action.yml

name: setup-pixi
description: Install the pixi package manager
author: Pavel Zwerschke
branding:
  icon: package
  color: yellow

inputs:
  pixi-version:
    description: Version of pixi to install
  pixi-url:
    description: URL of pixi to install. Can be a Handlebars template receiving `version`, `latest`, and `pixiFile` as variables.
  pixi-url-headers:
    description: Headers to use when fetching the pixi binary from `pixi-url`. Should be a JSON string.
  log-level:
    description: |
      Log level for the pixi CLI.
      One of `q`, `default`, `v`, `vv`, or `vvv`.
  manifest-path:
    description: Path to the manifest file (i.e., `pixi.toml`) to use for the pixi CLI. Defaults to `pixi.toml`.
  working-directory:
    description: |
      Working directory to use for pixi commands. If specified, pixi will look for manifest files (pixi.toml or pyproject.toml)
      in this directory instead of the repository root. Useful for monorepos where pixi projects are in subdirectories.
  run-install:
    description: Whether to run `pixi install` after installing pixi. Defaults to `true`.
  environments:
    description: |
      A space-separated list of environments to install. If not specified, only the default environment is installed.
  global-environments:
    description: |
      A newline-separated list of packages to install globally with `pixi global install`.
  activate-environment:
    description: |
      If the installed environment should be "activated" for the current job, modifying `$GITHUB_ENV` and
      `$GITHUB_PATH`. If more than one environment is specified in `environments`, this must be the name of the
      environment. Defaults to `false`. Requires at least pixi v0.21.0.
  locked:
    description: Whether to use `pixi install --locked`. Defaults to `true` when the lockfile is present, otherwise `false`.
  frozen:
    description: Whether to use `pixi install --frozen`. Defaults to `false`.
  cache:
    description: Whether to cache the pixi environment. Defaults to `true`. Only works if `pixi.lock` is present.
  global-cache:
    description: |
      Whether to cache the global environment(s). Defaults to `false`. As there is no lockfile for global environment,
      the global cache will expire at the end of every month, to ensure it does not go stale.
  cache-key:
    description: |
      Cache key prefix to use for caching the pixi environment.
      Defaults to `pixi-`. The full cache key is `<cache-key><conda-arch>-<sha-256-of-pixi-lock>`.
  global-cache-key:
    description: |
      Cache key prefix to use for caching the global environments.
      Defaults to `pixi-global-`. The full cache key is `<global-cache-key><conda-arch>-<sha-256-of-global-environments>`.
  cache-write:
    description: |
      Whether to write to the cache or only read from it. Defaults to `true`. Applies to both project and global caches as the case may be.
  pixi-bin-path:
    description: |
      Path to the pixi binary to use. Defaults to `~/.pixi/bin/pixi`.
  auth-host:
    description: |
      Host to use for authentication. If not set, pixi is not authenticating.
      Requires `auth-token`, `auth-conda-token`, `auth-workload-identity`, `auth-s3-access-key-id` and `auth-s3-secret-access-key`,
      or `auth-username` and `auth-password` to be set.
      See https://pixi.prefix.dev/latest/deployment/authentication/
  auth-token:
    description: Token to use for authentication.
  auth-username:
    description: Username to use for authentication.
  auth-password:
    description: Password to use for authentication.
  auth-conda-token:
    description: Conda token to use for authentication.
  auth-s3-access-key-id:
    description: Access key ID to use for S3 authentication.
  auth-s3-secret-access-key:
    description: Secret access key to use for S3 authentication.
  auth-s3-session-token:
    description: Session token to use for S3 authentication.
  auth-workload-identity:
    description: |
      Whether to log in non-interactively by exchanging the GitHub Actions OIDC ID token for an access token
      (`pixi auth login --workload-identity`). Defaults to `false`. Requires `auth-host` and `permissions: id-token: write`.
  auth-workload-identity-audience:
    description: |
      Audience requested in the OIDC ID token. Defaults to the host, or `prefix.dev` for prefix.dev hosts.
      Requires `auth-workload-identity`.
  auth-workload-identity-exchange:
    description: |
      How the server exchanges the ID token.
      Requires `auth-workload-identity`.
      options: token-exchange, prefix
      - `token-exchange`: OAuth 2.0 Token Exchange (RFC 8693) at `auth-workload-identity-token-endpoint`.
      - `prefix`: prefix.dev's mint endpoint.
  auth-workload-identity-token-endpoint:
    description: |
      Token endpoint for `auth-workload-identity-exchange: token-exchange`: a URL or a path on the host.
      Defaults to the `token_endpoint` from the host's RFC 8414 metadata.
      Requires `auth-workload-identity`.
  auth-logout:
    description: |
      When to run `pixi auth logout <auth-host>`. Requires `auth-host`.
      options: post, after-install, never
      - `post` (default): The credentials stay available to all subsequent steps and are removed in the post step at the end of the job.
      - `after-install`: The credentials are removed at the end of this action, so that later steps cannot reach the private channel anymore.
      - `never`: The credentials are never removed.
  persist-credentials:
    description: Removed, use `auth-logout` instead.
    deprecationMessage: '`persist-credentials` has been removed, use `auth-logout: after-install` (instead of `false`) or `auth-logout: never` (instead of `true`).'
  pypi-keyring-provider:
    description: |
      Specifies whether to use keyring to look up credentials for PyPI.
      options: disabled, subprocess
  post-cleanup:
    description: |
      If the action should clean up after itself. Defaults to `false`.
      If `true`, the pixi environment, the pixi binary and the rattler files in ~/.rattler and ~/.cache/rattler are removed.
  configuration:
    description: |
      Global pixi configuration in TOML format. Will be written to `$PIXI_HOME/config.toml` (`~/.pixi/config.toml` by default).
      Fails if this file already exists.
      For example, to enable insecure post-link scripts: `run-post-link-scripts = "insecure"`

runs:
  using: node24
  main: dist/index.js
  post: dist/post.js