chore(deps): bump github/codeql-action from 4.32.2 to 4.32.6

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.2 to 4.32.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](45cbd0c69e...0d579ffd05)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/codeql-analysis.yml

@@ -47,7 +47,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
         with:
           languages: ${{ matrix.language }}
           source-root: src
@@ -59,7 +59,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6

.github/workflows/test.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Actionlint
         uses: eifinger/actionlint-action@7802e0cc3ab3f81cbffb36fb0bf1a3621d994b89 # v1.10.1
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: .nvmrc
@@ -38,7 +38,7 @@ jobs:
           npm run all
       - name: Check all jobs are in all-tests-passed.needs
         run: |
-          tsc --module nodenext --moduleResolution nodenext --target es2022 check-all-tests-passed-needs.ts
+          tsc check-all-tests-passed-needs.ts
           node check-all-tests-passed-needs.js
         working-directory: .github/scripts
       - name: Make sure no changes from linters are detected
@@ -164,21 +164,9 @@ jobs:
       - name: Latest version gets installed
         run: |
           LATEST_VERSION=$(gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/astral-sh/uv/releases/latest | jq -r '.tag_name')
-          UV_VERSION_OUTPUT=$(uv --version)
-
-          if [[ ! "$UV_VERSION_OUTPUT" =~ ^uv[[:space:]]+([^[:space:]]+) ]]; then
-            echo "Could not parse uv version from: $UV_VERSION_OUTPUT"
-            exit 1
-          fi
-
-          UV_VERSION="${BASH_REMATCH[1]}"
-
           echo "Latest version is $LATEST_VERSION"
-          echo "uv --version output is $UV_VERSION_OUTPUT"
+          if [ "$(uv --version)" != "uv $LATEST_VERSION" ]; then
-          echo "Parsed uv version is $UV_VERSION"
+              echo "Wrong uv version: $(uv --version)"
-
-          if [ "$UV_VERSION" != "$LATEST_VERSION" ]; then
-            echo "Wrong uv version: $UV_VERSION_OUTPUT"
               exit 1
           fi
         env:
@@ -808,12 +796,12 @@ jobs:
       - name: Install from custom manifest file
         uses: ./
         with:
-          manifest-file: "https://raw.githubusercontent.com/astral-sh/setup-uv/${{ github.ref }}/__tests__/download/custom-manifest.ndjson"
+          manifest-file: "https://raw.githubusercontent.com/astral-sh/setup-uv/${{ github.ref }}/__tests__/download/custom-manifest.json"
       - run: uv sync
         working-directory: __tests__/fixtures/uv-project
       - name: Correct version gets installed
         run: |
-          if [ "$(uv --version)" != "uv 0.9.26" ]; then
+          if [ "$(uv --version)" != "uv 0.7.12-alpha.1" ]; then
             echo "Wrong uv version: $(uv --version)"
             exit 1
           fi

.github/workflows/update-known-checksums.yml

@@ -20,12 +20,11 @@ jobs:
           persist-credentials: true
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: .nvmrc
+          node-version: "20"
-          cache: npm
       - name: Update known checksums
         id: update-known-checksums
         run:
-          node dist/update-known-checksums/index.cjs
+          node dist/update-known-checksums/index.js
           src/download/checksum/known-checksums.ts
       - name: Check for changes
         id: changes-exist

AGENTS.md

@@ -10,9 +10,4 @@ This repository is a TypeScript-based GitHub Action for installing `uv` in GitHu
 - User-facing changes are usually multi-file changes. If you add or change inputs, outputs, or behavior, update `action.yml`, the implementation in `src/`, tests in `__tests__/`, relevant docs/README, and then re-package.
 - The easiest areas to regress are version resolution and caching. When touching them, add or update tests for precedence, cache invalidation, and cross-platform path behavior.
 - Workflow edits have extra CI-only checks (`actionlint` and `zizmor`); `npm run all` does not cover them.
-- Source is authored with bundler-friendly TypeScript, but published action artifacts in `dist/` are bundled as CommonJS for maximum GitHub Actions runtime compatibility with `@actions/*` dependencies.
-- Keep these concerns separate when changing module formats:
-  - `src/` and tests may use modern ESM-friendly TypeScript patterns.
-  - `dist/` should prioritize runtime reliability over format purity.
-  - Do not switch published bundles to ESM without validating the actual committed artifacts under the target Node runtime.
 - Before finishing, make sure validation does not leave generated or formatting-only diffs behind.

README.md

@@ -114,7 +114,7 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed
     # Custom path to set UV_TOOL_BIN_DIR to
     tool-bin-dir: ""
 
-    # URL to a custom manifest file in the astral-sh/versions format
+    # URL to a custom manifest file (NDJSON preferred, legacy JSON array is deprecated)
     manifest-file: ""
 
     # Add problem matchers
@@ -190,8 +190,8 @@ For more advanced configuration options, see our detailed documentation:
 
 ## How it works
 
-By default, this action resolves uv versions from the
+By default, this action resolves uv versions from
-[`astral-sh/versions`](https://github.com/astral-sh/versions) manifest and downloads uv from the
+[`astral-sh/versions`](https://github.com/astral-sh/versions) (NDJSON) and downloads uv from the
 official [GitHub Releases](https://github.com/astral-sh/uv).
 
 It then uses the [GitHub Actions Toolkit](https://github.com/actions/toolkit) to cache uv as a

__tests__/download/custom-manifest.json

@@ -0,0 +1,9 @@
+[
+  {
+    "arch": "x86_64",
+    "artifactName": "uv-x86_64-unknown-linux-gnu.tar.gz",
+    "downloadUrl": "https://release.pyx.dev/0.7.12-alpha.1/uv-x86_64-unknown-linux-gnu.tar.gz",
+    "platform": "unknown-linux-gnu",
+    "version": "0.7.12-alpha.1"
+  }
+]

__tests__/download/custom-manifest.ndjson

@@ -1 +0,0 @@
-{"version":"0.9.26","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"30ccbf0a66dc8727a02b0e245c583ee970bdafecf3a443c1686e1b30ec4939e8"}]}

__tests__/download/download-version.test.ts

@@ -1,10 +1,9 @@
 import { beforeEach, describe, expect, it, jest } from "@jest/globals";
-import * as semver from "semver";
 
 const mockInfo = jest.fn();
 const mockWarning = jest.fn();
 
-jest.unstable_mockModule("@actions/core", () => ({
+jest.mock("@actions/core", () => ({
   debug: jest.fn(),
   info: mockInfo,
   warning: mockWarning,
@@ -19,41 +18,59 @@ const mockExtractZip = jest.fn<any>();
 // biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
 const mockCacheDir = jest.fn<any>();
 
-jest.unstable_mockModule("@actions/tool-cache", () => ({
+jest.mock("@actions/tool-cache", () => {
+  const actual = jest.requireActual("@actions/tool-cache") as Record<
+    string,
+    unknown
+  >;
+
+  return {
+    ...actual,
     cacheDir: mockCacheDir,
     downloadTool: mockDownloadTool,
-  evaluateVersions: (versions: string[], range: string) =>
-    semver.maxSatisfying(versions, range) ?? "",
     extractTar: mockExtractTar,
     extractZip: mockExtractZip,
-  find: () => "",
+  };
-  findAllVersions: () => [],
+});
-  isExplicitVersion: (version: string) => semver.valid(version) !== null,
+
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockGetLatestVersionFromNdjson = jest.fn<any>();
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockGetAllVersionsFromNdjson = jest.fn<any>();
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockGetArtifactFromNdjson = jest.fn<any>();
+
+jest.mock("../../src/download/versions-client", () => ({
+  getAllVersions: mockGetAllVersionsFromNdjson,
+  getArtifact: mockGetArtifactFromNdjson,
+  getLatestVersion: mockGetLatestVersionFromNdjson,
 }));
 
 // biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
-const mockGetLatestVersion = jest.fn<any>();
+const mockGetAllManifestVersions = jest.fn<any>();
 // biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
-const mockGetAllVersions = jest.fn<any>();
+const mockGetLatestVersionInManifest = jest.fn<any>();
 // biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
-const mockGetArtifact = jest.fn<any>();
+const mockGetManifestArtifact = jest.fn<any>();
 
-jest.unstable_mockModule("../../src/download/manifest", () => ({
+jest.mock("../../src/download/version-manifest", () => ({
-  getAllVersions: mockGetAllVersions,
+  getAllVersions: mockGetAllManifestVersions,
-  getArtifact: mockGetArtifact,
+  getLatestKnownVersion: mockGetLatestVersionInManifest,
-  getLatestVersion: mockGetLatestVersion,
+  getManifestArtifact: mockGetManifestArtifact,
 }));
 
 // biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
 const mockValidateChecksum = jest.fn<any>();
 
-jest.unstable_mockModule("../../src/download/checksum/checksum", () => ({
+jest.mock("../../src/download/checksum/checksum", () => ({
   validateChecksum: mockValidateChecksum,
 }));
 
-const { downloadVersion, resolveVersion, rewriteToMirror } = await import(
+import {
-  "../../src/download/download-version"
+  downloadVersionFromManifest,
-);
+  downloadVersionFromNdjson,
+  resolveVersion,
+} from "../../src/download/download-version";
 
 describe("download-version", () => {
   beforeEach(() => {
@@ -63,9 +80,12 @@ describe("download-version", () => {
     mockExtractTar.mockReset();
     mockExtractZip.mockReset();
     mockCacheDir.mockReset();
-    mockGetLatestVersion.mockReset();
+    mockGetLatestVersionFromNdjson.mockReset();
-    mockGetAllVersions.mockReset();
+    mockGetAllVersionsFromNdjson.mockReset();
-    mockGetArtifact.mockReset();
+    mockGetArtifactFromNdjson.mockReset();
+    mockGetAllManifestVersions.mockReset();
+    mockGetLatestVersionInManifest.mockReset();
+    mockGetManifestArtifact.mockReset();
     mockValidateChecksum.mockReset();
 
     mockDownloadTool.mockResolvedValue("/tmp/downloaded");
@@ -75,28 +95,36 @@ describe("download-version", () => {
   });
 
   describe("resolveVersion", () => {
-    it("uses the default manifest to resolve latest", async () => {
+    it("uses astral-sh/versions to resolve latest", async () => {
-      mockGetLatestVersion.mockResolvedValue("0.9.26");
+      mockGetLatestVersionFromNdjson.mockResolvedValue("0.9.26");
 
       const version = await resolveVersion("latest", undefined);
 
       expect(version).toBe("0.9.26");
-      expect(mockGetLatestVersion).toHaveBeenCalledTimes(1);
+      expect(mockGetLatestVersionFromNdjson).toHaveBeenCalledTimes(1);
-      expect(mockGetLatestVersion).toHaveBeenCalledWith(undefined);
     });
 
-    it("uses the default manifest to resolve available versions", async () => {
+    it("uses astral-sh/versions to resolve available versions", async () => {
-      mockGetAllVersions.mockResolvedValue(["0.9.26", "0.9.25"]);
+      mockGetAllVersionsFromNdjson.mockResolvedValue(["0.9.26", "0.9.25"]);
 
       const version = await resolveVersion("^0.9.0", undefined);
 
       expect(version).toBe("0.9.26");
-      expect(mockGetAllVersions).toHaveBeenCalledTimes(1);
+      expect(mockGetAllVersionsFromNdjson).toHaveBeenCalledTimes(1);
-      expect(mockGetAllVersions).toHaveBeenCalledWith(undefined);
+    });
+
+    it("does not fall back when astral-sh/versions fails", async () => {
+      mockGetLatestVersionFromNdjson.mockRejectedValue(
+        new Error("NDJSON unavailable"),
+      );
+
+      await expect(resolveVersion("latest", undefined)).rejects.toThrow(
+        "NDJSON unavailable",
+      );
     });
 
     it("uses manifest-file when provided", async () => {
-      mockGetAllVersions.mockResolvedValue(["0.9.26", "0.9.25"]);
+      mockGetAllManifestVersions.mockResolvedValue(["0.9.26", "0.9.25"]);
 
       const version = await resolveVersion(
         "^0.9.0",
@@ -104,35 +132,37 @@ describe("download-version", () => {
       );
 
       expect(version).toBe("0.9.26");
-      expect(mockGetAllVersions).toHaveBeenCalledWith(
+      expect(mockGetAllManifestVersions).toHaveBeenCalledWith(
         "https://example.com/custom.ndjson",
       );
     });
   });
 
-  describe("downloadVersion", () => {
+  describe("downloadVersionFromNdjson", () => {
-    it("fails when manifest lookup fails", async () => {
+    it("fails when NDJSON metadata lookup fails", async () => {
-      mockGetArtifact.mockRejectedValue(new Error("manifest unavailable"));
+      mockGetArtifactFromNdjson.mockRejectedValue(
+        new Error("NDJSON unavailable"),
+      );
 
       await expect(
-        downloadVersion(
+        downloadVersionFromNdjson(
           "unknown-linux-gnu",
           "x86_64",
           "0.9.26",
           undefined,
           "token",
         ),
-      ).rejects.toThrow("manifest unavailable");
+      ).rejects.toThrow("NDJSON unavailable");
 
       expect(mockDownloadTool).not.toHaveBeenCalled();
       expect(mockValidateChecksum).not.toHaveBeenCalled();
     });
 
-    it("fails when no matching artifact exists in the default manifest", async () => {
+    it("fails when no matching artifact exists in NDJSON metadata", async () => {
-      mockGetArtifact.mockResolvedValue(undefined);
+      mockGetArtifactFromNdjson.mockResolvedValue(undefined);
 
       await expect(
-        downloadVersion(
+        downloadVersionFromNdjson(
           "unknown-linux-gnu",
           "x86_64",
           "0.9.26",
@@ -147,14 +177,14 @@ describe("download-version", () => {
       expect(mockValidateChecksum).not.toHaveBeenCalled();
     });
 
-    it("uses built-in checksums for default manifest downloads", async () => {
+    it("uses built-in checksums for default NDJSON downloads", async () => {
-      mockGetArtifact.mockResolvedValue({
+      mockGetArtifactFromNdjson.mockResolvedValue({
         archiveFormat: "tar.gz",
-        checksum: "manifest-checksum-that-should-be-ignored",
+        sha256: "ndjson-checksum-that-should-be-ignored",
-        downloadUrl: "https://example.com/uv.tar.gz",
+        url: "https://example.com/uv.tar.gz",
       });
 
-      await downloadVersion(
+      await downloadVersionFromNdjson(
         "unknown-linux-gnu",
         "x86_64",
         "0.9.26",
@@ -170,126 +200,23 @@ describe("download-version", () => {
         "0.9.26",
       );
     });
-
-    it("rewrites GitHub Releases URLs to the Astral mirror", async () => {
-      mockGetArtifact.mockResolvedValue({
-        archiveFormat: "tar.gz",
-        checksum: "abc123",
-        downloadUrl:
-          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
-      });
-
-      await downloadVersion(
-        "unknown-linux-gnu",
-        "x86_64",
-        "0.9.26",
-        undefined,
-        "token",
-      );
-
-      expect(mockDownloadTool).toHaveBeenCalledWith(
-        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
-        undefined,
-        undefined,
-      );
-    });
-
-    it("does not rewrite non-GitHub URLs", async () => {
-      mockGetArtifact.mockResolvedValue({
-        archiveFormat: "tar.gz",
-        checksum: "abc123",
-        downloadUrl: "https://example.com/uv.tar.gz",
-      });
-
-      await downloadVersion(
-        "unknown-linux-gnu",
-        "x86_64",
-        "0.9.26",
-        undefined,
-        "token",
-      );
-
-      expect(mockDownloadTool).toHaveBeenCalledWith(
-        "https://example.com/uv.tar.gz",
-        undefined,
-        "token",
-      );
-    });
-
-    it("falls back to GitHub Releases when the mirror fails", async () => {
-      mockGetArtifact.mockResolvedValue({
-        archiveFormat: "tar.gz",
-        checksum: "abc123",
-        downloadUrl:
-          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
-      });
-
-      mockDownloadTool
-        .mockRejectedValueOnce(new Error("mirror unavailable"))
-        .mockResolvedValueOnce("/tmp/downloaded");
-
-      await downloadVersion(
-        "unknown-linux-gnu",
-        "x86_64",
-        "0.9.26",
-        undefined,
-        "token",
-      );
-
-      expect(mockDownloadTool).toHaveBeenCalledTimes(2);
-      expect(mockDownloadTool).toHaveBeenNthCalledWith(
-        1,
-        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
-        undefined,
-        undefined,
-      );
-      expect(mockDownloadTool).toHaveBeenNthCalledWith(
-        2,
-        "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
-        undefined,
-        "token",
-      );
-      expect(mockWarning).toHaveBeenCalledWith(
-        "Failed to download from mirror, falling back to GitHub Releases: mirror unavailable",
-      );
-    });
-
-    it("does not fall back for non-GitHub URLs", async () => {
-      mockGetArtifact.mockResolvedValue({
-        archiveFormat: "tar.gz",
-        checksum: "abc123",
-        downloadUrl: "https://example.com/uv.tar.gz",
-      });
-
-      mockDownloadTool.mockRejectedValue(new Error("download failed"));
-
-      await expect(
-        downloadVersion(
-          "unknown-linux-gnu",
-          "x86_64",
-          "0.9.26",
-          undefined,
-          "token",
-        ),
-      ).rejects.toThrow("download failed");
-
-      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
   });
 
+  describe("downloadVersionFromManifest", () => {
     it("uses manifest-file checksum metadata when checksum input is unset", async () => {
-      mockGetArtifact.mockResolvedValue({
+      mockGetManifestArtifact.mockResolvedValue({
         archiveFormat: "tar.gz",
         checksum: "manifest-checksum",
         downloadUrl: "https://example.com/custom-uv.tar.gz",
       });
 
-      await downloadVersion(
+      await downloadVersionFromManifest(
+        "https://example.com/custom.ndjson",
         "unknown-linux-gnu",
         "x86_64",
         "0.9.26",
         "",
         "token",
-        "https://example.com/custom.ndjson",
       );
 
       expect(mockValidateChecksum).toHaveBeenCalledWith(
@@ -302,19 +229,19 @@ describe("download-version", () => {
     });
 
     it("prefers checksum input over manifest-file checksum metadata", async () => {
-      mockGetArtifact.mockResolvedValue({
+      mockGetManifestArtifact.mockResolvedValue({
         archiveFormat: "tar.gz",
         checksum: "manifest-checksum",
         downloadUrl: "https://example.com/custom-uv.tar.gz",
       });
 
-      await downloadVersion(
+      await downloadVersionFromManifest(
+        "https://example.com/custom.ndjson",
         "unknown-linux-gnu",
         "x86_64",
         "0.9.26",
         "user-checksum",
         "token",
-        "https://example.com/custom.ndjson",
       );
 
       expect(mockValidateChecksum).toHaveBeenCalledWith(
@@ -326,28 +253,4 @@ describe("download-version", () => {
       );
     });
   });
-
-  describe("rewriteToMirror", () => {
-    it("rewrites a GitHub Releases URL to the Astral mirror", () => {
-      expect(
-        rewriteToMirror(
-          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
-        ),
-      ).toBe(
-        "https://releases.astral.sh/github/uv/releases/download/0.9.26/uv-x86_64-unknown-linux-gnu.tar.gz",
-      );
-    });
-
-    it("returns undefined for non-GitHub URLs", () => {
-      expect(rewriteToMirror("https://example.com/uv.tar.gz")).toBeUndefined();
-    });
-
-    it("returns undefined for a different GitHub repo", () => {
-      expect(
-        rewriteToMirror(
-          "https://github.com/other/repo/releases/download/v1.0/file.tar.gz",
-        ),
-      ).toBeUndefined();
-    });
-  });
 });

__tests__/download/manifest.test.ts

@@ -1,168 +0,0 @@
-import { beforeEach, describe, expect, it, jest } from "@jest/globals";
-
-// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
-const mockFetch = jest.fn<any>();
-
-jest.unstable_mockModule("@actions/core", () => ({
-  debug: jest.fn(),
-  info: jest.fn(),
-}));
-
-jest.unstable_mockModule("../../src/utils/fetch", () => ({
-  fetch: mockFetch,
-}));
-
-const {
-  clearManifestCache,
-  fetchManifest,
-  getAllVersions,
-  getArtifact,
-  getLatestVersion,
-  parseManifest,
-} = await import("../../src/download/manifest");
-
-const sampleManifestResponse = `{"version":"0.9.25","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.25/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"606b3c6949d971709f2526fa0d9f0fd23ccf60e09f117999b406b424af18a6a6"}]}
-{"version":"0.9.26","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f"},{"platform":"x86_64-pc-windows-msvc","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip","archive_format":"zip","sha256":"eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036"}]}`;
-
-const multiVariantManifestResponse = `{"version":"0.9.26","artifacts":[{"platform":"aarch64-apple-darwin","variant":"python-managed","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin-managed.tar.gz","archive_format":"tar.gz","sha256":"managed-checksum"},{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.zip","archive_format":"zip","sha256":"default-checksum"}]}`;
-
-function createMockResponse(
-  ok: boolean,
-  status: number,
-  statusText: string,
-  data: string,
-) {
-  return {
-    ok,
-    status,
-    statusText,
-    text: async () => data,
-  };
-}
-
-describe("manifest", () => {
-  beforeEach(() => {
-    clearManifestCache();
-    mockFetch.mockReset();
-  });
-
-  describe("fetchManifest", () => {
-    it("fetches and parses manifest data", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleManifestResponse),
-      );
-
-      const versions = await fetchManifest();
-
-      expect(versions).toHaveLength(2);
-      expect(versions[0]?.version).toBe("0.9.25");
-      expect(versions[1]?.version).toBe("0.9.26");
-    });
-
-    it("throws on a failed fetch", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(false, 500, "Internal Server Error", ""),
-      );
-
-      await expect(fetchManifest()).rejects.toThrow(
-        "Failed to fetch manifest data: 500 Internal Server Error",
-      );
-    });
-
-    it("caches results per URL", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleManifestResponse),
-      );
-
-      await fetchManifest("https://example.com/custom.ndjson");
-      await fetchManifest("https://example.com/custom.ndjson");
-
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  describe("getAllVersions", () => {
-    it("returns all version strings", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleManifestResponse),
-      );
-
-      const versions = await getAllVersions(
-        "https://example.com/custom.ndjson",
-      );
-
-      expect(versions).toEqual(["0.9.25", "0.9.26"]);
-    });
-  });
-
-  describe("getArtifact", () => {
-    beforeEach(() => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", sampleManifestResponse),
-      );
-    });
-
-    it("finds an artifact by version and platform", async () => {
-      const artifact = await getArtifact("0.9.26", "aarch64", "apple-darwin");
-
-      expect(artifact).toEqual({
-        archiveFormat: "tar.gz",
-        checksum:
-          "fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f",
-        downloadUrl:
-          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz",
-      });
-    });
-
-    it("finds a windows artifact", async () => {
-      const artifact = await getArtifact("0.9.26", "x86_64", "pc-windows-msvc");
-
-      expect(artifact).toEqual({
-        archiveFormat: "zip",
-        checksum:
-          "eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036",
-        downloadUrl:
-          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip",
-      });
-    });
-
-    it("prefers the default variant when multiple artifacts share a platform", async () => {
-      mockFetch.mockResolvedValue(
-        createMockResponse(true, 200, "OK", multiVariantManifestResponse),
-      );
-
-      const artifact = await getArtifact("0.9.26", "aarch64", "apple-darwin");
-
-      expect(artifact).toEqual({
-        archiveFormat: "zip",
-        checksum: "default-checksum",
-        downloadUrl:
-          "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.zip",
-      });
-    });
-
-    it("returns undefined for an unknown version", async () => {
-      const artifact = await getArtifact("0.0.1", "aarch64", "apple-darwin");
-
-      expect(artifact).toBeUndefined();
-    });
-
-    it("returns undefined for an unknown platform", async () => {
-      const artifact = await getArtifact(
-        "0.9.26",
-        "aarch64",
-        "unknown-linux-musl",
-      );
-
-      expect(artifact).toBeUndefined();
-    });
-  });
-
-  describe("parseManifest", () => {
-    it("throws for malformed manifest data", () => {
-      expect(() => parseManifest('{"version":"0.1.0"', "test-source")).toThrow(
-        "Failed to parse manifest data from test-source",
-      );
-    });
-  });
-});

__tests__/download/version-manifest.test.ts

@@ -0,0 +1,136 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+const mockWarning = jest.fn();
+
+jest.mock("@actions/core", () => ({
+  debug: jest.fn(),
+  info: jest.fn(),
+  warning: mockWarning,
+}));
+
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockFetch = jest.fn<any>();
+jest.mock("../../src/utils/fetch", () => ({
+  fetch: mockFetch,
+}));
+
+import {
+  clearManifestCache,
+  getAllVersions,
+  getLatestKnownVersion,
+  getManifestArtifact,
+} from "../../src/download/version-manifest";
+
+const legacyManifestResponse = JSON.stringify([
+  {
+    arch: "x86_64",
+    artifactName: "uv-x86_64-unknown-linux-gnu.tar.gz",
+    downloadUrl:
+      "https://example.com/releases/download/0.7.12-alpha.1/uv-x86_64-unknown-linux-gnu.tar.gz",
+    platform: "unknown-linux-gnu",
+    version: "0.7.12-alpha.1",
+  },
+  {
+    arch: "x86_64",
+    artifactName: "uv-x86_64-unknown-linux-gnu.tar.gz",
+    downloadUrl:
+      "https://example.com/releases/download/0.7.13/uv-x86_64-unknown-linux-gnu.tar.gz",
+    platform: "unknown-linux-gnu",
+    version: "0.7.13",
+  },
+]);
+
+const ndjsonManifestResponse = `{"version":"0.10.0","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/releases/download/0.10.0/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"checksum-100"}]}
+{"version":"0.9.30","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/releases/download/0.9.30/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"checksum-0930"}]}`;
+
+const multiVariantManifestResponse = `{"version":"0.10.0","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"managed-python","url":"https://example.com/releases/download/0.10.0/uv-x86_64-unknown-linux-gnu-managed-python.tar.gz","archive_format":"tar.gz","sha256":"checksum-managed"},{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/releases/download/0.10.0/uv-x86_64-unknown-linux-gnu-default.zip","archive_format":"zip","sha256":"checksum-default"}]}`;
+
+function createMockResponse(
+  ok: boolean,
+  status: number,
+  statusText: string,
+  data: string,
+) {
+  return {
+    ok,
+    status,
+    statusText,
+    text: async () => data,
+  };
+}
+
+describe("version-manifest", () => {
+  beforeEach(() => {
+    clearManifestCache();
+    mockFetch.mockReset();
+    mockWarning.mockReset();
+  });
+
+  it("supports the legacy JSON manifest format", async () => {
+    mockFetch.mockResolvedValue(
+      createMockResponse(true, 200, "OK", legacyManifestResponse),
+    );
+
+    const latest = await getLatestKnownVersion(
+      "https://example.com/legacy.json",
+    );
+    const artifact = await getManifestArtifact(
+      "https://example.com/legacy.json",
+      "0.7.13",
+      "x86_64",
+      "unknown-linux-gnu",
+    );
+
+    expect(latest).toBe("0.7.13");
+    expect(artifact).toEqual({
+      archiveFormat: undefined,
+      checksum: undefined,
+      downloadUrl:
+        "https://example.com/releases/download/0.7.13/uv-x86_64-unknown-linux-gnu.tar.gz",
+    });
+    expect(mockWarning).toHaveBeenCalledTimes(1);
+  });
+
+  it("supports NDJSON manifests", async () => {
+    mockFetch.mockResolvedValue(
+      createMockResponse(true, 200, "OK", ndjsonManifestResponse),
+    );
+
+    const versions = await getAllVersions("https://example.com/custom.ndjson");
+    const artifact = await getManifestArtifact(
+      "https://example.com/custom.ndjson",
+      "0.10.0",
+      "x86_64",
+      "unknown-linux-gnu",
+    );
+
+    expect(versions).toEqual(["0.10.0", "0.9.30"]);
+    expect(artifact).toEqual({
+      archiveFormat: "tar.gz",
+      checksum: "checksum-100",
+      downloadUrl:
+        "https://example.com/releases/download/0.10.0/uv-x86_64-unknown-linux-gnu.tar.gz",
+    });
+    expect(mockWarning).not.toHaveBeenCalled();
+  });
+
+  it("prefers the default variant when a manifest contains multiple variants", async () => {
+    mockFetch.mockResolvedValue(
+      createMockResponse(true, 200, "OK", multiVariantManifestResponse),
+    );
+
+    const artifact = await getManifestArtifact(
+      "https://example.com/multi-variant.ndjson",
+      "0.10.0",
+      "x86_64",
+      "unknown-linux-gnu",
+    );
+
+    expect(artifact).toEqual({
+      archiveFormat: "zip",
+      checksum: "checksum-default",
+      downloadUrl:
+        "https://example.com/releases/download/0.10.0/uv-x86_64-unknown-linux-gnu-default.zip",
+    });
+  });
+});

__tests__/download/versions-client.test.ts

@@ -0,0 +1,169 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+// biome-ignore lint/suspicious/noExplicitAny: Mock requires flexible typing in tests.
+const mockFetch = jest.fn<any>();
+jest.mock("../../src/utils/fetch", () => ({
+  fetch: mockFetch,
+}));
+
+import {
+  clearCache,
+  fetchVersionData,
+  getAllVersions,
+  getArtifact,
+  getLatestVersion,
+  parseVersionData,
+} from "../../src/download/versions-client";
+
+const sampleNdjsonResponse = `{"version":"0.9.26","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f"},{"platform":"x86_64-pc-windows-msvc","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip","archive_format":"zip","sha256":"eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036"}]}
+{"version":"0.9.25","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.25/uv-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"606b3c6949d971709f2526fa0d9f0fd23ccf60e09f117999b406b424af18a6a6"}]}`;
+
+const multiVariantNdjsonResponse = `{"version":"0.9.26","artifacts":[{"platform":"aarch64-apple-darwin","variant":"python-managed","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin-managed.tar.gz","archive_format":"tar.gz","sha256":"managed-checksum"},{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.zip","archive_format":"zip","sha256":"default-checksum"}]}`;
+
+function createMockResponse(
+  ok: boolean,
+  status: number,
+  statusText: string,
+  data: string,
+) {
+  return {
+    ok,
+    status,
+    statusText,
+    text: async () => data,
+  };
+}
+
+describe("versions-client", () => {
+  beforeEach(() => {
+    clearCache();
+    mockFetch.mockReset();
+  });
+
+  describe("fetchVersionData", () => {
+    it("should fetch and parse NDJSON data", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
+      );
+
+      const versions = await fetchVersionData();
+
+      expect(versions).toHaveLength(2);
+      expect(versions[0].version).toBe("0.9.26");
+      expect(versions[1].version).toBe("0.9.25");
+    });
+
+    it("should throw error on failed fetch", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(false, 500, "Internal Server Error", ""),
+      );
+
+      await expect(fetchVersionData()).rejects.toThrow(
+        "Failed to fetch version data: 500 Internal Server Error",
+      );
+    });
+
+    it("should cache results", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
+      );
+
+      await fetchVersionData();
+      await fetchVersionData();
+
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("getLatestVersion", () => {
+    it("should return the first version (newest)", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
+      );
+
+      const latest = await getLatestVersion();
+
+      expect(latest).toBe("0.9.26");
+    });
+  });
+
+  describe("getAllVersions", () => {
+    it("should return all version strings", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
+      );
+
+      const versions = await getAllVersions();
+
+      expect(versions).toEqual(["0.9.26", "0.9.25"]);
+    });
+  });
+
+  describe("getArtifact", () => {
+    beforeEach(() => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", sampleNdjsonResponse),
+      );
+    });
+
+    it("should find artifact by version and platform", async () => {
+      const artifact = await getArtifact("0.9.26", "aarch64", "apple-darwin");
+
+      expect(artifact).toEqual({
+        archiveFormat: "tar.gz",
+        sha256:
+          "fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f",
+        url: "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz",
+      });
+    });
+
+    it("should find windows artifact", async () => {
+      const artifact = await getArtifact("0.9.26", "x86_64", "pc-windows-msvc");
+
+      expect(artifact).toEqual({
+        archiveFormat: "zip",
+        sha256:
+          "eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036",
+        url: "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-x86_64-pc-windows-msvc.zip",
+      });
+    });
+
+    it("should prefer the default variant when multiple artifacts share a platform", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(true, 200, "OK", multiVariantNdjsonResponse),
+      );
+
+      const artifact = await getArtifact("0.9.26", "aarch64", "apple-darwin");
+
+      expect(artifact).toEqual({
+        archiveFormat: "zip",
+        sha256: "default-checksum",
+        url: "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.zip",
+      });
+    });
+
+    it("should return undefined for unknown version", async () => {
+      const artifact = await getArtifact("0.0.1", "aarch64", "apple-darwin");
+
+      expect(artifact).toBeUndefined();
+    });
+
+    it("should return undefined for unknown platform", async () => {
+      const artifact = await getArtifact(
+        "0.9.26",
+        "aarch64",
+        "unknown-linux-musl",
+      );
+
+      expect(artifact).toBeUndefined();
+    });
+  });
+
+  describe("parseVersionData", () => {
+    it("should throw for malformed NDJSON", () => {
+      expect(() =>
+        parseVersionData('{"version":"0.1.0"', "test-source"),
+      ).toThrow("Failed to parse version data from test-source");
+    });
+  });
+});

__tests__/utils/inputs.test.ts

@@ -1,3 +1,14 @@
+jest.mock("@actions/core", () => {
+  return {
+    debug: jest.fn(),
+    getBooleanInput: jest.fn(
+      (name: string) => (mockInputs[name] ?? "") === "true",
+    ),
+    getInput: jest.fn((name: string) => mockInputs[name] ?? ""),
+    warning: jest.fn(),
+  };
+});
+
 import {
   afterEach,
   beforeEach,
@@ -11,26 +22,6 @@ import {
 let mockInputs: Record<string, string> = {};
 const ORIGINAL_HOME = process.env.HOME;
 
-const mockDebug = jest.fn();
-const mockGetBooleanInput = jest.fn(
-  (name: string) => (mockInputs[name] ?? "") === "true",
-);
-const mockGetInput = jest.fn((name: string) => mockInputs[name] ?? "");
-const mockInfo = jest.fn();
-const mockWarning = jest.fn();
-
-jest.unstable_mockModule("@actions/core", () => ({
-  debug: mockDebug,
-  getBooleanInput: mockGetBooleanInput,
-  getInput: mockGetInput,
-  info: mockInfo,
-  warning: mockWarning,
-}));
-
-async function importInputsModule() {
-  return await import("../../src/utils/inputs");
-}
-
 describe("cacheDependencyGlob", () => {
   beforeEach(() => {
     jest.resetModules();
@@ -45,21 +36,21 @@ describe("cacheDependencyGlob", () => {
 
   it("returns empty string when input not provided", async () => {
     mockInputs["working-directory"] = "/workspace";
-    const { cacheDependencyGlob } = await importInputsModule();
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
     expect(cacheDependencyGlob).toBe("");
   });
 
   it("resolves a single relative path", async () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["cache-dependency-glob"] = "requirements.txt";
-    const { cacheDependencyGlob } = await importInputsModule();
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
     expect(cacheDependencyGlob).toBe("/workspace/requirements.txt");
   });
 
   it("strips leading ./ from relative path", async () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["cache-dependency-glob"] = "./uv.lock";
-    const { cacheDependencyGlob } = await importInputsModule();
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
     expect(cacheDependencyGlob).toBe("/workspace/uv.lock");
   });
 
@@ -67,7 +58,7 @@ describe("cacheDependencyGlob", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["cache-dependency-glob"] =
       "  ~/.cache/file1\n ./rel/file2  \nfile3.txt";
-    const { cacheDependencyGlob } = await importInputsModule();
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
     expect(cacheDependencyGlob).toBe(
       [
         "/home/testuser/.cache/file1", // expanded tilde, absolute path unchanged
@@ -80,7 +71,7 @@ describe("cacheDependencyGlob", () => {
   it("keeps absolute path unchanged in multiline input", async () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["cache-dependency-glob"] = "/abs/path.lock\nrelative.lock";
-    const { cacheDependencyGlob } = await importInputsModule();
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
     expect(cacheDependencyGlob).toBe(
       ["/abs/path.lock", "/workspace/relative.lock"].join("\n"),
     );
@@ -89,7 +80,7 @@ describe("cacheDependencyGlob", () => {
   it("handles exclusions in relative paths correct", async () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["cache-dependency-glob"] = "!/abs/path.lock\n!relative.lock";
-    const { cacheDependencyGlob } = await importInputsModule();
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
     expect(cacheDependencyGlob).toBe(
       ["!/abs/path.lock", "!/workspace/relative.lock"].join("\n"),
     );
@@ -113,7 +104,7 @@ describe("tool directories", () => {
     mockInputs["tool-bin-dir"] = "~/tool-bin-dir";
     mockInputs["tool-dir"] = "~/tool-dir";
 
-    const { toolBinDir, toolDir } = await importInputsModule();
+    const { toolBinDir, toolDir } = await import("../../src/utils/inputs");
 
     expect(toolBinDir).toBe("/home/testuser/tool-bin-dir");
     expect(toolDir).toBe("/home/testuser/tool-dir");
@@ -136,7 +127,9 @@ describe("cacheLocalPath", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["cache-local-path"] = "~/uv-cache/cache-local-path";
 
-    const { CacheLocalSource, cacheLocalPath } = await importInputsModule();
+    const { CacheLocalSource, cacheLocalPath } = await import(
+      "../../src/utils/inputs"
+    );
 
     expect(cacheLocalPath).toEqual({
       path: "/home/testuser/uv-cache/cache-local-path",
@@ -159,7 +152,7 @@ describe("venvPath", () => {
 
   it("defaults to .venv in the working directory", async () => {
     mockInputs["working-directory"] = "/workspace";
-    const { venvPath } = await importInputsModule();
+    const { venvPath } = await import("../../src/utils/inputs");
     expect(venvPath).toBe("/workspace/.venv");
   });
 
@@ -167,7 +160,7 @@ describe("venvPath", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["activate-environment"] = "true";
     mockInputs["venv-path"] = "custom-venv";
-    const { venvPath } = await importInputsModule();
+    const { venvPath } = await import("../../src/utils/inputs");
     expect(venvPath).toBe("/workspace/custom-venv");
   });
 
@@ -175,7 +168,7 @@ describe("venvPath", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["activate-environment"] = "true";
     mockInputs["venv-path"] = "custom-venv/";
-    const { venvPath } = await importInputsModule();
+    const { venvPath } = await import("../../src/utils/inputs");
     expect(venvPath).toBe("/workspace/custom-venv");
   });
 
@@ -183,7 +176,7 @@ describe("venvPath", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["activate-environment"] = "true";
     mockInputs["venv-path"] = "/tmp/custom-venv";
-    const { venvPath } = await importInputsModule();
+    const { venvPath } = await import("../../src/utils/inputs");
     expect(venvPath).toBe("/tmp/custom-venv");
   });
 
@@ -191,7 +184,7 @@ describe("venvPath", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["activate-environment"] = "true";
     mockInputs["venv-path"] = "~/.venv";
-    const { venvPath } = await importInputsModule();
+    const { venvPath } = await import("../../src/utils/inputs");
     expect(venvPath).toBe("/home/testuser/.venv");
   });
 
@@ -199,11 +192,18 @@ describe("venvPath", () => {
     mockInputs["working-directory"] = "/workspace";
     mockInputs["venv-path"] = "custom-venv";
 
-    const { activateEnvironment, venvPath } = await importInputsModule();
+    const { activateEnvironment, venvPath } = await import(
+      "../../src/utils/inputs"
+    );
 
     expect(activateEnvironment).toBe(false);
     expect(venvPath).toBe("/workspace/custom-venv");
-    expect(mockWarning).toHaveBeenCalledWith(
+
+    const mockedCore = jest.requireMock("@actions/core") as {
+      warning: jest.Mock;
+    };
+
+    expect(mockedCore.warning).toHaveBeenCalledWith(
       "venv-path is only used when activate-environment is true",
     );
   });

__tests__/version/tool-versions-file.test.ts

@@ -1,121 +1,113 @@
+jest.mock("node:fs");
+jest.mock("@actions/core", () => ({
+  warning: jest.fn(),
+}));
+
+import fs from "node:fs";
+import * as core from "@actions/core";
 import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { getUvVersionFromToolVersions } from "../../src/version/tool-versions-file";
 
-const mockReadFileSync = jest.fn();
+const mockedFs = fs as jest.Mocked<typeof fs>;
-const mockWarning = jest.fn();
+const mockedCore = core as jest.Mocked<typeof core>;
-
-jest.unstable_mockModule("node:fs", () => ({
-  default: {
-    readFileSync: mockReadFileSync,
-  },
-}));
-
-jest.unstable_mockModule("@actions/core", () => ({
-  warning: mockWarning,
-}));
-
-async function getVersionFromToolVersions(filePath: string) {
-  const { getUvVersionFromToolVersions } = await import(
-    "../../src/version/tool-versions-file"
-  );
-
-  return getUvVersionFromToolVersions(filePath);
-}
 
 describe("getUvVersionFromToolVersions", () => {
   beforeEach(() => {
-    jest.resetModules();
     jest.clearAllMocks();
   });
 
-  it("should return undefined for non-.tool-versions files", async () => {
+  it("should return undefined for non-.tool-versions files", () => {
-    const result = await getVersionFromToolVersions("package.json");
+    const result = getUvVersionFromToolVersions("package.json");
     expect(result).toBeUndefined();
-    expect(mockReadFileSync).not.toHaveBeenCalled();
+    expect(mockedFs.readFileSync).not.toHaveBeenCalled();
   });
 
-  it("should return version for valid uv entry", async () => {
+  it("should return version for valid uv entry", () => {
     const fileContent = "python 3.11.0\nuv 0.1.0\nnodejs 18.0.0";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.1.0");
-    expect(mockReadFileSync).toHaveBeenCalledWith(".tool-versions", "utf8");
+    expect(mockedFs.readFileSync).toHaveBeenCalledWith(
+      ".tool-versions",
+      "utf8",
+    );
   });
 
-  it("should return version for uv entry with v prefix", async () => {
+  it("should return version for uv entry with v prefix", () => {
     const fileContent = "uv v0.2.0";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.2.0");
   });
 
-  it("should handle whitespace around uv entry", async () => {
+  it("should handle whitespace around uv entry", () => {
     const fileContent = "  uv   0.3.0  ";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.3.0");
   });
 
-  it("should skip commented lines", async () => {
+  it("should skip commented lines", () => {
     const fileContent = "# uv 0.1.0\npython 3.11.0\nuv 0.2.0";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.2.0");
   });
 
-  it("should return first matching uv version", async () => {
+  it("should return first matching uv version", () => {
     const fileContent = "uv 0.1.0\npython 3.11.0\nuv 0.2.0";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBe("0.1.0");
   });
 
-  it("should return undefined when no uv entry found", async () => {
+  it("should return undefined when no uv entry found", () => {
     const fileContent = "python 3.11.0\nnodejs 18.0.0";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBeUndefined();
   });
 
-  it("should return undefined for empty file", async () => {
+  it("should return undefined for empty file", () => {
-    mockReadFileSync.mockReturnValue("");
+    mockedFs.readFileSync.mockReturnValue("");
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBeUndefined();
   });
 
-  it("should warn and return undefined for ref syntax", async () => {
+  it("should warn and return undefined for ref syntax", () => {
     const fileContent = "uv ref:main";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions(".tool-versions");
+    const result = getUvVersionFromToolVersions(".tool-versions");
 
     expect(result).toBeUndefined();
-    expect(mockWarning).toHaveBeenCalledWith(
+    expect(mockedCore.warning).toHaveBeenCalledWith(
       "The ref syntax of .tool-versions is not supported. Please use a released version instead.",
     );
   });
 
-  it("should handle file path with .tool-versions extension", async () => {
+  it("should handle file path with .tool-versions extension", () => {
     const fileContent = "uv 0.1.0";
-    mockReadFileSync.mockReturnValue(fileContent);
+    mockedFs.readFileSync.mockReturnValue(fileContent);
 
-    const result = await getVersionFromToolVersions("path/to/.tool-versions");
+    const result = getUvVersionFromToolVersions("path/to/.tool-versions");
 
     expect(result).toBe("0.1.0");
-    expect(mockReadFileSync).toHaveBeenCalledWith(
+    expect(mockedFs.readFileSync).toHaveBeenCalledWith(
       "path/to/.tool-versions",
       "utf8",
     );

action.yml

@@ -75,7 +75,7 @@ inputs:
     description: "Custom path to set UV_TOOL_BIN_DIR to."
     required: false
   manifest-file:
-    description: "URL to a custom manifest file in the astral-sh/versions format."
+    description: "URL to a custom manifest file. Supports the astral-sh/versions NDJSON format and the legacy JSON array format (deprecated)."
     required: false
   add-problem-matchers:
     description: "Add problem matchers."
@@ -102,8 +102,8 @@ outputs:
     description: "A boolean value to indicate the Python cache entry was found"
 runs:
   using: "node24"
-  main: "dist/setup/index.cjs"
+  main: "dist/setup/index.js"
-  post: "dist/save-cache/index.cjs"
+  post: "dist/save-cache/index.js"
   post-if: success()
 branding:
   icon: "package"

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.7/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.3.7/schema.json",
   "assist": {
     "actions": {
       "source": {

docs/customization.md

@@ -19,14 +19,14 @@ are automatically verified by this action. The sha256 hashes can be found on the
 ## Manifest file
 
 By default, setup-uv reads version metadata from
-[`astral-sh/versions`](https://github.com/astral-sh/versions).
+[`astral-sh/versions`](https://github.com/astral-sh/versions) (NDJSON format).
 
 The `manifest-file` input lets you override that source with your own URL, for example to test
 custom uv builds or alternate download locations.
 
 ### Format
 
-The manifest file must use the same format as `astral-sh/versions`: one JSON object per line, where each object represents a version and its artifacts. The versions must be sorted in descending order. For example:
+The manifest file must be in NDJSON format, where each line is a JSON object representing a version and its artifacts. For example:
 
 ```json
 {"version":"0.10.7","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}
@@ -37,6 +37,23 @@ setup-uv currently only supports `default` as the `variant`.
 
 The `archive_format` field is currently ignored.
 
+### Legacy format: JSON array (deprecated)
+
+The previous JSON array format is still supported for compatibility, but deprecated and will be
+removed in a future major release.
+
+```json
+[
+  {
+    "version": "0.7.13",
+    "artifactName": "uv-aarch64-apple-darwin.tar.gz",
+    "arch": "aarch64",
+    "platform": "apple-darwin",
+    "downloadUrl": "https://github.com/astral-sh/uv/releases/download/0.7.13/uv-aarch64-apple-darwin.tar.gz"
+  }
+]
+```
+
 ```yaml
 - name: Use a custom manifest file
   uses: astral-sh/setup-uv@v7

jest.config.js

@@ -0,0 +1,9 @@
+module.exports = {
+  clearMocks: true,
+  moduleFileExtensions: ["js", "ts"],
+  testMatch: ["**/*.test.ts"],
+  transform: {
+    "^.+\\.ts$": "ts-jest",
+  },
+  verbose: true,
+};

jest.config.mjs

@@ -1,14 +0,0 @@
-import { createDefaultEsmPreset } from "ts-jest";
-
-const esmPreset = createDefaultEsmPreset({
-  tsconfig: "./tsconfig.json",
-});
-
-export default {
-  ...esmPreset,
-  clearMocks: true,
-  moduleFileExtensions: ["js", "mjs", "ts"],
-  testEnvironment: "node",
-  testMatch: ["**/*.test.ts"],
-  verbose: true,
-};

package.json

@@ -2,18 +2,16 @@
   "name": "setup-uv",
   "version": "1.0.0",
   "private": true,
-  "type": "module",
   "description": "Set up your GitHub Actions workflow with a specific version of uv",
-  "main": "dist/setup/index.cjs",
+  "main": "dist/index.js",
   "scripts": {
-    "build": "tsc --noEmit",
+    "build": "tsc",
     "check": "biome check --write",
-    "package": "node scripts/build-dist.mjs",
+    "package": "ncc build -o dist/setup src/setup-uv.ts && ncc build -o dist/save-cache src/save-cache.ts && ncc build -o dist/update-known-checksums src/update-known-checksums.ts",
-    "test:unit": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js",
+    "test": "jest",
-    "test": "npm run build && npm run test:unit",
     "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
-    "update-known-checksums": "RUNNER_TEMP=known_versions node dist/update-known-checksums/index.cjs src/download/checksum/known-checksums.ts",
+    "update-known-checksums": "RUNNER_TEMP=known_versions node dist/update-known-checksums/index.js src/download/checksum/known-checksums.ts",
-    "all": "npm run build && npm run check && npm run package && npm run test:unit"
+    "all": "npm run build && npm run check && npm run package && npm test"
   },
   "repository": {
     "type": "git",
@@ -28,26 +26,25 @@
   "author": "@eifinger",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^6.0.0",
+    "@actions/cache": "^4.1.0",
-    "@actions/core": "^3.0.0",
+    "@actions/core": "^1.11.1",
-    "@actions/exec": "^3.0.0",
+    "@actions/exec": "^1.1.1",
-    "@actions/glob": "^0.6.1",
+    "@actions/glob": "^0.5.0",
-    "@actions/io": "^3.0.2",
+    "@actions/io": "^1.1.3",
-    "@actions/tool-cache": "^4.0.0",
+    "@actions/tool-cache": "^2.0.2",
-    "@renovatebot/pep440": "^4.2.2",
+    "@renovatebot/pep440": "^4.2.1",
     "smol-toml": "^1.6.0",
-    "undici": "^7.24.2"
+    "undici": "5.28.5"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.7",
+    "@biomejs/biome": "2.3.8",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.5.0",
+    "@types/node": "^24.10.1",
     "@types/semver": "^7.7.1",
     "@vercel/ncc": "^0.38.4",
-    "esbuild": "^0.27.4",
+    "jest": "^30.2.0",
-    "jest": "^30.3.0",
+    "js-yaml": "^4.1.0",
-    "js-yaml": "^4.1.1",
+    "ts-jest": "^29.4.5",
-    "ts-jest": "^29.4.6",
     "typescript": "^5.9.3"
   }
 }

scripts/build-dist.mjs

@@ -1,33 +0,0 @@
-import { rm } from "node:fs/promises";
-import { build } from "esbuild";
-
-const builds = [
-  {
-    entryPoints: ["src/setup-uv.ts"],
-    outfile: "dist/setup/index.cjs",
-    staleOutfiles: ["dist/setup/index.mjs"],
-  },
-  {
-    entryPoints: ["src/save-cache.ts"],
-    outfile: "dist/save-cache/index.cjs",
-    staleOutfiles: ["dist/save-cache/index.mjs"],
-  },
-  {
-    entryPoints: ["src/update-known-checksums.ts"],
-    outfile: "dist/update-known-checksums/index.cjs",
-    staleOutfiles: ["dist/update-known-checksums/index.mjs"],
-  },
-];
-
-for (const { staleOutfiles, ...options } of builds) {
-  await Promise.all(
-    staleOutfiles.map((outfile) => rm(outfile, { force: true })),
-  );
-  await build({
-    bundle: true,
-    format: "cjs",
-    platform: "node",
-    target: "node24",
-    ...options,
-  });
-}

src/download/checksum/known-checksums.ts

@@ -1,177 +1,5 @@
 // AUTOGENERATED_DO_NOT_EDIT
 export const KNOWN_CHECKSUMS: { [key: string]: string } = {
-  "aarch64-apple-darwin-0.11.1":
-    "f7815f739ed5d0e4202e6292acedb8659b9ae7de663d07188d8c6cbd7f96303f",
-  "aarch64-pc-windows-msvc-0.11.1":
-    "b789db0c1504dd3b02c090bd5783487497cc46cc2eb71754874cdd1ef59eb52a",
-  "aarch64-unknown-linux-gnu-0.11.1":
-    "1340e62da1ee3c1109764340e1247e8a1a232c30dde4a0f0548976dcaa90f06d",
-  "aarch64-unknown-linux-musl-0.11.1":
-    "bd04ffce77ee8d77f39823c13606183581847c2f5dcd704f2ea0f15e376b1a27",
-  "arm-unknown-linux-musleabihf-0.11.1":
-    "625c0e756e2374fce864ceaa6beedd5821e276e2b6307f2b719f2d62b449b89c",
-  "armv7-unknown-linux-gnueabihf-0.11.1":
-    "baf8daaab20b0502d1853dbfd916afb0762c024ae7f0df1c2deb2a1a1c1c3467",
-  "armv7-unknown-linux-musleabihf-0.11.1":
-    "684c25b74e83bcb1b177152379cfe2c974ba731aa5af278e1d161e41709f8bcf",
-  "i686-pc-windows-msvc-0.11.1":
-    "3c07858a08c54e4e5753239354c7b07ae69071b2b6f5aa2cc970e612adcb4740",
-  "i686-unknown-linux-gnu-0.11.1":
-    "6e83167c05708570563b10b6cc7e8c289daef5f51fde0b152e41af2a7ef70813",
-  "i686-unknown-linux-musl-0.11.1":
-    "b0d5152635c257fec76f95cb9268112b47ff70bd33a23866295a4f2ed9f46b7f",
-  "powerpc64le-unknown-linux-gnu-0.11.1":
-    "e42d2abfac46f57564789e2bfa6dbea4ae3135892e36ae066ba0ae77b69bb676",
-  "riscv64gc-unknown-linux-gnu-0.11.1":
-    "5e2c757b35dab015ad37f74ee3e060208390b5f4defb6684876f1be0664f3f6e",
-  "riscv64gc-unknown-linux-musl-0.11.1":
-    "6f590a824aed363cbec4079f7ddab87b5685119e0f5f0e71cd114c7b7c326199",
-  "s390x-unknown-linux-gnu-0.11.1":
-    "4208173c74e29572b799178709b5ed5828b24888659f944a4b47c0aaf78b42d2",
-  "x86_64-apple-darwin-0.11.1":
-    "2103670e8e949605e51926c7b953923ff6f6befbfb55aee928f5e760c9c910f8",
-  "x86_64-pc-windows-msvc-0.11.1":
-    "6659250cebbd3bb6ee48bcb21a3f0c6656450d63fb97f0f069bcb532bdb688ed",
-  "x86_64-unknown-linux-gnu-0.11.1":
-    "7c0c8069053e6e99e5911ff32b916be571f3419cd8e11bd28fb7da2c7dcaa553",
-  "x86_64-unknown-linux-musl-0.11.1":
-    "4e949471a95b37088a1ff1a585f69abed4d3cd3f921f50709a46b6ba62986d38",
-  "aarch64-apple-darwin-0.11.0":
-    "0c0f32c6a3473c5928aff96c3233715edfc79290e892f255cac93710cde7b91a",
-  "aarch64-pc-windows-msvc-0.11.0":
-    "95419e04a3ef5f13fb2a06bd6d787ba80a9d8981d6f097780e5a979817a2879d",
-  "aarch64-unknown-linux-gnu-0.11.0":
-    "8e179ca110343a17f801444ff9ef117dba56ef5fc9f6a4c9bb77b318ddba5f24",
-  "aarch64-unknown-linux-musl-0.11.0":
-    "658be4b8ec905635f1295468d4d5120d9e1ab1722eec9a104473ce993590babe",
-  "arm-unknown-linux-musleabihf-0.11.0":
-    "bfdcbd5fa41c8a9877a72c2b55a95da2bc79933885ef56c699b65bb2ed9cea91",
-  "armv7-unknown-linux-gnueabihf-0.11.0":
-    "0cad4e1b6769e48aa1e80cf639ddcc7c1bfe9ed017e95868fed185a8d818c949",
-  "armv7-unknown-linux-musleabihf-0.11.0":
-    "2aa9da83c6c0cf8a06bc9df14d51056284fa067ef5390b4db79998ff12f3bee7",
-  "i686-pc-windows-msvc-0.11.0":
-    "3b09d70e686087e096dbd8a2af21b922a2cac7d613dc053c3281c3ddbb961961",
-  "i686-unknown-linux-gnu-0.11.0":
-    "59928a0267501c20d9f9942f5f1d81a991ec55e29a19e002ae3d5c178c674c89",
-  "i686-unknown-linux-musl-0.11.0":
-    "1f438d6f6f851f0dabad3307ce7fd46541ecc5c42ebb664f382eb6c9a424a67d",
-  "powerpc64le-unknown-linux-gnu-0.11.0":
-    "29f17fb43595492b1a36cda57df7adad74183132df32799d32897268ff4e26dd",
-  "riscv64gc-unknown-linux-gnu-0.11.0":
-    "84ef37dda1003c5b65fa6c8f84242d35a7fcc84cc5ea9490d702edc36cad1f67",
-  "s390x-unknown-linux-gnu-0.11.0":
-    "b25be62f3b642348a2fece5c658624586661b8d1103891ab6903768b0529edc4",
-  "x86_64-apple-darwin-0.11.0":
-    "31aaec764166af8885cf99321fd6ed24fef80225a6f26ed1ae8ce04111688a7e",
-  "x86_64-pc-windows-msvc-0.11.0":
-    "e21d00b172df83531564a95e75a2bdc0c59b471dbb3515f0c1b4d6ef657dc451",
-  "x86_64-unknown-linux-gnu-0.11.0":
-    "cc0fbb42b3642125f600a55b0b095bea65cddaadb94c6ea2b6ba5d79c5825089",
-  "x86_64-unknown-linux-musl-0.11.0":
-    "bf6b0757c73d1726faa2a819b155d4d864919a95766720215d78fdcd09d42d26",
-  "aarch64-apple-darwin-0.10.12":
-    "ae738b5661a900579ec621d3918c0ef17bdec0da2a8a6d8b161137cd15f25414",
-  "aarch64-pc-windows-msvc-0.10.12":
-    "e79881e2c4f98a0f3a37b8770bf224e8fee70f6dcf8fc17055d8291bb1b0b867",
-  "aarch64-unknown-linux-gnu-0.10.12":
-    "0ed7d20f49f6b9b60d45fdfcac28f3ac01a671a6ef08672401ed2833423fea2a",
-  "aarch64-unknown-linux-musl-0.10.12":
-    "55bd1c1c10ec8b95a8c184f5e18b566703c6ab105f0fc118aaa4d748aabf28e4",
-  "arm-unknown-linux-musleabihf-0.10.12":
-    "9714e5059b05110a1c7ddbc18c971c13e0260e10551b7b77d82cbf907a4ebd9b",
-  "armv7-unknown-linux-gnueabihf-0.10.12":
-    "eaa02f36d5112029601b18ac3d1a0c03a83bb20cb4154c2f5345f777fa6c4101",
-  "armv7-unknown-linux-musleabihf-0.10.12":
-    "bd735652298c6e62cdd2ac939babe176a3356613e6803baa33d0bc10e8d9e4ed",
-  "i686-pc-windows-msvc-0.10.12":
-    "2312e75b9c77befdc1bff30da18f16df03083452852952553bee91da362c1a1d",
-  "i686-unknown-linux-gnu-0.10.12":
-    "8501844b34e3a28cfbba5a4b857eebd696d952e0bb4160357451ad80f3f49db8",
-  "i686-unknown-linux-musl-0.10.12":
-    "56cad78abcf5b710d2f7b9f774fcfd6bbed340d2aa9d9fc9e3b515542ec5e953",
-  "powerpc64le-unknown-linux-gnu-0.10.12":
-    "3c8017d9112221c83f43e8a15a58099663c0b2bdeabc8b43bb800413dfa21218",
-  "riscv64gc-unknown-linux-gnu-0.10.12":
-    "b1ca482b6b5dd7bf6ab733a3695cb0ab5b8e992ca96527efae93aa78fcc52a9b",
-  "s390x-unknown-linux-gnu-0.10.12":
-    "e1a0345eefe6fd3300948cd6f18aab092f9b88a243782113e645ce96530a6693",
-  "x86_64-apple-darwin-0.10.12":
-    "17443e293f2ae407bb2d8d34b875ebfe0ae01cf1296de5647e69e7b2e2b428f0",
-  "x86_64-pc-windows-msvc-0.10.12":
-    "4c1d55501869b3330d4aabf45ad6024ce2367e0f3af83344395702d272c22e88",
-  "x86_64-unknown-linux-gnu-0.10.12":
-    "ec72570c9d1f33021aa80b176d7baba390de2cfeb1abcbefca346d563bf17484",
-  "x86_64-unknown-linux-musl-0.10.12":
-    "adccf40b5d1939a5e0093081ec2307ea24235adf7c2d96b122c561fa37711c46",
-  "aarch64-apple-darwin-0.10.11":
-    "437a7d498dd6564d5bf986074249ba1fc600e73da55ae04d7bd4c24d5f149b95",
-  "aarch64-pc-windows-msvc-0.10.11":
-    "6a3eec4105c775dd87c11ef8ec41564648273751ff807c8955c24ddbcc636d03",
-  "aarch64-unknown-linux-gnu-0.10.11":
-    "23003df007937dd607409c8ddf010baa82bad2673e60e254632ca5b04edcce13",
-  "aarch64-unknown-linux-musl-0.10.11":
-    "5d80a7f6343d2676dfde1e5126582070a2bbc62df6f60d5527a169be3788532a",
-  "arm-unknown-linux-musleabihf-0.10.11":
-    "d3c248497c450d22a39c1d43a4a358c0c852e6056f5f49be96495eea41afb96c",
-  "armv7-unknown-linux-gnueabihf-0.10.11":
-    "7895a6470dfba051af4e74253599482fc0b37141b5d229956b383365e1a22902",
-  "armv7-unknown-linux-musleabihf-0.10.11":
-    "d2880c08acfdaef0985488972c8b14969f7139c27545046e2f6202f0e0f4d9d8",
-  "i686-pc-windows-msvc-0.10.11":
-    "c17f3dc3b2c47490057f17a1f0c37270f11a7b7cedf9bf2c0f841ce02bc7001b",
-  "i686-unknown-linux-gnu-0.10.11":
-    "1ab69ff7dd104a902731758ee05b782dfd9bdb263384e61650de638f33f586df",
-  "i686-unknown-linux-musl-0.10.11":
-    "cffb80d303fc1655e259d0b769c489f452e97425a6b6d3393d766413783a1d8c",
-  "powerpc64le-unknown-linux-gnu-0.10.11":
-    "ddc6a20670e60219e947b1b04813be80d7e9f4c4a0234231c8ed9298eec04aa6",
-  "riscv64gc-unknown-linux-gnu-0.10.11":
-    "c0719473cf5f8b475e917b8dfef6ae5d876b86a00a82ef91e47a02f561399f4f",
-  "s390x-unknown-linux-gnu-0.10.11":
-    "305ee734c585918515a22fe43b7cf253c38d468771373a0c02364d67498e07b2",
-  "x86_64-apple-darwin-0.10.11":
-    "ff90020b554cf02ef8008535c9aab6ef27bb7be6b075359300dec79c361df897",
-  "x86_64-pc-windows-msvc-0.10.11":
-    "9ee74df98582f37fdd6069e1caac80d2616f9a489f5dbb2b1c152f30be69c58e",
-  "x86_64-unknown-linux-gnu-0.10.11":
-    "5a360b0de092ddf4131f5313d0411b48c4e95e8107e40c3f8f2e9fcb636b3583",
-  "x86_64-unknown-linux-musl-0.10.11":
-    "d78246139dc6cf3ed6d03c84da762686bced7ad1de67977ee372a45b95a1f6d0",
-  "aarch64-apple-darwin-0.10.10":
-    "8a09f0ef51ee7f7170731b4cb8bde5bf9ba6da5304f49a7df6cdab42a1f37b5d",
-  "aarch64-pc-windows-msvc-0.10.10":
-    "2c6fe113f14574bc27f085751c68d3485589fcc3c3c64ed85dd1eecc2f87cffc",
-  "aarch64-unknown-linux-gnu-0.10.10":
-    "2b80457b950deda12e8d5dc3b9b7494ac143eae47f1fb11b1c6e5a8495a6421e",
-  "aarch64-unknown-linux-musl-0.10.10":
-    "d08c08b82cdcaf2bd3d928ffe844d3558dda53f90066db6ef9174157cc763252",
-  "arm-unknown-linux-musleabihf-0.10.10":
-    "ccc3c4dd5eeea4b2be829ef9bc0b8d9882389c0f303f7ec5ba668065d57e2673",
-  "armv7-unknown-linux-gnueabihf-0.10.10":
-    "032786622b52f8d0232b5ad16e25342a64f9e43576652db7bf607231021902f3",
-  "armv7-unknown-linux-musleabihf-0.10.10":
-    "f6f67b190eb28b473917c97210f89fd11d9b9393d774acd093ea738fcee68864",
-  "i686-pc-windows-msvc-0.10.10":
-    "980d7ea368cc4883f572bb85c285a647eddfc23539064d2bfaf8fbfefcc2112b",
-  "i686-unknown-linux-gnu-0.10.10":
-    "5260fbef838f8cfec44697064a5cfae08a27c6ab7ed7feab7fc946827e896952",
-  "i686-unknown-linux-musl-0.10.10":
-    "a6683ade964f8d8623098ca0c96b4311d8388b44a56a386cd795974f39fb5bd2",
-  "powerpc64le-unknown-linux-gnu-0.10.10":
-    "78939dc4fc905aca8af4be19b6c6ecc306f04c6ca9f98d144372595d9397fd0d",
-  "riscv64gc-unknown-linux-gnu-0.10.10":
-    "5eff670bf80fce9d9e50df5b4d46c415a9c0324eadf7059d97c76f89ffc33c3f",
-  "s390x-unknown-linux-gnu-0.10.10":
-    "a32d2be5600f7f42f82596ffe9d3115f020974ca7fb4f15251c5625c5481ea5e",
-  "x86_64-apple-darwin-0.10.10":
-    "dd18420591d625f9b4ca2b57a7a6fe3cce43910f02e02d90e47a4101428de14a",
-  "x86_64-pc-windows-msvc-0.10.10":
-    "d31a30f1dfb96e630a08d5a9b3f3f551254b7ed6e9b7e495f46a4232661c7252",
-  "x86_64-unknown-linux-gnu-0.10.10":
-    "3e1027f26ce8c7e4c32e2277a7fed2cb410f2f1f9320d3df97653d40e21f415b",
-  "x86_64-unknown-linux-musl-0.10.10":
-    "74544e8755fbc27559e22e29fd561bdc48f91b8bd8323e760a1130f32433bea4",
   "aarch64-apple-darwin-0.10.9":
     "a92f61e9ac9b0f29668c15f56152e4a60143fca148ff5bfadb86718472c3f376",
   "aarch64-pc-windows-msvc-0.10.9":

src/download/download-version.ts

@@ -4,15 +4,19 @@ import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
 import * as pep440 from "@renovatebot/pep440";
 import * as semver from "semver";
-import {
+import { TOOL_CACHE_NAME, VERSIONS_NDJSON_URL } from "../utils/constants";
-  ASTRAL_MIRROR_PREFIX,
-  GITHUB_RELEASES_PREFIX,
-  TOOL_CACHE_NAME,
-  VERSIONS_MANIFEST_URL,
-} from "../utils/constants";
 import type { Architecture, Platform } from "../utils/platforms";
 import { validateChecksum } from "./checksum/checksum";
-import { getAllVersions, getArtifact, getLatestVersion } from "./manifest";
+import {
+  getAllVersions as getAllManifestVersions,
+  getLatestKnownVersion as getLatestVersionInManifest,
+  getManifestArtifact,
+} from "./version-manifest";
+import {
+  getAllVersions as getAllVersionsFromNdjson,
+  getArtifact as getArtifactFromNdjson,
+  getLatestVersion as getLatestVersionFromNdjson,
+} from "./versions-client";
 
 export function tryGetFromToolCache(
   arch: Architecture,
@@ -29,85 +33,73 @@ export function tryGetFromToolCache(
   return { installedPath, version: resolvedVersion };
 }
 
-export async function downloadVersion(
+export async function downloadVersionFromNdjson(
   platform: Platform,
   arch: Architecture,
   version: string,
   checkSum: string | undefined,
   githubToken: string,
-  manifestUrl?: string,
 ): Promise<{ version: string; cachedToolDir: string }> {
-  const artifact = await getArtifact(version, arch, platform, manifestUrl);
+  const artifact = await getArtifactFromNdjson(version, arch, platform);
 
   if (!artifact) {
     throw new Error(
-      getMissingArtifactMessage(version, arch, platform, manifestUrl),
+      `Could not find artifact for version ${version}, arch ${arch}, platform ${platform} in ${VERSIONS_NDJSON_URL} .`,
     );
   }
 
   // For the default astral-sh/versions source, checksum validation relies on
-  // user input or the built-in KNOWN_CHECKSUMS table, not manifest sha256 values.
+  // user input or the built-in KNOWN_CHECKSUMS table, not NDJSON sha256 values.
-  const checksum =
+  return await downloadVersion(
-    manifestUrl === undefined
+    artifact.url,
-      ? checkSum
-      : resolveChecksum(checkSum, artifact.checksum);
-
-  const mirrorUrl = rewriteToMirror(artifact.downloadUrl);
-  const downloadUrl = mirrorUrl ?? artifact.downloadUrl;
-  // Don't send the GitHub token to the Astral mirror.
-  const downloadToken = mirrorUrl !== undefined ? undefined : githubToken;
-
-  try {
-    return await downloadArtifact(
-      downloadUrl,
     `uv-${arch}-${platform}`,
     platform,
     arch,
     version,
-      checksum,
+    checkSum,
-      downloadToken,
+    githubToken,
+  );
+}
+
+export async function downloadVersionFromManifest(
+  manifestUrl: string,
+  platform: Platform,
+  arch: Architecture,
+  version: string,
+  checkSum: string | undefined,
+  githubToken: string,
+): Promise<{ version: string; cachedToolDir: string }> {
+  const artifact = await getManifestArtifact(
+    manifestUrl,
+    version,
+    arch,
+    platform,
+  );
+  if (!artifact) {
+    throw new Error(
+      `manifest-file does not contain version ${version}, arch ${arch}, platform ${platform}.`,
     );
-  } catch (err) {
-    if (mirrorUrl === undefined) {
-      throw err;
   }
 
-    core.warning(
+  return await downloadVersion(
-      `Failed to download from mirror, falling back to GitHub Releases: ${(err as Error).message}`,
-    );
-
-    return await downloadArtifact(
     artifact.downloadUrl,
     `uv-${arch}-${platform}`,
     platform,
     arch,
     version,
-      checksum,
+    resolveChecksum(checkSum, artifact.checksum),
     githubToken,
   );
-  }
 }
 
-/**
+async function downloadVersion(
- * Rewrite a GitHub Releases URL to the Astral mirror.
- * Returns `undefined` if the URL does not match the expected GitHub prefix.
- */
-export function rewriteToMirror(url: string): string | undefined {
-  if (!url.startsWith(GITHUB_RELEASES_PREFIX)) {
-    return undefined;
-  }
-
-  return ASTRAL_MIRROR_PREFIX + url.slice(GITHUB_RELEASES_PREFIX.length);
-}
-
-async function downloadArtifact(
   downloadUrl: string,
   artifactName: string,
   platform: Platform,
   arch: Architecture,
   version: string,
   checksum: string | undefined,
-  githubToken: string | undefined,
+  githubToken: string,
 ): Promise<{ version: string; cachedToolDir: string }> {
   core.info(`Downloading uv from "${downloadUrl}" ...`);
   const downloadPath = await tc.downloadTool(
@@ -144,26 +136,13 @@ async function downloadArtifact(
     version,
     arch,
   );
-  return { cachedToolDir, version };
+  return { cachedToolDir, version: version };
-}
-
-function getMissingArtifactMessage(
-  version: string,
-  arch: Architecture,
-  platform: Platform,
-  manifestUrl?: string,
-): string {
-  if (manifestUrl === undefined) {
-    return `Could not find artifact for version ${version}, arch ${arch}, platform ${platform} in ${VERSIONS_MANIFEST_URL} .`;
-  }
-
-  return `manifest-file does not contain version ${version}, arch ${arch}, platform ${platform}.`;
 }
 
 function resolveChecksum(
   checkSum: string | undefined,
-  manifestChecksum: string,
+  manifestChecksum?: string,
-): string {
+): string | undefined {
   return checkSum !== undefined && checkSum !== ""
     ? checkSum
     : manifestChecksum;
@@ -179,28 +158,32 @@ export async function resolveVersion(
   resolutionStrategy: "highest" | "lowest" = "highest",
 ): Promise<string> {
   core.debug(`Resolving version: ${versionInput}`);
+  let version: string;
   const isSimpleMinimumVersionSpecifier =
     versionInput.includes(">") && !versionInput.includes(",");
   const resolveVersionSpecifierToLatest =
     isSimpleMinimumVersionSpecifier && resolutionStrategy === "highest";
-
   if (resolveVersionSpecifierToLatest) {
     core.info("Found minimum version specifier, using latest version");
   }
-
+  if (manifestUrl !== undefined) {
-  const version =
+    version =
       versionInput === "latest" || resolveVersionSpecifierToLatest
-      ? await getLatestVersion(manifestUrl)
+        ? await getLatestVersionInManifest(manifestUrl)
         : versionInput;
-
+  } else {
+    version =
+      versionInput === "latest" || resolveVersionSpecifierToLatest
+        ? await getLatestVersionFromNdjson()
+        : versionInput;
+  }
   if (tc.isExplicitVersion(version)) {
     core.debug(`Version ${version} is an explicit version.`);
-    if (
+    if (resolveVersionSpecifierToLatest) {
-      resolveVersionSpecifierToLatest &&
+      if (!pep440.satisfies(version, versionInput)) {
-      !pep440.satisfies(version, versionInput)
-    ) {
         throw new Error(`No version found for ${versionInput}`);
       }
+    }
     return version;
   }
 
@@ -225,11 +208,11 @@ async function getAvailableVersions(
     core.info(
       `Getting available versions from manifest-file ${manifestUrl} ...`,
     );
-  } else {
+    return await getAllManifestVersions(manifestUrl);
-    core.info(`Getting available versions from ${VERSIONS_MANIFEST_URL} ...`);
   }
 
-  return await getAllVersions(manifestUrl);
+  core.info(`Getting available versions from ${VERSIONS_NDJSON_URL} ...`);
+  return await getAllVersionsFromNdjson();
 }
 
 function maxSatisfying(

src/download/legacy-version-manifest.ts

@@ -0,0 +1,80 @@
+import * as core from "@actions/core";
+
+export interface ManifestEntry {
+  arch: string;
+  platform: string;
+  version: string;
+  downloadUrl: string;
+  checksum?: string;
+  variant?: string;
+  archiveFormat?: string;
+}
+
+interface LegacyManifestEntry {
+  arch: string;
+  platform: string;
+  version: string;
+  downloadUrl: string;
+  checksum?: string;
+}
+
+const warnedLegacyManifestUrls = new Set<string>();
+
+export function parseLegacyManifestEntries(
+  parsedEntries: unknown[],
+  manifestUrl: string,
+): ManifestEntry[] {
+  warnAboutLegacyManifestFormat(manifestUrl);
+
+  return parsedEntries.map((entry, index) => {
+    if (!isLegacyManifestEntry(entry)) {
+      throw new Error(
+        `Invalid legacy manifest-file entry at index ${index} in ${manifestUrl}.`,
+      );
+    }
+
+    return {
+      arch: entry.arch,
+      checksum: entry.checksum,
+      downloadUrl: entry.downloadUrl,
+      platform: entry.platform,
+      version: entry.version,
+    };
+  });
+}
+
+export function clearLegacyManifestWarnings(): void {
+  warnedLegacyManifestUrls.clear();
+}
+
+function warnAboutLegacyManifestFormat(manifestUrl: string): void {
+  if (warnedLegacyManifestUrls.has(manifestUrl)) {
+    return;
+  }
+
+  warnedLegacyManifestUrls.add(manifestUrl);
+  core.warning(
+    `manifest-file ${manifestUrl} uses the legacy JSON array format, which is deprecated. Please migrate to the astral-sh/versions NDJSON format before the next major release.`,
+  );
+}
+
+function isLegacyManifestEntry(value: unknown): value is LegacyManifestEntry {
+  if (!isRecord(value)) {
+    return false;
+  }
+
+  const checksumIsValid =
+    typeof value.checksum === "string" || value.checksum === undefined;
+
+  return (
+    typeof value.arch === "string" &&
+    checksumIsValid &&
+    typeof value.downloadUrl === "string" &&
+    typeof value.platform === "string" &&
+    typeof value.version === "string"
+  );
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}

src/download/manifest.ts

@@ -1,208 +0,0 @@
-import * as core from "@actions/core";
-import * as semver from "semver";
-import { VERSIONS_MANIFEST_URL } from "../utils/constants";
-import { fetch } from "../utils/fetch";
-import { selectDefaultVariant } from "./variant-selection";
-
-export interface ManifestArtifact {
-  platform: string;
-  variant?: string;
-  url: string;
-  archive_format: string;
-  sha256: string;
-}
-
-export interface ManifestVersion {
-  version: string;
-  artifacts: ManifestArtifact[];
-}
-
-export interface ArtifactResult {
-  archiveFormat: string;
-  checksum: string;
-  downloadUrl: string;
-}
-
-const cachedManifestData = new Map<string, ManifestVersion[]>();
-
-export async function fetchManifest(
-  manifestUrl: string = VERSIONS_MANIFEST_URL,
-): Promise<ManifestVersion[]> {
-  const cachedVersions = cachedManifestData.get(manifestUrl);
-  if (cachedVersions !== undefined) {
-    core.debug(`Using cached manifest data from ${manifestUrl}`);
-    return cachedVersions;
-  }
-
-  core.info(`Fetching manifest data from ${manifestUrl} ...`);
-  const response = await fetch(manifestUrl, {});
-  if (!response.ok) {
-    throw new Error(
-      `Failed to fetch manifest data: ${response.status} ${response.statusText}`,
-    );
-  }
-
-  const body = await response.text();
-  const versions = parseManifest(body, manifestUrl);
-  cachedManifestData.set(manifestUrl, versions);
-  return versions;
-}
-
-export function parseManifest(
-  data: string,
-  sourceDescription: string,
-): ManifestVersion[] {
-  const trimmed = data.trim();
-  if (trimmed === "") {
-    throw new Error(`Manifest at ${sourceDescription} is empty.`);
-  }
-
-  if (trimmed.startsWith("[")) {
-    throw new Error(
-      `Legacy JSON array manifests are no longer supported in ${sourceDescription}. Use the astral-sh/versions manifest format instead.`,
-    );
-  }
-
-  const versions: ManifestVersion[] = [];
-
-  for (const [index, line] of data.split("\n").entries()) {
-    const record = line.trim();
-    if (record === "") {
-      continue;
-    }
-
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(record);
-    } catch (error) {
-      throw new Error(
-        `Failed to parse manifest data from ${sourceDescription} at line ${index + 1}: ${(error as Error).message}`,
-      );
-    }
-
-    if (!isManifestVersion(parsed)) {
-      throw new Error(
-        `Invalid manifest record in ${sourceDescription} at line ${index + 1}.`,
-      );
-    }
-
-    versions.push(parsed);
-  }
-
-  if (versions.length === 0) {
-    throw new Error(`No manifest data found in ${sourceDescription}.`);
-  }
-
-  return versions;
-}
-
-export async function getLatestVersion(
-  manifestUrl: string = VERSIONS_MANIFEST_URL,
-): Promise<string> {
-  const versions = await fetchManifest(manifestUrl);
-  const [firstVersion, ...remainingVersions] = versions.map(
-    (versionData) => versionData.version,
-  );
-
-  if (firstVersion === undefined) {
-    throw new Error("No versions found in manifest data");
-  }
-
-  const latestVersion = remainingVersions.reduce(
-    (latest, current) => (semver.gt(current, latest) ? current : latest),
-    firstVersion,
-  );
-
-  core.debug(`Latest version from manifest: ${latestVersion}`);
-  return latestVersion;
-}
-
-export async function getAllVersions(
-  manifestUrl: string = VERSIONS_MANIFEST_URL,
-): Promise<string[]> {
-  const versions = await fetchManifest(manifestUrl);
-  return versions.map((versionData) => versionData.version);
-}
-
-export async function getArtifact(
-  version: string,
-  arch: string,
-  platform: string,
-  manifestUrl: string = VERSIONS_MANIFEST_URL,
-): Promise<ArtifactResult | undefined> {
-  const versions = await fetchManifest(manifestUrl);
-  const versionData = versions.find(
-    (candidate) => candidate.version === version,
-  );
-  if (!versionData) {
-    core.debug(`Version ${version} not found in manifest ${manifestUrl}`);
-    return undefined;
-  }
-
-  const targetPlatform = `${arch}-${platform}`;
-  const matchingArtifacts = versionData.artifacts.filter(
-    (candidate) => candidate.platform === targetPlatform,
-  );
-
-  if (matchingArtifacts.length === 0) {
-    core.debug(
-      `Artifact for ${targetPlatform} not found in version ${version}. Available platforms: ${versionData.artifacts
-        .map((candidate) => candidate.platform)
-        .join(", ")}`,
-    );
-    return undefined;
-  }
-
-  const artifact = selectDefaultVariant(
-    matchingArtifacts,
-    `Multiple artifacts found for ${targetPlatform} in version ${version}`,
-  );
-
-  return {
-    archiveFormat: artifact.archive_format,
-    checksum: artifact.sha256,
-    downloadUrl: artifact.url,
-  };
-}
-
-export function clearManifestCache(manifestUrl?: string): void {
-  if (manifestUrl === undefined) {
-    cachedManifestData.clear();
-    return;
-  }
-
-  cachedManifestData.delete(manifestUrl);
-}
-
-function isManifestVersion(value: unknown): value is ManifestVersion {
-  if (!isRecord(value)) {
-    return false;
-  }
-
-  if (typeof value.version !== "string" || !Array.isArray(value.artifacts)) {
-    return false;
-  }
-
-  return value.artifacts.every(isManifestArtifact);
-}
-
-function isManifestArtifact(value: unknown): value is ManifestArtifact {
-  if (!isRecord(value)) {
-    return false;
-  }
-
-  const variantIsValid =
-    typeof value.variant === "string" || value.variant === undefined;
-
-  return (
-    typeof value.archive_format === "string" &&
-    typeof value.platform === "string" &&
-    typeof value.sha256 === "string" &&
-    typeof value.url === "string" &&
-    variantIsValid
-  );
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null;
-}

src/download/version-manifest.ts

@@ -0,0 +1,169 @@
+import * as core from "@actions/core";
+import * as semver from "semver";
+import { fetch } from "../utils/fetch";
+import {
+  clearLegacyManifestWarnings,
+  type ManifestEntry,
+  parseLegacyManifestEntries,
+} from "./legacy-version-manifest";
+import { selectDefaultVariant } from "./variant-selection";
+import { type NdjsonVersion, parseVersionData } from "./versions-client";
+
+export interface ManifestArtifact {
+  downloadUrl: string;
+  checksum?: string;
+  archiveFormat?: string;
+}
+
+const cachedManifestEntries = new Map<string, ManifestEntry[]>();
+
+export async function getLatestKnownVersion(
+  manifestUrl: string,
+): Promise<string> {
+  const versions = await getAllVersions(manifestUrl);
+  const latestVersion = versions.reduce((latest, current) =>
+    semver.gt(current, latest) ? current : latest,
+  );
+
+  return latestVersion;
+}
+
+export async function getAllVersions(manifestUrl: string): Promise<string[]> {
+  const manifestEntries = await getManifestEntries(manifestUrl);
+  return [...new Set(manifestEntries.map((entry) => entry.version))];
+}
+
+export async function getManifestArtifact(
+  manifestUrl: string,
+  version: string,
+  arch: string,
+  platform: string,
+): Promise<ManifestArtifact | undefined> {
+  const manifestEntries = await getManifestEntries(manifestUrl);
+  const entry = selectManifestEntry(
+    manifestEntries,
+    manifestUrl,
+    version,
+    arch,
+    platform,
+  );
+
+  if (!entry) {
+    return undefined;
+  }
+
+  return {
+    archiveFormat: entry.archiveFormat,
+    checksum: entry.checksum,
+    downloadUrl: entry.downloadUrl,
+  };
+}
+
+export function clearManifestCache(): void {
+  cachedManifestEntries.clear();
+  clearLegacyManifestWarnings();
+}
+
+async function getManifestEntries(
+  manifestUrl: string,
+): Promise<ManifestEntry[]> {
+  const cachedEntries = cachedManifestEntries.get(manifestUrl);
+  if (cachedEntries !== undefined) {
+    core.debug(`Using cached manifest-file from: ${manifestUrl}`);
+    return cachedEntries;
+  }
+
+  core.info(`Fetching manifest-file from: ${manifestUrl}`);
+  const response = await fetch(manifestUrl, {});
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch manifest-file: ${response.status} ${response.statusText}`,
+    );
+  }
+
+  const data = await response.text();
+  const parsedEntries = parseManifestEntries(data, manifestUrl);
+  cachedManifestEntries.set(manifestUrl, parsedEntries);
+
+  return parsedEntries;
+}
+
+function parseManifestEntries(
+  data: string,
+  manifestUrl: string,
+): ManifestEntry[] {
+  const trimmed = data.trim();
+  if (trimmed === "") {
+    throw new Error(`manifest-file at ${manifestUrl} is empty.`);
+  }
+
+  const parsedAsJson = tryParseJson(trimmed);
+  if (Array.isArray(parsedAsJson)) {
+    return parseLegacyManifestEntries(parsedAsJson, manifestUrl);
+  }
+
+  const versions = parseVersionData(trimmed, manifestUrl);
+  return mapNdjsonVersionsToManifestEntries(versions, manifestUrl);
+}
+
+function mapNdjsonVersionsToManifestEntries(
+  versions: NdjsonVersion[],
+  manifestUrl: string,
+): ManifestEntry[] {
+  const manifestEntries: ManifestEntry[] = [];
+
+  for (const versionData of versions) {
+    for (const artifact of versionData.artifacts) {
+      const [arch, ...platformParts] = artifact.platform.split("-");
+      if (arch === undefined || platformParts.length === 0) {
+        throw new Error(
+          `Invalid artifact platform '${artifact.platform}' in manifest-file ${manifestUrl}.`,
+        );
+      }
+
+      manifestEntries.push({
+        arch,
+        archiveFormat: artifact.archive_format,
+        checksum: artifact.sha256,
+        downloadUrl: artifact.url,
+        platform: platformParts.join("-"),
+        variant: artifact.variant,
+        version: versionData.version,
+      });
+    }
+  }
+
+  return manifestEntries;
+}
+
+function selectManifestEntry(
+  manifestEntries: ManifestEntry[],
+  manifestUrl: string,
+  version: string,
+  arch: string,
+  platform: string,
+): ManifestEntry | undefined {
+  const matches = manifestEntries.filter(
+    (candidate) =>
+      candidate.version === version &&
+      candidate.arch === arch &&
+      candidate.platform === platform,
+  );
+
+  if (matches.length === 0) {
+    return undefined;
+  }
+
+  return selectDefaultVariant(
+    matches,
+    `manifest-file ${manifestUrl} contains multiple artifacts for version ${version}, arch ${arch}, platform ${platform}`,
+  );
+}
+
+function tryParseJson(value: string): unknown {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return undefined;
+  }
+}

src/download/versions-client.ts

@@ -0,0 +1,191 @@
+import * as core from "@actions/core";
+import { VERSIONS_NDJSON_URL } from "../utils/constants";
+import { fetch } from "../utils/fetch";
+import { selectDefaultVariant } from "./variant-selection";
+
+export interface NdjsonArtifact {
+  platform: string;
+  variant?: string;
+  url: string;
+  archive_format: string;
+  sha256: string;
+}
+
+export interface NdjsonVersion {
+  version: string;
+  artifacts: NdjsonArtifact[];
+}
+
+export interface ArtifactResult {
+  url: string;
+  sha256: string;
+  archiveFormat: string;
+}
+
+const cachedVersionData = new Map<string, NdjsonVersion[]>();
+
+export async function fetchVersionData(
+  url: string = VERSIONS_NDJSON_URL,
+): Promise<NdjsonVersion[]> {
+  const cachedVersions = cachedVersionData.get(url);
+  if (cachedVersions !== undefined) {
+    core.debug(`Using cached NDJSON version data from ${url}`);
+    return cachedVersions;
+  }
+
+  core.info(`Fetching version data from ${url} ...`);
+  const response = await fetch(url, {});
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch version data: ${response.status} ${response.statusText}`,
+    );
+  }
+
+  const body = await response.text();
+  const versions = parseVersionData(body, url);
+  cachedVersionData.set(url, versions);
+  return versions;
+}
+
+export function parseVersionData(
+  data: string,
+  sourceDescription: string,
+): NdjsonVersion[] {
+  const versions: NdjsonVersion[] = [];
+
+  for (const [index, line] of data.split("\n").entries()) {
+    const trimmed = line.trim();
+    if (trimmed === "") {
+      continue;
+    }
+
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch (error) {
+      throw new Error(
+        `Failed to parse version data from ${sourceDescription} at line ${index + 1}: ${(error as Error).message}`,
+      );
+    }
+
+    if (!isNdjsonVersion(parsed)) {
+      throw new Error(
+        `Invalid NDJSON record in ${sourceDescription} at line ${index + 1}.`,
+      );
+    }
+
+    versions.push(parsed);
+  }
+
+  if (versions.length === 0) {
+    throw new Error(`No version data found in ${sourceDescription}.`);
+  }
+
+  return versions;
+}
+
+export async function getLatestVersion(): Promise<string> {
+  const versions = await fetchVersionData();
+  const latestVersion = versions[0]?.version;
+  if (!latestVersion) {
+    throw new Error("No versions found in NDJSON data");
+  }
+
+  core.debug(`Latest version from NDJSON: ${latestVersion}`);
+  return latestVersion;
+}
+
+export async function getAllVersions(): Promise<string[]> {
+  const versions = await fetchVersionData();
+  return versions.map((versionData) => versionData.version);
+}
+
+export async function getArtifact(
+  version: string,
+  arch: string,
+  platform: string,
+): Promise<ArtifactResult | undefined> {
+  const versions = await fetchVersionData();
+  const versionData = versions.find(
+    (candidate) => candidate.version === version,
+  );
+  if (!versionData) {
+    core.debug(`Version ${version} not found in NDJSON data`);
+    return undefined;
+  }
+
+  const targetPlatform = `${arch}-${platform}`;
+  const matchingArtifacts = versionData.artifacts.filter(
+    (candidate) => candidate.platform === targetPlatform,
+  );
+
+  if (matchingArtifacts.length === 0) {
+    core.debug(
+      `Artifact for ${targetPlatform} not found in version ${version}. Available platforms: ${versionData.artifacts
+        .map((candidate) => candidate.platform)
+        .join(", ")}`,
+    );
+    return undefined;
+  }
+
+  const artifact = selectArtifact(matchingArtifacts, version, targetPlatform);
+
+  return {
+    archiveFormat: artifact.archive_format,
+    sha256: artifact.sha256,
+    url: artifact.url,
+  };
+}
+
+export function clearCache(url?: string): void {
+  if (url === undefined) {
+    cachedVersionData.clear();
+    return;
+  }
+
+  cachedVersionData.delete(url);
+}
+
+function selectArtifact(
+  artifacts: NdjsonArtifact[],
+  version: string,
+  targetPlatform: string,
+): NdjsonArtifact {
+  return selectDefaultVariant(
+    artifacts,
+    `Multiple artifacts found for ${targetPlatform} in version ${version}`,
+  );
+}
+
+function isNdjsonVersion(value: unknown): value is NdjsonVersion {
+  if (!isRecord(value)) {
+    return false;
+  }
+
+  if (typeof value.version !== "string" || !Array.isArray(value.artifacts)) {
+    return false;
+  }
+
+  return value.artifacts.every(isNdjsonArtifact);
+}
+
+function isNdjsonArtifact(value: unknown): value is NdjsonArtifact {
+  if (!isRecord(value)) {
+    return false;
+  }
+
+  const variantIsValid =
+    typeof value.variant === "string" || value.variant === undefined;
+
+  return (
+    typeof value.archive_format === "string" &&
+    typeof value.platform === "string" &&
+    typeof value.sha256 === "string" &&
+    typeof value.url === "string" &&
+    variantIsValid
+  );
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}

src/setup-uv.ts

@@ -4,7 +4,8 @@ import * as core from "@actions/core";
 import * as exec from "@actions/exec";
 import { restoreCache } from "./cache/restore-cache";
 import {
-  downloadVersion,
+  downloadVersionFromManifest,
+  downloadVersionFromNdjson,
   resolveVersion,
   tryGetFromToolCache,
 } from "./download/download-version";
@@ -37,8 +38,6 @@ import {
 } from "./utils/platforms";
 import { getUvVersionFromFile } from "./version/resolve";
 
-const sourceDir = __dirname;
-
 async function getPythonVersion(): Promise<string> {
   if (pythonVersion !== "") {
     return pythonVersion;
@@ -131,7 +130,7 @@ async function setupUv(
   checkSum: string | undefined,
   githubToken: string,
 ): Promise<{ uvDir: string; version: string }> {
-  const resolvedVersion = await determineVersion();
+  const resolvedVersion = await determineVersion(manifestFile);
   const toolCacheResult = tryGetFromToolCache(arch, resolvedVersion);
   if (toolCacheResult.installedPath) {
     core.info(`Found uv in tool-cache for ${toolCacheResult.version}`);
@@ -141,34 +140,36 @@ async function setupUv(
     };
   }
 
-  const downloadResult = await downloadVersion(
+  const downloadVersionResult =
+    manifestFile !== undefined
+      ? await downloadVersionFromManifest(
+          manifestFile,
+          platform,
+          arch,
+          resolvedVersion,
+          checkSum,
+          githubToken,
+        )
+      : await downloadVersionFromNdjson(
           platform,
           arch,
           resolvedVersion,
           checkSum,
           githubToken,
-    manifestFile,
         );
 
   return {
-    uvDir: downloadResult.cachedToolDir,
+    uvDir: downloadVersionResult.cachedToolDir,
-    version: downloadResult.version,
+    version: downloadVersionResult.version,
   };
 }
 
-async function determineVersion(): Promise<string> {
+async function determineVersion(
-  return await resolveVersion(
+  manifestFile: string | undefined,
-    getRequestedVersion(),
+): Promise<string> {
-    manifestFile,
-    resolutionStrategy,
-  );
-}
-
-function getRequestedVersion(): string {
   if (versionInput !== "") {
-    return versionInput;
+    return await resolveVersion(versionInput, manifestFile, resolutionStrategy);
   }
-
   if (versionFileInput !== "") {
     const versionFromFile = getUvVersionFromFile(versionFileInput);
     if (versionFromFile === undefined) {
@@ -176,23 +177,28 @@ function getRequestedVersion(): string {
         `Could not determine uv version from file: ${versionFileInput}`,
       );
     }
-    return versionFromFile;
+    return await resolveVersion(
+      versionFromFile,
+      manifestFile,
+      resolutionStrategy,
+    );
   }
-
   const versionFromUvToml = getUvVersionFromFile(
     `${workingDirectory}${path.sep}uv.toml`,
   );
   const versionFromPyproject = getUvVersionFromFile(
     `${workingDirectory}${path.sep}pyproject.toml`,
   );
-
   if (versionFromUvToml === undefined && versionFromPyproject === undefined) {
     core.info(
       "Could not determine uv version from uv.toml or pyproject.toml. Falling back to latest.",
     );
   }
-
+  return await resolveVersion(
-  return versionFromUvToml || versionFromPyproject || "latest";
+    versionFromUvToml || versionFromPyproject || "latest",
+    manifestFile,
+    resolutionStrategy,
+  );
 }
 
 function addUvToPathAndOutput(cachedPath: string): void {
@@ -302,7 +308,7 @@ function setCacheDir(): void {
 
 function addMatchers(): void {
   if (addProblemMatchers) {
-    const matchersPath = path.join(sourceDir, "..", "..", ".github");
+    const matchersPath = path.join(__dirname, `..${path.sep}..`, ".github");
     core.info(`##[add-matcher]${path.join(matchersPath, "python.json")}`);
   }
 }

src/update-known-checksums.ts

@@ -6,10 +6,10 @@ import {
   updateChecksums,
 } from "./download/checksum/update-known-checksums";
 import {
-  fetchManifest,
+  fetchVersionData,
   getLatestVersion,
-  type ManifestVersion,
+  type NdjsonVersion,
-} from "./download/manifest";
+} from "./download/versions-client";
 
 const VERSION_IN_CHECKSUM_KEY_PATTERN =
   /-(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/;
@@ -18,7 +18,7 @@ async function run(): Promise<void> {
   const checksumFilePath = process.argv.slice(2)[0];
   if (!checksumFilePath) {
     throw new Error(
-      "Missing checksum file path. Usage: node dist/update-known-checksums/index.cjs <checksum-file-path>",
+      "Missing checksum file path. Usage: node dist/update-known-checksums/index.js <checksum-file-path>",
     );
   }
 
@@ -32,8 +32,8 @@ async function run(): Promise<void> {
     return;
   }
 
-  const versions = await fetchManifest();
+  const versions = await fetchVersionData();
-  const checksumEntries = extractChecksumsFromManifest(versions);
+  const checksumEntries = extractChecksumsFromNdjson(versions);
   await updateChecksums(checksumFilePath, checksumEntries);
 
   core.setOutput("latest-version", latestVersion);
@@ -61,8 +61,8 @@ function extractVersionFromChecksumKey(key: string): string | undefined {
   return key.match(VERSION_IN_CHECKSUM_KEY_PATTERN)?.[1];
 }
 
-function extractChecksumsFromManifest(
+function extractChecksumsFromNdjson(
-  versions: ManifestVersion[],
+  versions: NdjsonVersion[],
 ): ChecksumEntry[] {
   const checksums: ChecksumEntry[] = [];
 

src/utils/constants.ts

@@ -1,13 +1,5 @@
 export const TOOL_CACHE_NAME = "uv";
 export const STATE_UV_PATH = "uv-path";
 export const STATE_UV_VERSION = "uv-version";
-export const VERSIONS_MANIFEST_URL =
+export const VERSIONS_NDJSON_URL =
   "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
-
-/** GitHub Releases URL prefix for uv artifacts. */
-export const GITHUB_RELEASES_PREFIX =
-  "https://github.com/astral-sh/uv/releases/download/";
-
-/** Astral mirror URL prefix that fronts GitHub Releases for uv artifacts. */
-export const ASTRAL_MIRROR_PREFIX =
-  "https://releases.astral.sh/github/uv/releases/download/";

tsconfig.json

@@ -1,12 +1,12 @@
 {
   "compilerOptions": {
-    "esModuleInterop": true,
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
-    "isolatedModules": true,
+    "module": "nodenext" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
-    "module": "esnext",
+    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
-    "moduleResolution": "bundler",
+    "outDir": "./lib" /* Redirect output structure to the directory. */,
-    "noImplicitAny": true,
+    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
-    "strict": true,
+    "strict": true /* Enable all strict type-checking options. */,
-    "target": "ES2022"
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
   },
-  "include": ["src/**/*.ts"]
+  "exclude": ["node_modules", "**/*.test.ts"]
 }