb333b6e2eba863643ce1e228075f27943",
+  "x86_64-unknown-linux-musl-0.11.6":
+    "aa342a53abe42364093506d7704214d2cdca30b916843e520bc67759a5d20132",
+  "aarch64-apple-darwin-0.11.5":
+    "470993e87503874c7c48861daa308b48a7c367e117235bbecf19368b9fdd35b2",
+  "aarch64-pc-windows-msvc-0.11.5":
+    "9b9b99a985cccf249225aaad76412823e9d9736d605dc2252151172a7f6ab3db",
+  "aarch64-unknown-linux-gnu-0.11.5":
+    "3e9b525d686ae4f3682412bce21536366a5c79616a41055530319c501c883169",
+  "aarch64-unknown-linux-musl-0.11.5":
+    "d73860013061c62d6a89f3370527d4c407214038af331147773ae2fd8f6394c1",
+  "arm-unknown-linux-musleabihf-0.11.5":
+    "dcfb4dc15f46eae90ac6d64e7dfc91d8bc0b16816f53b9f8d58ccc8a1220dbb8",
+  "armv7-unknown-linux-gnueabihf-0.11.5":
+    "818d86386fb57ca4182f39df25dd6160e97300d5ba362bc44e25d8adc904776c",
+  "armv7-unknown-linux-musleabihf-0.11.5":
+    "2cae8baae2c1b42249e656e16f5fe733189b0760ee93995be024f9cc5e72eb19",
+  "i686-pc-windows-msvc-0.11.5":
+    "2057ccf3dba9ed23755df92318a08ab221e9e088385c667292acc09d9cc477c6",
+  "i686-unknown-linux-gnu-0.11.5":
+    "2d340e2e5b3354ee7208bb8f2bbf4d2347d7ffdf2af733c21bee98746e34076d",
+  "i686-unknown-linux-musl-0.11.5":
+    "ffe2bc9e0c4fdc18f69b7c5bc016a03fa17028d42620ab2b024ad5bb22cd3f3d",
+  "powerpc64le-unknown-linux-gnu-0.11.5":
+    "c4dabaaa36a13989ab04389263064ca5c27093eb2e7c851ab62d50b6312d9800",
+  "riscv64gc-unknown-linux-gnu-0.11.5":
+    "6ae3ec3cf1aab72604bc6aa8486faf4b473066422c49d9c42ea8366ff3039de4",
+  "riscv64gc-unknown-linux-musl-0.11.5":
+    "d4686fb144563a40e791fc3f010a91e57fdce9cac7a03b8a14a972c25be4464c",
+  "s390x-unknown-linux-gnu-0.11.5":
+    "1309f1e462462dab2da6a55c37012a228d1c06a55c5b43f8ef901ba1599d9e12",
+  "x86_64-apple-darwin-0.11.5":
+    "b8964bed538143f9016d807e421e28f0237a29589851fc79e8159751ac64779a",
+  "x86_64-pc-windows-msvc-0.11.5":
+    "3fa5b6ea9de9256a035e0471f5ef0bb5d95344659723d6eb063e27c76431515d",
+  "x86_64-unknown-linux-gnu-0.11.5":
+    "0d87793f733f327849ebf9cf51b576cfb08328e22af73061405e4bec96ae84d1",
+  "x86_64-unknown-linux-musl-0.11.5":
+    "ee8a52743ce3979e52872b49c5e58ffa541048cb95132142bff23fe5608d73ea",
+  "aarch64-apple-darwin-0.11.4":
+    "9b9cb6c6f58c3246dbf3351ed4e97c500bc3266f5f237d2fd620b66e1c31dc56",
+  "aarch64-pc-windows-msvc-0.11.4":
+    "708b1c210109e50ff520bcd9b6d29cbd8cee584bb55e84d3d1941bf75ab0893d",
+  "aarch64-unknown-linux-gnu-0.11.4":
+    "f5aa91bba0b98d85a4e5262e2847f9ab2273c754f6374dff62b37ef18c65a2e7",
+  "aarch64-unknown-linux-musl-0.11.4":
+    "a02ec7667d7bb1d33cdb7e1de22f7e4242967e3df7e350bac6212515e3bce8ac",
+  "arm-unknown-linux-musleabihf-0.11.4":
+    "5bbc59d8c3d5fdade88fca47e4c18298e44a367e178e97e11466b22e992edae2",
+  "armv7-unknown-linux-gnueabihf-0.11.4":
+    "9d2299155b65988643a55777c638408a0df8e65f606933d1e44691ada72ff106",
+  "armv7-unknown-linux-musleabihf-0.11.4":
+    "43b1e02f8f4b27fd1d085fb14a246638bb607af32408cb13c5c3b3fb47db027f",
+  "i686-pc-windows-msvc-0.11.4":
+    "661588b3607e6d5bb78551f596772a0d04a930ce128189c90800d07f6fca1998",
+  "i686-unknown-linux-gnu-0.11.4":
+    "4248773a2574c3b697588655d7bf14f97baa744c3e156585230e5c711befa6ff",
+  "i686-unknown-linux-musl-0.11.4":
+    "0323c08c1e7455cdf65c89296eda28bad9051cb09d16ea3ce1d0bf718143449e",
+  "powerpc64le-unknown-linux-gnu-0.11.4":
+    "3ddb764538a5dcb4967d7375fde193ce5391e37ddd4d1242012d04cf3848479f",
+  "riscv64gc-unknown-linux-gnu-0.11.4":
+    "93db93607a824d677c47003ee828936913cfdeb2c871bb34cd79c3ec4481e2b1",
+  "riscv64gc-unknown-linux-musl-0.11.4":
+    "78f0d7f92244ce3d7a7a0df5fab2495450bcb18600b59acf1755e77cafed2300",
+  "s390x-unknown-linux-gnu-0.11.4":
+    "07361e1fb32e870841a27d3d7b0b20c4a81e0cc25eeb8b9115425bfd227d2d05",
+  "x86_64-apple-darwin-0.11.4":
+    "c326edaf3fd492f53d1c58777f3459c0d87bf9dae8d89e80aec4b0da6622dcf3",
+  "x86_64-pc-windows-msvc-0.11.4":
+    "26d84455a40b0272b2ab4785cad298ff2c89cd0765b482e9f85b5a1bd880a863",
+  "x86_64-unknown-linux-gnu-0.11.4":
+    "12f9a192bb32d70470aa22cbd2a193d1323a3f58f6ac5f9e3866aaca760c98c6",
+  "x86_64-unknown-linux-musl-0.11.4":
+    "36ce1c5d8997db9b6a24d0f41646d5509b6d1d8b9448c7325f8248a6ea5d4b00",
+  "aarch64-apple-darwin-0.11.3":
+    "2bc3d0c7bf2bd08325b1e170abac6f7e5b3346e1d4eab3370d17cefec934996f",
+  "aarch64-pc-windows-msvc-0.11.3":
+    "e99c56f9ab5e1e1ddcaea3e2389990c94baf38e0d7cb2148de08baf2d3261d49",
+  "aarch64-unknown-linux-gnu-0.11.3":
+    "711382e3158433f06b11d99afb440f4416359fc3c84558886d8ed8826a921bff",
+  "aarch64-unknown-linux-musl-0.11.3":
+    "8ecec82cb9a744d5fabff6d16d7777218a7730f699d2aa0d2f751c17858e2efa",
+  "arm-unknown-linux-musleabihf-0.11.3":
+    "3d021046a94ad11f12b9d83f36442a1a28e92e7149c3f79ba2951c96653dafac",
+  "armv7-unknown-linux-gnueabihf-0.11.3":
+    "13c9a0f5f624275ccd36db2896607f4fee3585f420734b16f6c66d70e32aa458",
+  "armv7-unknown-linux-musleabihf-0.11.3":
+    "260a88e2f00daab0363a745fde036a7881002d7a81094388f31925acb284110b",
+  "i686-pc-windows-msvc-0.11.3":
+    "036fa39fa5ea3cb86c127324924b913b5858e8d91c4cb413edacfc3123001696",
+  "i686-unknown-linux-gnu-0.11.3":
+    "b9410c8dae2fa0d4939af5b0ee7272d5591bd55890e8274dcf7f1aea84bfe043",
+  "i686-unknown-linux-musl-0.11.3":
+    "afe533fd409105e753d844490c65a4375e75bfb3812e49122684f996bed9e90a",
+  "powerpc64le-unknown-linux-gnu-0.11.3":
+    "5cdcadf4d50a5354312bc8ef37c2a6cfab4e2f13ccdf8380d3012b927b4ded95",
+  "riscv64gc-unknown-linux-gnu-0.11.3":
+    "8271e07ed9695870f4b0ae5ec722e3ae08fff280068f08bc6a8ca76c67d7fefa",
+  "riscv64gc-unknown-linux-musl-0.11.3":
+    "b750fc8393ced9939448849b05e94de6bf1e998bb7030c4ebe744b47b372bce9",
+  "s390x-unknown-linux-gnu-0.11.3":
+    "6dc4f555a5f6515f7fddb281422d2a8a3943853dae5de837bbb5d996d7576c71",
+  "x86_64-apple-darwin-0.11.3":
+    "b0e05e0b43a000fdc2132ee3f3400ba5dee427bc2337d3ec4eb8cf4f3d5722af",
+  "x86_64-pc-windows-msvc-0.11.3":
+    "ae681c0aaec7cc96af184648cb88d73f8393ed60fa5880abdd6bdb910f9b227c",
+  "x86_64-unknown-linux-gnu-0.11.3":
+    "c0f3236f146e55472663cfbcc9be3042a9f1092275bbe3fe2a56a6cbfd3da5ce",
+  "x86_64-unknown-linux-musl-0.11.3":
+    "8b40cf16b849634b81a530a3d0a0bcae5f24996ef9ae782976fd69b6266d3b8e",
  "aarch64-apple-darwin-0.11.2":
    "4beaa9550f93ef7f0fc02f7c28c9c48cd61fe30db00f5ac8947e0a425c3fb282",
  "aarch64-pc-windows-msvc-0.11.2":
@@ -2,8 +2,6 @@ import { promises as fs } from "node:fs";
 import * as path from "node:path";
 import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
-import * as pep440 from "@renovatebot/pep440";
-import * as semver from "semver";
 import {
  ASTRAL_MIRROR_PREFIX,
  GITHUB_RELEASES_PREFIX,
@@ -12,7 +10,9 @@ import {
 } from "../utils/constants";
 import type { Architecture, Platform } from "../utils/platforms";
 import { validateChecksum } from "./checksum/checksum";
-import { getAllVersions, getArtifact, getLatestVersion } from "./manifest";
+import { getArtifact } from "./manifest";
+
+export { resolveVersion } from "../version/resolve";

 export function tryGetFromToolCache(
  arch: Architecture,
@@ -172,102 +172,3 @@ function resolveChecksum(
 function getExtension(platform: Platform): string {
  return platform === "pc-windows-msvc" ? ".zip" : ".tar.gz";
 }
-
-export async function resolveVersion(
-  versionInput: string,
-  manifestUrl: string | undefined,
-  resolutionStrategy: "highest" | "lowest" = "highest",
-): Promise<string> {
-  core.debug(`Resolving version: ${versionInput}`);
-  const isSimpleMinimumVersionSpecifier =
-    versionInput.includes(">") && !versionInput.includes(",");
-  const resolveVersionSpecifierToLatest =
-    isSimpleMinimumVersionSpecifier && resolutionStrategy === "highest";
-
-  if (resolveVersionSpecifierToLatest) {
-    core.info("Found minimum version specifier, using latest version");
-  }
-
-  const version =
-    versionInput === "latest" || resolveVersionSpecifierToLatest
-      ? await getLatestVersion(manifestUrl)
-      : versionInput;
-
-  if (tc.isExplicitVersion(version)) {
-    core.debug(`Version ${version} is an explicit version.`);
-    if (
-      resolveVersionSpecifierToLatest &&
-      !pep440.satisfies(version, versionInput)
-    ) {
-      throw new Error(`No version found for ${versionInput}`);
-    }
-    return version;
-  }
-
-  const availableVersions = await getAvailableVersions(manifestUrl);
-  core.debug(`Available versions: ${availableVersions}`);
-  const resolvedVersion =
-    resolutionStrategy === "lowest"
-      ? minSatisfying(availableVersions, version)
-      : maxSatisfying(availableVersions, version);
-
-  if (resolvedVersion === undefined) {
-    throw new Error(`No version found for ${version}`);
-  }
-
-  return resolvedVersion;
-}
-
-async function getAvailableVersions(
-  manifestUrl: string | undefined,
-): Promise<string[]> {
-  if (manifestUrl !== undefined) {
-    core.info(
-      `Getting available versions from manifest-file ${manifestUrl} ...`,
-    );
-  } else {
-    core.info(`Getting available versions from ${VERSIONS_MANIFEST_URL} ...`);
-  }
-
-  return await getAllVersions(manifestUrl);
-}
-
-function maxSatisfying(
-  versions: string[],
-  version: string,
-): string | undefined {
-  const maxSemver = tc.evaluateVersions(versions, version);
-  if (maxSemver !== "") {
-    core.debug(`Found a version that satisfies the semver range: ${maxSemver}`);
-    return maxSemver;
-  }
-  const maxPep440 = pep440.maxSatisfying(versions, version);
-  if (maxPep440 !== null) {
-    core.debug(
-      `Found a version that satisfies the pep440 specifier: ${maxPep440}`,
-    );
-    return maxPep440;
-  }
-  return undefined;
-}
-
-function minSatisfying(
-  versions: string[],
-  version: string,
-): string | undefined {
-  // For semver, we need to use a different approach since tc.evaluateVersions only returns max
-  // Let's use semver directly for min satisfying
-  const minSemver = semver.minSatisfying(versions, version);
-  if (minSemver !== null) {
-    core.debug(`Found a version that satisfies the semver range: ${minSemver}`);
-    return minSemver;
-  }
-  const minPep440 = pep440.minSatisfying(versions, version);
-  if (minPep440 !== null) {
-    core.debug(
-      `Found a version that satisfies the pep440 specifier: ${minPep440}`,
-    );
-    return minPep440;
-  }
-  return undefined;
-}
@@ -111,6 +111,9 @@ export async function getLatestVersion(
 export async function getAllVersions(
  manifestUrl: string = VERSIONS_MANIFEST_URL,
 ): Promise<string[]> {
+  core.info(
+    `Getting available versions from ${manifestSource(manifestUrl)} ...`,
+  );
  const versions = await fetchManifest(manifestUrl);
  return versions.map((versionData) => versionData.version);
 }
@@ -165,6 +168,14 @@ export function clearManifestCache(manifestUrl?: string): void {
  cachedManifestData.delete(manifestUrl);
 }

+function manifestSource(manifestUrl: string): string {
+  if (manifestUrl === VERSIONS_MANIFEST_URL) {
+    return VERSIONS_MANIFEST_URL;
+  }
+
+  return `manifest-file ${manifestUrl}`;
+}
+
 function isManifestVersion(value: unknown): value is ManifestVersion {
  if (!isRecord(value)) {
    return false;
@@ -5,7 +5,6 @@ import * as exec from "@actions/exec";
 import { restoreCache } from "./cache/restore-cache";
 import {
  downloadVersion,
-  resolveVersion,
  tryGetFromToolCache,
 } from "./download/download-version";
 import { STATE_UV_PATH, STATE_UV_VERSION } from "./utils/constants";
@@ -16,7 +15,7 @@ import {
  getPlatform,
  type Platform,
 } from "./utils/platforms";
-import { getUvVersionFromFile } from "./version/resolve";
+import { resolveUvVersion } from "./version/resolve";

 const sourceDir = __dirname;

@@ -112,7 +111,13 @@ async function setupUv(
  platform: Platform,
  arch: Architecture,
 ): Promise<{ uvDir: string; version: string }> {
-  const resolvedVersion = await determineVersion(inputs);
+  const resolvedVersion = await resolveUvVersion({
+    manifestFile: inputs.manifestFile,
+    resolutionStrategy: inputs.resolutionStrategy,
+    version: inputs.version,
+    versionFile: inputs.versionFile,
+    workingDirectory: inputs.workingDirectory,
+  });
  const toolCacheResult = tryGetFromToolCache(arch, resolvedVersion);
  if (toolCacheResult.installedPath) {
    core.info(`Found uv in tool-cache for ${toolCacheResult.version}`);
@@ -137,45 +142,6 @@ async function setupUv(
  };
 }

-async function determineVersion(inputs: SetupInputs): Promise<string> {
-  return await resolveVersion(
-    getRequestedVersion(inputs),
-    inputs.manifestFile,
-    inputs.resolutionStrategy,
-  );
-}
-
-function getRequestedVersion(inputs: SetupInputs): string {
-  if (inputs.version !== "") {
-    return inputs.version;
-  }
-
-  if (inputs.versionFile !== "") {
-    const versionFromFile = getUvVersionFromFile(inputs.versionFile);
-    if (versionFromFile === undefined) {
-      throw new Error(
-        `Could not determine uv version from file: ${inputs.versionFile}`,
-      );
-    }
-    return versionFromFile;
-  }
-
-  const versionFromUvToml = getUvVersionFromFile(
-    `${inputs.workingDirectory}${path.sep}uv.toml`,
-  );
-  const versionFromPyproject = getUvVersionFromFile(
-    `${inputs.workingDirectory}${path.sep}pyproject.toml`,
-  );
-
-  if (versionFromUvToml === undefined && versionFromPyproject === undefined) {
-    core.info(
-      "Could not determine uv version from uv.toml or pyproject.toml. Falling back to latest.",
-    );
-  }
-
-  return versionFromUvToml || versionFromPyproject || "latest";
-}
-
 function addUvToPathAndOutput(cachedPath: string): void {
  core.setOutput("uv-path", `${cachedPath}${path.sep}uv`);
  core.saveState(STATE_UV_PATH, `${cachedPath}${path.sep}uv`);
@@ -252,13 +218,17 @@ async function activateEnvironment(inputs: SetupInputs): Promise<void> {
    }

    core.info(`Creating and activating python venv at ${inputs.venvPath}...`);
-    await exec.exec("uv", [
+    const venvArgs = [
      "venv",
      inputs.venvPath,
      "--directory",
      inputs.workingDirectory,
      "--clear",
-    ]);
+    ];
+    if (inputs.noProject) {
+      venvArgs.push("--no-project");
+    }
+    await exec.exec("uv", venvArgs);

    let venvBinPath = `${inputs.venvPath}${path.sep}bin`;
    if (process.platform === "win32") {
@@ -8,7 +8,19 @@ export function getConfigValueFromTomlFile(
  if (!fs.existsSync(filePath) || !filePath.endsWith(".toml")) {
    return undefined;
  }
+
  const fileContent = fs.readFileSync(filePath, "utf-8");
+  return getConfigValueFromTomlContent(filePath, fileContent, key);
+}
+
+export function getConfigValueFromTomlContent(
+  filePath: string,
+  fileContent: string,
+  key: string,
+): string | undefined {
+  if (!filePath.endsWith(".toml")) {
+    return undefined;
+  }

  if (filePath.endsWith("pyproject.toml")) {
    const tomlContent = toml.parse(fileContent) as {
@@ -16,6 +28,7 @@ export function getConfigValueFromTomlFile(
    };
    return tomlContent?.tool?.uv?.[key];
  }
+
  const tomlContent = toml.parse(fileContent) as Record<
    string,
    string | undefined
@@ -22,6 +22,7 @@ export interface SetupInputs {
  versionFile: string;
  pythonVersion: string;
  activateEnvironment: boolean;
+  noProject: boolean;
  venvPath: string;
  checksum: string;
  enableCache: boolean;
@@ -49,6 +50,7 @@ export function loadInputs(): SetupInputs {
  const versionFile = getVersionFile(workingDirectory);
  const pythonVersion = core.getInput("python-version");
  const activateEnvironment = core.getBooleanInput("activate-environment");
+  const noProject = core.getBooleanInput("no-project");
  const venvPath = getVenvPath(workingDirectory, activateEnvironment);
  const checksum = core.getInput("checksum");
  const enableCache = getEnableCache();
@@ -87,6 +89,7 @@ export function loadInputs(): SetupInputs {
    ignoreEmptyWorkdir,
    ignoreNothingToCache,
    manifestFile,
+    noProject,
    pruneCache,
    pythonDir,
    pythonVersion,
@@ -0,0 +1,103 @@
+import fs from "node:fs";
+import * as core from "@actions/core";
+import { getConfigValueFromTomlContent } from "../utils/config-file";
+import {
+  getUvVersionFromParsedPyproject,
+  getUvVersionFromRequirementsText,
+  parsePyprojectContent,
+} from "./requirements-file";
+import { normalizeVersionSpecifier } from "./specifier";
+import { getUvVersionFromToolVersions } from "./tool-versions-file";
+import type { ParsedVersionFile, VersionFileFormat } from "./types";
+
+interface VersionFileParser {
+  format: VersionFileFormat;
+  parse(filePath: string): string | undefined;
+  supports(filePath: string): boolean;
+}
+
+const VERSION_FILE_PARSERS: VersionFileParser[] = [
+  {
+    format: ".tool-versions",
+    parse: (filePath) => getUvVersionFromToolVersions(filePath),
+    supports: (filePath) => filePath.endsWith(".tool-versions"),
+  },
+  {
+    format: "uv.toml",
+    parse: (filePath) => {
+      const fileContent = fs.readFileSync(filePath, "utf-8");
+      return getConfigValueFromTomlContent(
+        filePath,
+        fileContent,
+        "required-version",
+      );
+    },
+    supports: (filePath) => filePath.endsWith("uv.toml"),
+  },
+  {
+    format: "pyproject.toml",
+    parse: (filePath) => {
+      const fileContent = fs.readFileSync(filePath, "utf-8");
+      const pyproject = parsePyprojectContent(fileContent);
+      const requiredVersion = pyproject.tool?.uv?.["required-version"];
+
+      if (requiredVersion !== undefined) {
+        return requiredVersion;
+      }
+
+      return getUvVersionFromParsedPyproject(pyproject);
+    },
+    supports: (filePath) => filePath.endsWith("pyproject.toml"),
+  },
+  {
+    format: "requirements",
+    parse: (filePath) => {
+      const fileContent = fs.readFileSync(filePath, "utf-8");
+      return getUvVersionFromRequirementsText(fileContent);
+    },
+    supports: (filePath) => filePath.endsWith(".txt"),
+  },
+];
+
+export function getParsedVersionFile(
+  filePath: string,
+): ParsedVersionFile | undefined {
+  core.info(`Trying to find version for uv in: ${filePath}`);
+
+  if (!fs.existsSync(filePath)) {
+    core.info(`Could not find file: ${filePath}`);
+    return undefined;
+  }
+
+  const parser = getVersionFileParser(filePath);
+  if (parser === undefined) {
+    return undefined;
+  }
+
+  try {
+    const specifier = parser.parse(filePath);
+    if (specifier === undefined) {
+      return undefined;
+    }
+
+    const normalizedSpecifier = normalizeVersionSpecifier(specifier);
+    core.info(`Found version for uv in ${filePath}: ${normalizedSpecifier}`);
+    return {
+      format: parser.format,
+      specifier: normalizedSpecifier,
+    };
+  } catch (error) {
+    core.warning(
+      `Error while parsing ${filePath}: ${(error as Error).message}`,
+    );
+    return undefined;
+  }
+}
+
+export function getUvVersionFromFile(filePath: string): string | undefined {
+  return getParsedVersionFile(filePath)?.specifier;
+}
+
+function getVersionFileParser(filePath: string): VersionFileParser | undefined {
+  return VERSION_FILE_PARSERS.find((parser) => parser.supports(filePath));
+}
@@ -5,31 +5,23 @@ export function getUvVersionFromRequirementsFile(
  filePath: string,
 ): string | undefined {
  const fileContent = fs.readFileSync(filePath, "utf-8");
+
  if (filePath.endsWith(".txt")) {
-    return getUvVersionFromAllDependencies(fileContent.split("\n"));
+    return getUvVersionFromRequirementsText(fileContent);
  }
-  const dependencies = parsePyprojectDependencies(fileContent);
-  return getUvVersionFromAllDependencies(dependencies);
+
+  return getUvVersionFromPyprojectContent(fileContent);
 }
-function getUvVersionFromAllDependencies(
-  allDependencies: string[],
+
+export function getUvVersionFromRequirementsText(
+  fileContent: string,
 ): string | undefined {
-  return allDependencies
-    .find((dep: string) => dep.match(/^uv[=<>~!]/))
-    ?.match(/^uv([=<>~!]+\S*)/)?.[1]
-    .trim();
+  return getUvVersionFromAllDependencies(fileContent.split("\n"));
 }

-interface Pyproject {
-  project?: {
-    dependencies?: string[];
-    "optional-dependencies"?: Record<string, string[]>;
-  };
-  "dependency-groups"?: Record<string, Array<string | object>>;
-}
-
-function parsePyprojectDependencies(pyprojectContent: string): string[] {
-  const pyproject: Pyproject = toml.parse(pyprojectContent);
+export function getUvVersionFromParsedPyproject(
+  pyproject: Pyproject,
+): string | undefined {
  const dependencies: string[] = pyproject?.project?.dependencies || [];
  const optionalDependencies: string[] = Object.values(
    pyproject?.project?.["optional-dependencies"] || {},
@@ -39,5 +31,39 @@ function parsePyprojectDependencies(pyprojectContent: string): string[] {
  )
    .flat()
    .filter((item: string | object) => typeof item === "string");
-  return dependencies.concat(optionalDependencies, devDependencies);
+
+  return getUvVersionFromAllDependencies(
+    dependencies.concat(optionalDependencies, devDependencies),
+  );
+}
+
+export function getUvVersionFromPyprojectContent(
+  pyprojectContent: string,
+): string | undefined {
+  const pyproject = parsePyprojectContent(pyprojectContent);
+  return getUvVersionFromParsedPyproject(pyproject);
+}
+
+export interface Pyproject {
+  project?: {
+    dependencies?: string[];
+    "optional-dependencies"?: Record<string, string[]>;
+  };
+  "dependency-groups"?: Record<string, Array<string | object>>;
+  tool?: {
+    uv?: Record<string, string | undefined>;
+  };
+}
+
+export function parsePyprojectContent(pyprojectContent: string): Pyproject {
+  return toml.parse(pyprojectContent) as Pyproject;
+}
+
+function getUvVersionFromAllDependencies(
+  allDependencies: string[],
+): string | undefined {
+  return allDependencies
+    .find((dep: string) => dep.match(/^uv[=<>~!]/))
+    ?.match(/^uv([=<>~!]+\S*)/)?.[1]
+    .trim();
 }
@@ -1,34 +1,183 @@
-import fs from "node:fs";
 import * as core from "@actions/core";
-import { getConfigValueFromTomlFile } from "../utils/config-file";
-import { getUvVersionFromRequirementsFile } from "./requirements-file";
-import { getUvVersionFromToolVersions } from "./tool-versions-file";
+import * as tc from "@actions/tool-cache";
+import * as pep440 from "@renovatebot/pep440";
+import * as semver from "semver";
+import { getAllVersions, getLatestVersion } from "../download/manifest";
+import type { ResolutionStrategy } from "../utils/inputs";
+import {
+  type ParsedVersionSpecifier,
+  parseVersionSpecifier,
+} from "./specifier";
+import type { ResolveUvVersionOptions } from "./types";
+import { resolveVersionRequest } from "./version-request-resolver";

-export function getUvVersionFromFile(filePath: string): string | undefined {
-  core.info(`Trying to find version for uv in: ${filePath}`);
-  if (!fs.existsSync(filePath)) {
-    core.info(`Could not find file: ${filePath}`);
-    return undefined;
-  }
-  let uvVersion: string | undefined;
-  try {
-    uvVersion = getUvVersionFromToolVersions(filePath);
-    if (uvVersion === undefined) {
-      uvVersion = getConfigValueFromTomlFile(filePath, "required-version");
-    }
-    if (uvVersion === undefined) {
-      uvVersion = getUvVersionFromRequirementsFile(filePath);
-    }
-  } catch (err) {
-    const message = (err as Error).message;
-    core.warning(`Error while parsing ${filePath}: ${message}`);
-    return undefined;
-  }
-  if (uvVersion?.startsWith("==")) {
-    uvVersion = uvVersion.slice(2);
-  }
-  if (uvVersion !== undefined) {
-    core.info(`Found version for uv in ${filePath}: ${uvVersion}`);
-  }
-  return uvVersion;
+interface ConcreteVersionResolutionContext {
+  manifestUrl?: string;
+  parsedSpecifier: ParsedVersionSpecifier;
+  resolutionStrategy: ResolutionStrategy;
+}
+
+interface ConcreteVersionResolver {
+  resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined>;
+}
+
+class ExactVersionResolver implements ConcreteVersionResolver {
+  async resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined> {
+    if (context.parsedSpecifier.kind !== "exact") {
+      return undefined;
+    }
+
+    core.debug(
+      `Version ${context.parsedSpecifier.normalized} is an explicit version.`,
+    );
+    return context.parsedSpecifier.normalized;
+  }
+}
+
+class LatestVersionResolver implements ConcreteVersionResolver {
+  async resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined> {
+    const shouldUseLatestVersion =
+      context.parsedSpecifier.kind === "latest" ||
+      (context.parsedSpecifier.kind === "range" &&
+        context.parsedSpecifier.isSimpleMinimumVersionSpecifier &&
+        context.resolutionStrategy === "highest");
+
+    if (!shouldUseLatestVersion) {
+      return undefined;
+    }
+
+    if (
+      context.parsedSpecifier.kind === "range" &&
+      context.parsedSpecifier.isSimpleMinimumVersionSpecifier
+    ) {
+      core.info("Found minimum version specifier, using latest version");
+    }
+
+    const latestVersion = await getLatestVersion(context.manifestUrl);
+
+    if (
+      context.parsedSpecifier.kind === "range" &&
+      context.parsedSpecifier.isSimpleMinimumVersionSpecifier &&
+      !pep440.satisfies(latestVersion, context.parsedSpecifier.raw)
+    ) {
+      throw new Error(`No version found for ${context.parsedSpecifier.raw}`);
+    }
+
+    return latestVersion;
+  }
+}
+
+class RangeVersionResolver implements ConcreteVersionResolver {
+  async resolve(
+    context: ConcreteVersionResolutionContext,
+  ): Promise<string | undefined> {
+    if (context.parsedSpecifier.kind !== "range") {
+      return undefined;
+    }
+
+    const availableVersions = await getAllVersions(context.manifestUrl);
+    core.debug(`Available versions: ${availableVersions}`);
+
+    const resolvedVersion =
+      context.resolutionStrategy === "lowest"
+        ? minSatisfying(availableVersions, context.parsedSpecifier.normalized)
+        : maxSatisfying(availableVersions, context.parsedSpecifier.normalized);
+
+    if (resolvedVersion === undefined) {
+      throw new Error(`No version found for ${context.parsedSpecifier.raw}`);
+    }
+
+    return resolvedVersion;
+  }
+}
+
+const CONCRETE_VERSION_RESOLVERS: ConcreteVersionResolver[] = [
+  new ExactVersionResolver(),
+  new LatestVersionResolver(),
+  new RangeVersionResolver(),
+];
+
+export async function resolveUvVersion(
+  options: ResolveUvVersionOptions,
+): Promise<string> {
+  const request = resolveVersionRequest(options);
+  const resolutionStrategy = options.resolutionStrategy ?? "highest";
+  const version = await resolveVersion(
+    request.specifier,
+    options.manifestFile,
+    resolutionStrategy,
+  );
+
+  return version;
+}
+
+export async function resolveVersion(
+  versionInput: string,
+  manifestUrl: string | undefined,
+  resolutionStrategy: ResolutionStrategy = "highest",
+): Promise<string> {
+  core.debug(`Resolving version: ${versionInput}`);
+
+  const context: ConcreteVersionResolutionContext = {
+    manifestUrl,
+    parsedSpecifier: parseVersionSpecifier(versionInput),
+    resolutionStrategy,
+  };
+
+  for (const resolver of CONCRETE_VERSION_RESOLVERS) {
+    const version = await resolver.resolve(context);
+    if (version !== undefined) {
+      return version;
+    }
+  }
+
+  throw new Error(`No version found for ${versionInput}`);
+}
+
+function maxSatisfying(
+  versions: string[],
+  version: string,
+): string | undefined {
+  const maxSemver = tc.evaluateVersions(versions, version);
+  if (maxSemver !== "") {
+    core.debug(`Found a version that satisfies the semver range: ${maxSemver}`);
+    return maxSemver;
+  }
+
+  const maxPep440 = pep440.maxSatisfying(versions, version);
+  if (maxPep440 !== null) {
+    core.debug(
+      `Found a version that satisfies the pep440 specifier: ${maxPep440}`,
+    );
+    return maxPep440;
+  }
+
+  return undefined;
+}
+
+function minSatisfying(
+  versions: string[],
+  version: string,
+): string | undefined {
+  const minSemver = semver.minSatisfying(versions, version);
+  if (minSemver !== null) {
+    core.debug(`Found a version that satisfies the semver range: ${minSemver}`);
+    return minSemver;
+  }
+
+  const minPep440 = pep440.minSatisfying(versions, version);
+  if (minPep440 !== null) {
+    core.debug(
+      `Found a version that satisfies the pep440 specifier: ${minPep440}`,
+    );
+    return minPep440;
+  }
+
+  return undefined;
 }
@@ -0,0 +1,59 @@
+import * as tc from "@actions/tool-cache";
+
+export type ParsedVersionSpecifier =
+  | {
+      kind: "exact";
+      normalized: string;
+      raw: string;
+    }
+  | {
+      kind: "latest";
+      normalized: "latest";
+      raw: string;
+    }
+  | {
+      isSimpleMinimumVersionSpecifier: boolean;
+      kind: "range";
+      normalized: string;
+      raw: string;
+    };
+
+export function normalizeVersionSpecifier(specifier: string): string {
+  const trimmedSpecifier = specifier.trim();
+
+  if (trimmedSpecifier.startsWith("==")) {
+    return trimmedSpecifier.slice(2);
+  }
+
+  return trimmedSpecifier;
+}
+
+export function parseVersionSpecifier(
+  specifier: string,
+): ParsedVersionSpecifier {
+  const raw = specifier.trim();
+  const normalized = normalizeVersionSpecifier(raw);
+
+  if (normalized === "latest") {
+    return {
+      kind: "latest",
+      normalized: "latest",
+      raw,
+    };
+  }
+
+  if (tc.isExplicitVersion(normalized)) {
+    return {
+      kind: "exact",
+      normalized,
+      raw,
+    };
+  }
+
+  return {
+    isSimpleMinimumVersionSpecifier: raw.includes(">") && !raw.includes(","),
+    kind: "range",
+    normalized,
+    raw,
+  };
+}
@@ -0,0 +1,34 @@
+import type { ResolutionStrategy } from "../utils/inputs";
+
+export type VersionSource =
+  | "input"
+  | "version-file"
+  | "uv.toml"
+  | "pyproject.toml"
+  | "default";
+
+export type VersionFileFormat =
+  | ".tool-versions"
+  | "pyproject.toml"
+  | "requirements"
+  | "uv.toml";
+
+export interface ParsedVersionFile {
+  format: VersionFileFormat;
+  specifier: string;
+}
+
+export interface ResolveUvVersionOptions {
+  manifestFile?: string;
+  resolutionStrategy?: ResolutionStrategy;
+  version?: string;
+  versionFile?: string;
+  workingDirectory: string;
+}
+
+export interface VersionRequest {
+  format?: VersionFileFormat;
+  source: VersionSource;
+  sourcePath?: string;
+  specifier: string;
+}
@@ -0,0 +1,158 @@
+import * as path from "node:path";
+import * as core from "@actions/core";
+import { getParsedVersionFile } from "./file-parser";
+import { normalizeVersionSpecifier } from "./specifier";
+import type {
+  ParsedVersionFile,
+  ResolveUvVersionOptions,
+  VersionRequest,
+} from "./types";
+
+export interface VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined;
+}
+
+export class VersionRequestContext {
+  readonly version: string | undefined;
+  readonly versionFile: string | undefined;
+  readonly workingDirectory: string;
+
+  private readonly parsedFiles = new Map<
+    string,
+    ParsedVersionFile | undefined
+  >();
+
+  constructor(
+    version: string | undefined,
+    versionFile: string | undefined,
+    workingDirectory: string,
+  ) {
+    this.version = version;
+    this.versionFile = versionFile;
+    this.workingDirectory = workingDirectory;
+  }
+
+  getVersionFile(filePath: string): ParsedVersionFile | undefined {
+    const cachedResult = this.parsedFiles.get(filePath);
+    if (cachedResult !== undefined || this.parsedFiles.has(filePath)) {
+      return cachedResult;
+    }
+
+    const result = getParsedVersionFile(filePath);
+    this.parsedFiles.set(filePath, result);
+    return result;
+  }
+
+  getWorkspaceCandidates(): Array<{
+    source: "pyproject.toml" | "uv.toml";
+    sourcePath: string;
+  }> {
+    return [
+      {
+        source: "uv.toml",
+        sourcePath: path.join(this.workingDirectory, "uv.toml"),
+      },
+      {
+        source: "pyproject.toml",
+        sourcePath: path.join(this.workingDirectory, "pyproject.toml"),
+      },
+    ];
+  }
+}
+
+export class ExplicitInputVersionResolver implements VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined {
+    if (context.version === undefined) {
+      return undefined;
+    }
+
+    return {
+      source: "input",
+      specifier: normalizeVersionSpecifier(context.version),
+    };
+  }
+}
+
+export class VersionFileVersionResolver implements VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined {
+    if (context.versionFile === undefined) {
+      return undefined;
+    }
+
+    const versionFile = context.getVersionFile(context.versionFile);
+    if (versionFile === undefined) {
+      throw new Error(
+        `Could not determine uv version from file: ${context.versionFile}`,
+      );
+    }
+
+    return {
+      format: versionFile.format,
+      source: "version-file",
+      sourcePath: context.versionFile,
+      specifier: versionFile.specifier,
+    };
+  }
+}
+
+export class WorkspaceVersionResolver implements VersionRequestResolver {
+  resolve(context: VersionRequestContext): VersionRequest | undefined {
+    for (const candidate of context.getWorkspaceCandidates()) {
+      const versionFile = context.getVersionFile(candidate.sourcePath);
+      if (versionFile === undefined) {
+        continue;
+      }
+
+      return {
+        format: versionFile.format,
+        source: candidate.source,
+        sourcePath: candidate.sourcePath,
+        specifier: versionFile.specifier,
+      };
+    }
+
+    core.info(
+      "Could not determine uv version from uv.toml or pyproject.toml. Falling back to latest.",
+    );
+    return undefined;
+  }
+}
+
+export class LatestVersionResolver implements VersionRequestResolver {
+  resolve(): VersionRequest {
+    return {
+      source: "default",
+      specifier: "latest",
+    };
+  }
+}
+
+const VERSION_REQUEST_RESOLVERS: VersionRequestResolver[] = [
+  new ExplicitInputVersionResolver(),
+  new VersionFileVersionResolver(),
+  new WorkspaceVersionResolver(),
+  new LatestVersionResolver(),
+];
+
+export function resolveVersionRequest(
+  options: ResolveUvVersionOptions,
+): VersionRequest {
+  const context = new VersionRequestContext(
+    emptyToUndefined(options.version),
+    emptyToUndefined(options.versionFile),
+    options.workingDirectory,
+  );
+
+  for (const resolver of VERSION_REQUEST_RESOLVERS) {
+    const request = resolver.resolve(context);
+    if (request !== undefined) {
+      return request;
+    }
+  }
+
+  throw new Error("Could not resolve a requested uv version.");
+}
+
+function emptyToUndefined(value: string | undefined): string | undefined {
+  return value === undefined || value === "" ? undefined : value;
+}