Stop fetching version information from github APIs

.github/copilot-instructions.md

@@ -23,7 +23,7 @@ and configures the environment for subsequent workflow steps.
 **Size**: Small-medium repository (~50 source files, ~400 total files including dependencies)
 **Languages**: TypeScript (primary), JavaScript (compiled output), JSON (configuration)
 **Runtime**: Node.js 24 (GitHub Actions runtime)
-**Key Dependencies**: @actions/core, @actions/cache, @actions/tool-cache
+**Key Dependencies**: @actions/core, @actions/cache, @actions/tool-cache, @octokit/core
 
 ### Core Architecture
 

.github/workflows/update-known-versions.yml

@@ -27,6 +27,7 @@ jobs:
           node dist/update-known-versions/index.js
           src/download/checksum/known-checksums.ts
           version-manifest.json
+          ${{ secrets.GITHUB_TOKEN }}
       - name: Check for changes
         id: changes-exist
         run: |

__tests__/download/versions-client.test.ts

@@ -1,142 +0,0 @@
-import { beforeEach, describe, expect, it, jest } from "@jest/globals";
-
-// biome-ignore lint/suspicious/noExplicitAny: mock needs flexible typing
-const mockFetch = jest.fn<any>();
-jest.mock("../../src/utils/fetch", () => ({
-  fetch: mockFetch,
-}));
-
-import {
-  clearCache,
-  fetchVersionData,
-  getAllVersions,
-  getArtifact,
-  getLatestVersion,
-} from "../../src/download/versions-client";
-
-const sampleNdjsonResponse = `{"version":"0.9.26","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f"},{"platform":"x86_64-pc-windows-msvc","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip","archive_format":"zip","sha256":"eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036"}]}
-{"version":"0.9.25","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.25/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"606b3c6949d971709f2526fa0d9f0fd23ccf60e09f117999b406b424af18a6a6"}]}`;
-
-function createMockResponse(
-  ok: boolean,
-  status: number,
-  statusText: string,
-  data: string,
-) {
-  return {
-    ok,
-    status,
-    statusText,
-    text: async () => data,
-  };
-}
-
-describe("versions-client", () => {
-  beforeEach(() => {
-    clearCache();
-    mockFetch.mockReset();
-  });
-
-  describe("fetchVersionData", () => {
-    it("should fetch and parse NDJSON data", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
-      );
-
-      const versions = await fetchVersionData();
-
-      expect(versions).toHaveLength(2);
-      expect(versions[0].version).toBe("0.9.26");
-      expect(versions[1].version).toBe("0.9.25");
-    });
-
-    it("should throw error on failed fetch", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(false, 500, "Internal Server Error", ""),
-      );
-
-      await expect(fetchVersionData()).rejects.toThrow(
-        "Failed to fetch version data: 500 Internal Server Error",
-      );
-    });
-
-    it("should cache results", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
-      );
-
-      await fetchVersionData();
-      await fetchVersionData();
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  describe("getLatestVersion", () => {
-    it("should return the first version (newest)", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
-      );
-
-      const latest = await getLatestVersion();
-
-      expect(latest).toBe("0.9.26");
-    });
-  });
-
-  describe("getAllVersions", () => {
-    it("should return all version strings", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
-      );
-
-      const versions = await getAllVersions();
-
-      expect(versions).toEqual(["0.9.26", "0.9.25"]);
-    });
-  });
-
-  describe("getArtifact", () => {
-    beforeEach(() => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
-      );
-    });
-
-    it("should find artifact by version and platform", async () => {
-      const artifact = await getArtifact("0.9.26", "aarch64", "apple-darwin");
-
-      expect(artifact).toEqual({
-        sha256:
-          "fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f",
-        url: "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz",
-      });
-    });
-
-    it("should find Windows artifact", async () => {
-      const artifact = await getArtifact("0.9.26", "x86_64", "pc-windows-msvc");
-
-      expect(artifact).toEqual({
-        sha256:
-          "eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036",
-        url: "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip",
-      });
-    });
-
-    it("should return undefined for unknown version", async () => {
-      const artifact = await getArtifact("0.0.1", "aarch64", "apple-darwin");
-
-      expect(artifact).toBeUndefined();
-    });
-
-    it("should return undefined for unknown platform", async () => {
-      const artifact = await getArtifact(
-        "0.9.26",
-        "aarch64",
-        "unknown-linux-musl",
-      );
-
-      expect(artifact).toBeUndefined();
-    });
-  });
-});

package-lock.json

@@ -15,6 +15,9 @@
         "@actions/glob": "^0.5.0",
         "@actions/io": "^1.1.3",
         "@actions/tool-cache": "^2.0.2",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
         "@renovatebot/pep440": "^4.2.1",
         "smol-toml": "^1.4.2",
         "undici": "5.28.5"
@@ -409,6 +412,7 @@
       "integrity": "sha512-UlLAnTPrFdNGoFtbSXwcGFQBtQZJCNjaN6hQNP3UPvuNXT1i82N26KL3dZeIpNalWywr9IuQuncaAfUaS1g6sQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@ampproject/remapping": "^2.2.0",
         "@babel/code-frame": "^7.27.1",
@@ -1586,6 +1590,134 @@
         "@tybys/wasm-util": "^0.10.0"
       }
     },
+    "node_modules/@octokit/auth-token": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
+      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "10.0.7",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
+      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/endpoint": "^11.0.2",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^27.0.0"
+      }
+    },
     "node_modules/@opentelemetry/api": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.4.1.tgz",
@@ -2322,6 +2454,12 @@
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz",
       "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
     },
+    "node_modules/before-after-hook": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
+      "license": "Apache-2.0"
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
@@ -2364,6 +2502,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "caniuse-lite": "^1.0.30001733",
         "electron-to-chromium": "^1.5.199",
@@ -2931,6 +3070,22 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -3475,6 +3630,7 @@
       "integrity": "sha512-F26gjC0yWN8uAA5m5Ss8ZQf5nDHWGlN/xWZIh8S5SRbsEKBovwZhxGd6LJlbZYxBgCYOtreSUyb8hpXyGC5O4A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/core": "30.2.0",
         "@jest/types": "30.2.0",
@@ -5173,6 +5329,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -5213,6 +5370,12 @@
       "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
       "license": "MIT"
     },
+    "node_modules/universal-user-agent": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
+      "license": "ISC"
+    },
     "node_modules/unrs-resolver": {
       "version": "1.11.1",
       "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.11.1.tgz",
@@ -5909,6 +6072,7 @@
       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.28.0.tgz",
       "integrity": "sha512-UlLAnTPrFdNGoFtbSXwcGFQBtQZJCNjaN6hQNP3UPvuNXT1i82N26KL3dZeIpNalWywr9IuQuncaAfUaS1g6sQ==",
       "dev": true,
+      "peer": true,
       "requires": {
         "@ampproject/remapping": "^2.2.0",
         "@babel/code-frame": "^7.27.1",
@@ -6723,6 +6887,94 @@
         "@tybys/wasm-util": "^0.10.0"
       }
     },
+    "@octokit/auth-token": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w=="
+    },
+    "@octokit/core": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
+      "peer": true,
+      "requires": {
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
+      }
+    },
+    "@octokit/endpoint": {
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
+      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
+      "requires": {
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
+      }
+    },
+    "@octokit/graphql": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
+      "requires": {
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
+      }
+    },
+    "@octokit/openapi-types": {
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="
+    },
+    "@octokit/plugin-paginate-rest": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
+      "requires": {
+        "@octokit/types": "^16.0.0"
+      }
+    },
+    "@octokit/plugin-rest-endpoint-methods": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
+      "requires": {
+        "@octokit/types": "^16.0.0"
+      }
+    },
+    "@octokit/request": {
+      "version": "10.0.7",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
+      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
+      "requires": {
+        "@octokit/endpoint": "^11.0.2",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "universal-user-agent": "^7.0.2"
+      }
+    },
+    "@octokit/request-error": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+      "requires": {
+        "@octokit/types": "^16.0.0"
+      }
+    },
+    "@octokit/types": {
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
+      "requires": {
+        "@octokit/openapi-types": "^27.0.0"
+      }
+    },
     "@opentelemetry/api": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.4.1.tgz",
@@ -7223,6 +7475,11 @@
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz",
       "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
     },
+    "before-after-hook": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="
+    },
     "brace-expansion": {
       "version": "1.1.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
@@ -7246,6 +7503,7 @@
       "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.25.2.tgz",
       "integrity": "sha512-0si2SJK3ooGzIawRu61ZdPCO1IncZwS8IzuX73sPZsXW6EQ/w/DAfPyKI8l1ETTCr2MnvqWitmlCUxgdul45jA==",
       "dev": true,
+      "peer": true,
       "requires": {
         "caniuse-lite": "^1.0.30001733",
         "electron-to-chromium": "^1.5.199",
@@ -7623,6 +7881,11 @@
         "jest-util": "30.2.0"
       }
     },
+    "fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg=="
+    },
     "fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -7987,6 +8250,7 @@
       "resolved": "https://registry.npmjs.org/jest/-/jest-30.2.0.tgz",
       "integrity": "sha512-F26gjC0yWN8uAA5m5Ss8ZQf5nDHWGlN/xWZIh8S5SRbsEKBovwZhxGd6LJlbZYxBgCYOtreSUyb8hpXyGC5O4A==",
       "dev": true,
+      "peer": true,
       "requires": {
         "@jest/core": "30.2.0",
         "@jest/types": "30.2.0",
@@ -9134,7 +9398,8 @@
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true
+      "dev": true,
+      "peer": true
     },
     "uglify-js": {
       "version": "3.19.3",
@@ -9156,6 +9421,11 @@
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
       "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="
     },
+    "universal-user-agent": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A=="
+    },
     "unrs-resolver": {
       "version": "1.11.1",
       "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.11.1.tgz",

package.json

@@ -10,7 +10,7 @@
     "package": "ncc build -o dist/setup src/setup-uv.ts && ncc build -o dist/save-cache src/save-cache.ts && ncc build -o dist/update-known-versions src/update-known-versions.ts",
     "test": "jest",
     "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
-    "update-known-versions": "RUNNER_TEMP=known_versions node dist/update-known-versions/index.js src/download/checksum/known-checksums.ts version-manifest.json",
+    "update-known-versions": "RUNNER_TEMP=known_versions node dist/update-known-versions/index.js src/download/checksum/known-versions.ts \"$(gh auth token)\"",
     "all": "npm run build && npm run check && npm run package && npm test"
   },
   "repository": {
@@ -32,6 +32,9 @@
     "@actions/glob": "^0.5.0",
     "@actions/io": "^1.1.3",
     "@actions/tool-cache": "^2.0.2",
+    "@octokit/core": "^7.0.6",
+    "@octokit/plugin-paginate-rest": "^14.0.0",
+    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
     "@renovatebot/pep440": "^4.2.1",
     "smol-toml": "^1.4.2",
     "undici": "5.28.5"

src/download/checksum/checksum.ts

@@ -11,36 +11,28 @@ export async function validateChecksum(
   arch: Architecture,
   platform: Platform,
   version: string,
-  ndjsonChecksum?: string,
 ): Promise<void> {
-  // Priority: user-provided checksum > KNOWN_CHECKSUMS > NDJSON fallback
+  let isValid: boolean | undefined;
-  const key = `${arch}-${platform}-${version}`;
-  let checksumToUse: string | undefined;
-  let source: string;
-
   if (checkSum !== undefined && checkSum !== "") {
-    checksumToUse = checkSum;
+    isValid = await validateFileCheckSum(downloadPath, checkSum);
-    source = "user-provided";
-  } else if (key in KNOWN_CHECKSUMS) {
-    checksumToUse = KNOWN_CHECKSUMS[key];
-    source = `known checksum for ${key}`;
-  } else if (ndjsonChecksum !== undefined && ndjsonChecksum !== "") {
-    checksumToUse = ndjsonChecksum;
-    source = "NDJSON version data";
   } else {
-    core.debug(`No checksum found for ${key}.`);
+    core.debug("Checksum not provided. Checking known checksums.");
-    return;
+    const key = `${arch}-${platform}-${version}`;
+    if (key in KNOWN_CHECKSUMS) {
+      const knownChecksum = KNOWN_CHECKSUMS[`${arch}-${platform}-${version}`];
+      core.debug(`Checking checksum for ${arch}-${platform}-${version}.`);
+      isValid = await validateFileCheckSum(downloadPath, knownChecksum);
+    } else {
+      core.debug(`No known checksum found for ${key}.`);
+    }
   }
 
-  core.debug(`Using ${source}.`);
+  if (isValid === false) {
-  const isValid = await validateFileCheckSum(downloadPath, checksumToUse);
+    throw new Error(`Checksum for ${downloadPath} did not match ${checkSum}.`);
-
+  }
-  if (!isValid) {
+  if (isValid === true) {
-    throw new Error(
+    core.debug(`Checksum for ${downloadPath} is valid.`);
-      `Checksum for ${downloadPath} did not match ${checksumToUse}.`,
-    );
   }
-  core.debug(`Checksum for ${downloadPath} is valid.`);
 }
 
 async function validateFileCheckSum(

src/download/checksum/update-known-checksums.ts

@@ -1,13 +1,9 @@
 import { promises as fs } from "node:fs";
-
+import * as tc from "@actions/tool-cache";
-export interface ChecksumEntry {
+import { KNOWN_CHECKSUMS } from "./known-checksums";
-  key: string;
-  checksum: string;
-}
-
 export async function updateChecksums(
   filePath: string,
-  checksumEntries: ChecksumEntry[],
+  downloadUrls: string[],
 ): Promise<void> {
   await fs.rm(filePath);
   await fs.appendFile(
@@ -15,12 +11,49 @@ export async function updateChecksums(
     "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n",
   );
   let firstLine = true;
-  for (const entry of checksumEntries) {
+  for (const downloadUrl of downloadUrls) {
+    const key = getKey(downloadUrl);
+    if (key === undefined) {
+      continue;
+    }
+    const checksum = await getOrDownloadChecksum(key, downloadUrl);
     if (!firstLine) {
       await fs.appendFile(filePath, ",\n");
     }
-    await fs.appendFile(filePath, `  "${entry.key}":\n    "${entry.checksum}"`);
+    await fs.appendFile(filePath, `  "${key}":\n    "${checksum}"`);
     firstLine = false;
   }
   await fs.appendFile(filePath, ",\n};\n");
 }
+
+function getKey(downloadUrl: string): string | undefined {
+  // https://github.com/astral-sh/uv/releases/download/0.3.2/uv-aarch64-apple-darwin.tar.gz.sha256
+  const parts = downloadUrl.split("/");
+  const fileName = parts[parts.length - 1];
+  if (fileName.startsWith("source")) {
+    return undefined;
+  }
+  const name = fileName.split(".")[0].split("uv-")[1];
+  const version = parts[parts.length - 2];
+  return `${name}-${version}`;
+}
+
+async function getOrDownloadChecksum(
+  key: string,
+  downloadUrl: string,
+): Promise<string> {
+  let checksum = "";
+  if (key in KNOWN_CHECKSUMS) {
+    checksum = KNOWN_CHECKSUMS[key];
+  } else {
+    const content = await downloadAssetContent(downloadUrl);
+    checksum = content.split(" ")[0].trim();
+  }
+  return checksum;
+}
+
+async function downloadAssetContent(downloadUrl: string): Promise<string> {
+  const downloadPath = await tc.downloadTool(downloadUrl);
+  const content = await fs.readFile(downloadPath, "utf8");
+  return content;
+}

src/download/download-version.ts

@@ -8,14 +8,11 @@ import { OWNER, REPO, TOOL_CACHE_NAME } from "../utils/constants";
 import type { Architecture, Platform } from "../utils/platforms";
 import { validateChecksum } from "./checksum/checksum";
 import {
+  getAvailableVersionsFromManifest,
+  getDownloadUrl,
   getLatestKnownVersion as getLatestVersionInManifest,
-  getDownloadUrl as getManifestDownloadUrl,
+  REMOTE_MANIFEST_URL,
 } from "./version-manifest";
-import {
-  getAllVersions,
-  getArtifact,
-  getLatestVersion as getLatestVersionFromNdjson,
-} from "./versions-client";
 
 export function tryGetFromToolCache(
   arch: Architecture,
@@ -32,7 +29,7 @@ export function tryGetFromToolCache(
   return { installedPath, version: resolvedVersion };
 }
 
-export async function downloadVersionFromNdjson(
+export async function downloadVersionFromGithub(
   platform: Platform,
   arch: Architecture,
   version: string,
@@ -41,14 +38,7 @@ export async function downloadVersionFromNdjson(
 ): Promise<{ version: string; cachedToolDir: string }> {
   const artifact = `uv-${arch}-${platform}`;
   const extension = getExtension(platform);
-
+  const downloadUrl = `https://github.com/${OWNER}/${REPO}/releases/download/${version}/${artifact}${extension}`;
-  // Get artifact info from NDJSON (includes URL and checksum)
-  const artifactInfo = await getArtifact(version, arch, platform);
-
-  const downloadUrl =
-    artifactInfo?.url ??
-    `https://github.com/${OWNER}/${REPO}/releases/download/${version}/${artifact}${extension}`;
-
   return await downloadVersion(
     downloadUrl,
     artifact,
@@ -57,39 +47,52 @@ export async function downloadVersionFromNdjson(
     version,
     checkSum,
     githubToken,
-    artifactInfo?.sha256,
   );
 }
 
 export async function downloadVersionFromManifest(
-  manifestUrl: string,
+  manifestUrl: string | undefined,
   platform: Platform,
   arch: Architecture,
   version: string,
   checkSum: string | undefined,
   githubToken: string,
 ): Promise<{ version: string; cachedToolDir: string }> {
-  const downloadUrl = await getManifestDownloadUrl(
+  // If no user-provided manifest, try remote manifest first (will use cache if already fetched)
-    manifestUrl,
+  // then fall back to bundled manifest
-    version,
+  const manifestSources =
-    arch,
+    manifestUrl !== undefined
-    platform,
+      ? [manifestUrl]
-  );
+      : [REMOTE_MANIFEST_URL, undefined];
-  if (!downloadUrl) {
+
-    throw new Error(
+  for (const source of manifestSources) {
-      `manifest-file does not contain version ${version}, arch ${arch}, platform ${platform}.`,
+    try {
-    );
+      const downloadUrl = await getDownloadUrl(source, version, arch, platform);
+      if (downloadUrl) {
+        return await downloadVersion(
+          downloadUrl,
+          `uv-${arch}-${platform}`,
+          platform,
+          arch,
+          version,
+          checkSum,
+          githubToken,
+        );
+      }
+    } catch (err) {
+      core.debug(`Failed to get download URL from manifest ${source}: ${err}`);
+    }
   }
 
-  return await downloadVersion(
+  core.info(
-    downloadUrl,
+    `Manifest does not contain version ${version}, arch ${arch}, platform ${platform}. Falling back to GitHub releases.`,
-    `uv-${arch}-${platform}`,
+  );
+  return await downloadVersionFromGithub(
     platform,
     arch,
     version,
     checkSum,
     githubToken,
-    undefined, // No NDJSON checksum for manifest downloads
   );
 }
 
@@ -101,7 +104,6 @@ async function downloadVersion(
   version: string,
   checkSum: string | undefined,
   githubToken: string,
-  ndjsonChecksum?: string,
 ): Promise<{ version: string; cachedToolDir: string }> {
   core.info(`Downloading uv from "${downloadUrl}" ...`);
   const downloadPath = await tc.downloadTool(
@@ -109,14 +111,7 @@ async function downloadVersion(
     undefined,
     githubToken,
   );
-  await validateChecksum(
+  await validateChecksum(checkSum, downloadPath, arch, platform, version);
-    checkSum,
-    downloadPath,
-    arch,
-    platform,
-    version,
-    ndjsonChecksum,
-  );
 
   let uvDir: string;
   if (platform === "pc-windows-msvc") {
@@ -173,7 +168,7 @@ export async function resolveVersion(
   } else {
     version =
       versionInput === "latest" || resolveVersionSpecifierToLatest
-        ? await getLatestVersionFromNdjson()
+        ? await getLatestVersion()
         : versionInput;
   }
   if (tc.isExplicitVersion(version)) {
@@ -198,8 +193,36 @@ export async function resolveVersion(
 }
 
 async function getAvailableVersions(): Promise<string[]> {
-  core.info("Getting available versions from NDJSON...");
+  // 1. Try remote manifest first (no rate limits, always current)
-  return await getAllVersions();
+  try {
+    core.info("Getting available versions from remote manifest...");
+    const versions =
+      await getAvailableVersionsFromManifest(REMOTE_MANIFEST_URL);
+    core.debug(`Found ${versions.length} versions from remote manifest`);
+    return versions;
+  } catch (err) {
+    core.debug(`Remote manifest lookup failed: ${err}`);
+  }
+
+  // 2. Fall back to bundled manifest (no network, may be stale)
+  core.info("Getting available versions from bundled manifest...");
+  return await getAvailableVersionsFromManifest(undefined);
+}
+
+async function getLatestVersion() {
+  // 1. Try remote manifest first (no rate limits, always current)
+  try {
+    core.info("Getting latest version from remote manifest...");
+    const version = await getLatestVersionInManifest(REMOTE_MANIFEST_URL);
+    core.debug(`Latest version from remote manifest: ${version}`);
+    return version;
+  } catch (err) {
+    core.debug(`Remote manifest lookup failed: ${err}`);
+  }
+
+  // 2. Fall back to bundled manifest (no network, may be stale)
+  core.info("Getting latest version from bundled manifest...");
+  return await getLatestVersionInManifest(undefined);
 }
 
 function maxSatisfying(

src/download/version-manifest.ts

@@ -5,6 +5,11 @@ import * as semver from "semver";
 import { fetch } from "../utils/fetch";
 
 const localManifestFile = join(__dirname, "..", "..", "version-manifest.json");
+export const REMOTE_MANIFEST_URL =
+  "https://raw.githubusercontent.com/astral-sh/setup-uv/main/version-manifest.json";
+
+// Cache for manifest entries to avoid re-fetching
+const manifestCache = new Map<string, ManifestEntry[]>();
 
 interface ManifestEntry {
   version: string;
@@ -39,9 +44,25 @@ export async function getDownloadUrl(
   return entry ? entry.downloadUrl : undefined;
 }
 
+export async function getAvailableVersionsFromManifest(
+  manifestUrl: string | undefined,
+): Promise<string[]> {
+  const manifestEntries = await getManifestEntries(manifestUrl);
+  return [...new Set(manifestEntries.map((entry) => entry.version))];
+}
+
 async function getManifestEntries(
   manifestUrl: string | undefined,
 ): Promise<ManifestEntry[]> {
+  const cacheKey = manifestUrl ?? "local";
+
+  // Return cached entries if available
+  const cached = manifestCache.get(cacheKey);
+  if (cached !== undefined) {
+    core.debug(`Using cached manifest entries for: ${cacheKey}`);
+    return cached;
+  }
+
   let data: string;
   if (manifestUrl !== undefined) {
     core.info(`Fetching manifest-file from: ${manifestUrl}`);
@@ -58,7 +79,9 @@ async function getManifestEntries(
     data = fileContent.toString();
   }
 
-  return JSON.parse(data);
+  const entries: ManifestEntry[] = JSON.parse(data);
+  manifestCache.set(cacheKey, entries);
+  return entries;
 }
 
 export async function updateVersionManifest(

src/download/versions-client.ts

@@ -1,113 +0,0 @@
-import * as core from "@actions/core";
-import { VERSIONS_NDJSON_URL } from "../utils/constants";
-import { fetch } from "../utils/fetch";
-
-export interface NdjsonArtifact {
-  platform: string;
-  variant: string;
-  url: string;
-  archive_format: string;
-  sha256: string;
-}
-
-export interface NdjsonVersion {
-  version: string;
-  artifacts: NdjsonArtifact[];
-}
-
-let cachedVersionData: NdjsonVersion[] | null = null;
-
-export async function fetchVersionData(): Promise<NdjsonVersion[]> {
-  if (cachedVersionData !== null) {
-    core.debug("Using cached NDJSON version data");
-    return cachedVersionData;
-  }
-
-  core.info(`Fetching version data from ${VERSIONS_NDJSON_URL}...`);
-  const response = await fetch(VERSIONS_NDJSON_URL, {});
-  if (!response.ok) {
-    throw new Error(
-      `Failed to fetch version data: ${response.status} ${response.statusText}`,
-    );
-  }
-
-  const body = await response.text();
-  const versions: NdjsonVersion[] = [];
-
-  for (const line of body.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed === "") {
-      continue;
-    }
-    try {
-      const version = JSON.parse(trimmed) as NdjsonVersion;
-      versions.push(version);
-    } catch {
-      core.debug(`Failed to parse NDJSON line: ${trimmed}`);
-    }
-  }
-
-  if (versions.length === 0) {
-    throw new Error("No version data found in NDJSON file");
-  }
-
-  cachedVersionData = versions;
-  return versions;
-}
-
-export async function getLatestVersion(): Promise<string> {
-  const versions = await fetchVersionData();
-  // The NDJSON file lists versions in order, newest first
-  const latestVersion = versions[0]?.version;
-  if (!latestVersion) {
-    throw new Error("No versions found in NDJSON data");
-  }
-  core.debug(`Latest version from NDJSON: ${latestVersion}`);
-  return latestVersion;
-}
-
-export async function getAllVersions(): Promise<string[]> {
-  const versions = await fetchVersionData();
-  return versions.map((v) => v.version);
-}
-
-export interface ArtifactResult {
-  url: string;
-  sha256: string;
-}
-
-export async function getArtifact(
-  version: string,
-  arch: string,
-  platform: string,
-): Promise<ArtifactResult | undefined> {
-  const versions = await fetchVersionData();
-  const versionData = versions.find((v) => v.version === version);
-  if (!versionData) {
-    core.debug(`Version ${version} not found in NDJSON data`);
-    return undefined;
-  }
-
-  // The NDJSON artifact platform format is like "x86_64-apple-darwin"
-  // We need to match against arch-platform
-  const targetPlatform = `${arch}-${platform}`;
-  const artifact = versionData.artifacts.find(
-    (a) => a.platform === targetPlatform,
-  );
-
-  if (!artifact) {
-    core.debug(
-      `Artifact for ${targetPlatform} not found in version ${version}. Available platforms: ${versionData.artifacts.map((a) => a.platform).join(", ")}`,
-    );
-    return undefined;
-  }
-
-  return {
-    sha256: artifact.sha256,
-    url: artifact.url,
-  };
-}
-
-export function clearCache(): void {
-  cachedVersionData = null;
-}

src/setup-uv.ts

@@ -5,7 +5,6 @@ import * as exec from "@actions/exec";
 import { restoreCache } from "./cache/restore-cache";
 import {
   downloadVersionFromManifest,
-  downloadVersionFromNdjson,
   resolveVersion,
   tryGetFromToolCache,
 } from "./download/download-version";
@@ -139,23 +138,14 @@ async function setupUv(
     };
   }
 
-  // Use the same source for download as we used for version resolution
+  const downloadVersionResult = await downloadVersionFromManifest(
-  const downloadVersionResult = manifestFile
+    manifestFile,
-    ? await downloadVersionFromManifest(
+    platform,
-        manifestFile,
+    arch,
-        platform,
+    resolvedVersion,
-        arch,
+    checkSum,
-        resolvedVersion,
+    githubToken,
-        checkSum,
+  );
-        githubToken,
-      )
-    : await downloadVersionFromNdjson(
-        platform,
-        arch,
-        resolvedVersion,
-        checkSum,
-        githubToken,
-      );
 
   return {
     uvDir: downloadVersionResult.cachedToolDir,

src/update-known-versions.ts

@@ -1,116 +1,63 @@
-import { promises as fs } from "node:fs";
 import * as core from "@actions/core";
+import type { Endpoints } from "@octokit/types";
 import * as semver from "semver";
 import { updateChecksums } from "./download/checksum/update-known-checksums";
-import { getLatestKnownVersion } from "./download/version-manifest";
 import {
-  fetchVersionData,
+  getLatestKnownVersion,
-  getLatestVersion,
+  updateVersionManifest,
-  type NdjsonVersion,
+} from "./download/version-manifest";
-} from "./download/versions-client";
+import { OWNER, REPO } from "./utils/constants";
+import { Octokit } from "./utils/octokit";
 
-interface ChecksumEntry {
+type Release =
-  key: string;
+  Endpoints["GET /repos/{owner}/{repo}/releases"]["response"]["data"][number];
-  checksum: string;
-}
-
-interface ArtifactEntry {
-  version: string;
-  artifactName: string;
-  arch: string;
-  platform: string;
-  downloadUrl: string;
-}
-
-function extractChecksumsFromNdjson(
-  versions: NdjsonVersion[],
-): ChecksumEntry[] {
-  const checksums: ChecksumEntry[] = [];
-
-  for (const version of versions) {
-    for (const artifact of version.artifacts) {
-      // The platform field contains the target triple like "x86_64-apple-darwin"
-      const key = `${artifact.platform}-${version.version}`;
-      checksums.push({
-        checksum: artifact.sha256,
-        key,
-      });
-    }
-  }
-
-  return checksums;
-}
-
-function extractArtifactsFromNdjson(
-  versions: NdjsonVersion[],
-): ArtifactEntry[] {
-  const artifacts: ArtifactEntry[] = [];
-
-  for (const version of versions) {
-    for (const artifact of version.artifacts) {
-      // The platform field contains the target triple like "x86_64-apple-darwin"
-      // Split into arch and platform (e.g., "x86_64-apple-darwin" -> ["x86_64", "apple-darwin"])
-      const parts = artifact.platform.split("-");
-      const arch = parts[0];
-      const platform = parts.slice(1).join("-");
-
-      // Construct artifact name from platform and archive format
-      const artifactName = `uv-${artifact.platform}.${artifact.archive_format}`;
-
-      artifacts.push({
-        arch,
-        artifactName,
-        downloadUrl: artifact.url,
-        platform,
-        version: version.version,
-      });
-    }
-  }
-
-  return artifacts;
-}
 
 async function run(): Promise<void> {
   const checksumFilePath = process.argv.slice(2)[0];
   const versionsManifestFile = process.argv.slice(2)[1];
+  const githubToken = process.argv.slice(2)[2];
+
+  const octokit = new Octokit({
+    auth: githubToken,
+  });
+
+  const { data: latestRelease } = await octokit.rest.repos.getLatestRelease({
+    owner: OWNER,
+    repo: REPO,
+  });
 
-  const latestVersion = await getLatestVersion();
   const latestKnownVersion = await getLatestKnownVersion(undefined);
 
-  if (semver.lte(latestVersion, latestKnownVersion)) {
+  if (semver.lte(latestRelease.tag_name, latestKnownVersion)) {
     core.info(
-      `Latest release (${latestVersion}) is not newer than the latest known version (${latestKnownVersion}). Skipping update.`,
+      `Latest release (${latestRelease.tag_name}) is not newer than the latest known version (${latestKnownVersion}). Skipping update.`,
     );
     return;
   }
 
-  const versions = await fetchVersionData();
+  const releases: Release[] = await octokit.paginate(
+    octokit.rest.repos.listReleases,
+    {
+      owner: OWNER,
+      repo: REPO,
+    },
+  );
+  const checksumDownloadUrls: string[] = releases.flatMap((release) =>
+    release.assets
+      .filter((asset) => asset.name.endsWith(".sha256"))
+      .map((asset) => asset.browser_download_url),
+  );
+  await updateChecksums(checksumFilePath, checksumDownloadUrls);
 
-  // Extract checksums from NDJSON
+  const artifactDownloadUrls: string[] = releases.flatMap((release) =>
-  const checksumEntries = extractChecksumsFromNdjson(versions);
+    release.assets
-  await updateChecksums(checksumFilePath, checksumEntries);
+      .filter((asset) => !asset.name.endsWith(".sha256"))
+      .map((asset) => asset.browser_download_url),
+  );
 
-  // Extract artifact URLs for version manifest
+  await updateVersionManifest(versionsManifestFile, artifactDownloadUrls);
-  const artifactEntries = extractArtifactsFromNdjson(versions);
-  await updateVersionManifestFromEntries(versionsManifestFile, artifactEntries);
 
-  core.setOutput("latest-version", latestVersion);
+  core.setOutput("latest-version", latestRelease.tag_name);
-}
-
-async function updateVersionManifestFromEntries(
-  filePath: string,
-  entries: ArtifactEntry[],
-): Promise<void> {
-  const manifest = entries.map((entry) => ({
-    arch: entry.arch,
-    artifactName: entry.artifactName,
-    downloadUrl: entry.downloadUrl,
-    platform: entry.platform,
-    version: entry.version,
-  }));
-
-  core.debug(`Updating manifest-file: ${JSON.stringify(manifest)}`);
-  await fs.writeFile(filePath, JSON.stringify(manifest));
 }
 
 run();

src/utils/constants.ts

@@ -3,5 +3,3 @@ export const OWNER = "astral-sh";
 export const TOOL_CACHE_NAME = "uv";
 export const STATE_UV_PATH = "uv-path";
 export const STATE_UV_VERSION = "uv-version";
-export const VERSIONS_NDJSON_URL =
-  "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";

src/utils/octokit.ts

@@ -0,0 +1,34 @@
+import type { OctokitOptions } from "@octokit/core";
+import { Octokit as Core } from "@octokit/core";
+import {
+  type PaginateInterface,
+  paginateRest,
+} from "@octokit/plugin-paginate-rest";
+import { legacyRestEndpointMethods } from "@octokit/plugin-rest-endpoint-methods";
+import { fetch as customFetch } from "./fetch";
+
+export type { RestEndpointMethodTypes } from "@octokit/plugin-rest-endpoint-methods";
+
+const DEFAULTS = {
+  baseUrl: "https://api.github.com",
+  userAgent: "setup-uv",
+};
+
+const OctokitWithPlugins = Core.plugin(paginateRest, legacyRestEndpointMethods);
+
+export const Octokit = OctokitWithPlugins.defaults(function buildDefaults(
+  options: OctokitOptions,
+): OctokitOptions {
+  return {
+    ...DEFAULTS,
+    ...options,
+    request: {
+      fetch: customFetch,
+      ...options.request,
+    },
+  };
+});
+
+export type Octokit = InstanceType<typeof OctokitWithPlugins> & {
+  paginate: PaginateInterface;
+};