Bump release-drafter/release-drafter from 7.3.0 to 7.5.1

Bumps [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) from 7.3.0 to 7.5.1. - [Release notes](https://github.com/release-drafter/release-drafter/releases) - [Commits](https://github.com/release-drafter/release-drafter/compare/c2e2804cc59f45f57076a99af580d0fedb697927...4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e) --- updated-dependencies: - dependency-name: release-drafter/release-drafter dependency-version: 7.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Add option to skip Astral mirror downloads (#387 )
2026-08-08 10:17:03 +00:00 · 2026-07-07 04:42:46 +00:00 · 2026-07-05 10:17:44 +00:00 · 2026-07-05 12:04:11 +02:00 · 2026-07-05 11:56:05 +02:00 · 2026-07-05 11:55:02 +02:00
104 changed files with 82073 additions and 343 deletions
@@ -0,0 +1,53 @@
 ---
 name: dependabot-pr-rollup
 description: Find open Dependabot PRs for ruff-action, compare each PR head to its base branch, replay only the remaining npm and GitHub Actions changes in a fresh worktree and branch, run repository validation, and optionally commit, push, and open a PR. Use when you want to batch or manually replicate active Dependabot updates.
 license: MIT
 compatibility: Requires git, git worktree, gh CLI auth, npm, and a GitHub repo with an origin remote.
 ---
 # Dependabot PR Rollup
 ## When to use
 Use this skill when the user wants to:
 - find all open Dependabot PRs in this repo
 - reproduce their net effect in one local branch
 - validate the result with the repo's standard checks
 - optionally commit, push, and open a PR
 ## Workflow
 1. Inspect the current checkout state, but do not reuse a dirty worktree.
 2. List open Dependabot PRs with `gh pr list --state open --author app/dependabot`.
 3. For each PR, collect the title, base branch, head branch, changed files, and relevant diffs.
 4. Compare each PR head against `origin/<base>` instead of trusting the PR title. Dependabot PRs can already be partially merged, superseded by newer versions, or have no remaining net effect.
 5. Create a new worktree and branch from `origin/<base>`.
 6. Reproduce only the remaining dependency changes in the new worktree.
   - Inspect `package.json` before editing npm dependencies.
   - Run `npm ci --ignore-scripts` before applying npm updates so dependency commands run from a clean install.
   - Use `npm install ... --ignore-scripts` for direct npm dependency changes so `package-lock.json` stays in sync.
   - Preserve whether an npm package is a `dependency` or `devDependency`.
   - When updating `@biomejs/biome`, also update the Biome schema URL version in `biome.json` to match the installed Biome version.
   - For GitHub Actions updates, apply the net workflow-file changes from the Dependabot PR heads after confirming they still apply cleanly to the selected base.
 7. Run `npm run all`.
 8. If requested, commit the changed source, lockfile, workflow files, and generated artifacts, then push and open a PR.
 ## Repo-specific notes
 - Use `gh` for GitHub operations.
 - Keep the user's original checkout untouched by working in a separate worktree.
 - This repo has Dependabot configured for both `npm` and `github-actions`.
 - In this repo, `npm run all` is the safest validation command because it runs build, check, package, and unit tests.
 - `npm run check` may rewrite files with Biome; include those intentional formatting changes.
 - If dependency changes affect bundled output, include the regenerated `dist/` files from `npm run package`.
 ## Report back
 Always report:
 - open Dependabot PRs found
 - which PRs required no net changes
 - new branch name
 - new worktree path
 - files changed
 - `npm run all` result
 - if applicable, commit SHA and PR URL
@@ -0,0 +1,20 @@
 # Check http://editorconfig.org for more information
 # This is the main config file for this project:
 root = true
 [*]
 charset = utf-8
 trim_trailing_whitespace = true
 end_of_line = lf
 indent_style = space
 insert_final_newline = true
 indent_size = 2
 [*.{rs,py,pyi}]
 indent_size = 4
 [*.snap]
 trim_trailing_whitespace = false
 [*.md]
 max_line_length = 100
@@ -0,0 +1,2 @@
 * text=auto eol=lf
 dist/** -diff linguist-generated=true
@@ -1,13 +1,11 @@
 # Keep GitHub Actions up to date with GitHub's Dependabot...
 # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
 # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
 version: 2
 updates:
  - package-ecosystem: github-actions
    directory: /
    groups:
      github-actions:
        patterns:
          - "*"  # Group all Actions updates into a single larger pull request
    schedule:
-      interval: weekly
+      interval: daily
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: daily
@@ -0,0 +1,17 @@
 {
  "problemMatcher": [
    {
      "owner": "ruff-check",
      "pattern": [
        {
          "code": 4,
          "column": 3,
          "file": 1,
          "line": 2,
          "message": 5,
          "regexp": "^Error: (.*):(\\d+):(\\d+): (\\w+) (.*)$"
        }
      ]
    }
  ]
 }
@@ -0,0 +1,20 @@
 {
  "problemMatcher": [
    {
      "owner": "ruff-format",
      "pattern": [
        {
          "code": 2,
          "column": 5,
          "endColumn": 7,
          "endLine": 6,
          "file": 3,
          "line": 4,
          "message": 8,
          "regexp": "^(?:(error|warning|notice))\\s+title=([^,]+),file=([^,]+),line=(\\d+),col=(\\d+)(?:,endLine=(\\d+))?(?:,endColumn=(\\d+))?::(.+)$",
          "severity": 1
        }
      ]
    }
  ]
 }
@@ -0,0 +1,50 @@
 name-template: "v$RESOLVED_VERSION 🌈"
 tag-template: "v$RESOLVED_VERSION"
 categories:
  - title: "🚨 Breaking changes"
    labels:
      - "breaking-change"
  - title: "✨ New features"
    labels:
      - "new-feature"
  - title: "🐛 Bug fixes"
    labels:
      - "bugfix"
  - title: "🚀 Enhancements"
    labels:
      - "enhancement"
      - "refactor"
      - "performance"
  - title: "🧰 Maintenance"
    labels:
      - "maintenance"
      - "ci"
      - "update-known-checksums"
  - title: "📚 Documentation"
    labels:
      - "documentation"
  - title: "⬆️ Dependency updates"
    labels:
      - "dependencies"
 change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
 change-title-escapes: '\<*_&' # You can add # and @ to disable mentions, and add ` to disable code blocks.
 version-resolver:
  major:
    labels:
      - "major"
      - "breaking-change"
  minor:
    labels:
      - "minor"
      - "new-feature"
      - "enhancement"
  patch:
    labels:
      - "patch"
      - "bugfix"
      - "default-version-update"
  default: patch
 template: |
  ## Changes
  $CHANGES
@@ -0,0 +1,35 @@
 import * as fs from "node:fs";
 import * as yaml from "js-yaml";
 interface WorkflowJob {
  needs?: string[];
  [key: string]: unknown;
 }
 interface Workflow {
  jobs: Record<string, WorkflowJob>;
  [key: string]: unknown;
 }
 const workflow = yaml.load(
  fs.readFileSync("../workflows/test.yml", "utf8"),
 ) as Workflow;
 const jobs = Object.keys(workflow.jobs);
 const allTestsPassed = workflow.jobs["all-tests-passed"];
 const needs: string[] = allTestsPassed.needs || [];
 const expectedNeeds = jobs.filter((j) => j !== "all-tests-passed");
 const missing = expectedNeeds.filter((j) => !needs.includes(j));
 if (missing.length > 0) {
  console.error(
    `Missing jobs in all-tests-passed needs: ${missing.join(", ")}`,
  );
  console.info(
    "Please add the missing jobs to the needs section of all-tests-passed in test.yml.",
  );
  process.exit(1);
 }
 console.log(
  "All jobs in test.yml are in the needs section of all-tests-passed.",
 );
@@ -0,0 +1,9 @@
 {
  "compilerOptions": {
    "module": "nodenext",
    "moduleResolution": "nodenext",
    "target": "es2022",
    "types": ["node"]
  },
  "include": ["check-all-tests-passed-needs.ts"]
 }
@@ -1,16 +0,0 @@
 name: actionlint
 on:
  push:
    paths:
    - '.github/workflows/**'
  pull_request:
    paths:
    - '.github/workflows/**'
 jobs:
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: reviewdog/action-actionlint@v1
@@ -0,0 +1,74 @@
 # For most projects, this workflow file will not need changing; you simply need
 # to commit it to your repository.
 #
 # You may wish to alter this file to override the set of languages analyzed,
 # or to provide custom queries or build logic.
 #
 # ******** NOTE ********
 # We have attempted to detect the languages in your repository. Please check
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
 name: "CodeQL"
 on:
  workflow_dispatch:
  push:
    branches: [main]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [main]
  schedule:
    - cron: "31 7 * * 3"
 jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: ["TypeScript"]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://git.io/codeql-language-support
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
        with:
          languages: ${{ matrix.language }}
          source-root: src
          # If you wish to specify custom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 https://git.io/JvXDl
      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
      #    and modify them (or add more) to build your code if your project
      #    uses a compiled language
      #- run: |
      #   make bootstrap
      #   make release
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
@@ -1,16 +0,0 @@
 name: Python
 on: [push, pull_request]
 jobs:
  clean-python:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: chartboost/ruff-action@v1
        with:
          args: 'check'
      - uses: chartboost/ruff-action@v1
        with:
          args: 'format --check'
      - uses: jakebailey/pyright-action@v2
@@ -0,0 +1,24 @@
 ---
 name: Release Drafter
 # yamllint disable-line rule:truthy
 on:
  workflow_dispatch:
  push:
    branches:
      - main
 jobs:
  update_release_draft:
    name: ✏️ Draft release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    steps:
      - name: 🚀 Run Release Drafter
        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
        with:
          commitish: ${{ github.sha }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,113 @@
 name: Release
 on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g., 8.1.0)"
        required: true
        type: string
 permissions: {}
 jobs:
  validate-release:
    name: Validate release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Validate version and draft release
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ inputs.version }}
          TAG: v${{ inputs.version }}
        run: |
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "::error::Version must match MAJOR.MINOR.PATCH (e.g., 8.1.0)"
            exit 1
          fi
          RELEASE_JSON=$(gh release view "$TAG" --json isDraft,targetCommitish 2>&1) || {
            echo "::error::No release found for $TAG"
            exit 1
          }
          IS_DRAFT=$(echo "$RELEASE_JSON" | jq -r '.isDraft')
          TARGET=$(echo "$RELEASE_JSON" | jq -r '.targetCommitish')
          if [[ "$IS_DRAFT" != "true" ]]; then
            echo "::error::Release $TAG already exists and is not a draft"
            exit 1
          fi
          if [[ "$TARGET" != "$GITHUB_SHA" ]]; then
            echo "::error::Draft release target ($TARGET) does not match current commit ($GITHUB_SHA)"
            exit 1
          fi
  release-gate:
    # N.B. This name should not change, it is used for downstream checks.
    name: release-gate
    needs:
      - validate-release
    runs-on: ubuntu-latest
    environment:
      name: release-gate
    steps:
      - run: echo "Release approved"
  create-deployment:
    name: create-deployment
    needs:
      - validate-release
      - release-gate
    runs-on: ubuntu-latest
    environment:
      name: release
    steps:
      - run: echo "Release deployment created"
  release:
    name: Release
    needs:
      - validate-release
      - release-gate
      - create-deployment
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Publish release
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ inputs.version }}
          TAG: v${{ inputs.version }}
        run: |
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "::error::Version must match MAJOR.MINOR.PATCH (e.g., 8.1.0)"
            exit 1
          fi
          RELEASE_JSON=$(gh release view "$TAG" --json isDraft,targetCommitish 2>&1) || {
            echo "::error::No release found for $TAG"
            exit 1
          }
          IS_DRAFT=$(echo "$RELEASE_JSON" | jq -r '.isDraft')
          TARGET=$(echo "$RELEASE_JSON" | jq -r '.targetCommitish')
          if [[ "$IS_DRAFT" != "true" ]]; then
            echo "::error::Release $TAG already exists and is not a draft"
            exit 1
          fi
          if [[ "$TARGET" != "$GITHUB_SHA" ]]; then
            echo "::error::Draft release target ($TARGET) does not match current commit ($GITHUB_SHA)"
            exit 1
          fi
          echo "Publishing draft release $TAG"
          gh release edit "$TAG" --draft=false
@@ -1,26 +0,0 @@
 name: Mark and close stale pull requests
 on:
  schedule:
  - cron: '55 17 * * *'
 env:
  PR_STALE_DAYS: 21
  PR_CLOSE_DAYS: 7
 jobs:
  stale:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: read
      pull-requests: write
    steps:
    - uses: actions/stale@v9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        stale-pr-message: "This pull request has been marked as stale. It will be closed in 14 days if no further activity occurs."
        close-pr-message: "This pull request has been closed due to lack of activity."
        days-before-pr-stale: ${{ env.PR_STALE_DAYS }}
        days-before-pr-close: ${{ env.PR_CLOSE_DAYS }}
        delete-branch: true
@@ -0,0 +1,541 @@
 name: "test"
 on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 permissions: {}
 jobs:
  lint:
    runs-on: ubuntu-latest
    permissions:
      security-events: write # for zizmor
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Actionlint
        uses: eifinger/actionlint-action@1fc89649be682d16ec5cf65ea16e269eb88d3982  # v1.10.2
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: |
          npm ci --ignore-scripts
      - run: |
          npm run all
      - name: Check all jobs are in all-tests-passed.needs
        run: |
          tsc -p tsconfig.json
          node check-all-tests-passed-needs.js
        working-directory: .github/scripts
      - name: Make sure no changes from linters are detected
        run: |
          git diff --exit-code || (echo "::error::Please run 'npm run all' to fix the issues" && exit 1)
  test-latest-version:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, macos-14, windows-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use latest version
        uses: ./
        with:
          src: __tests__/fixtures/python-project
          version: latest
  test-specific-version:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        ruff-version: ["0.1.7", "0.1.8", "0.4.7", "0.4.10", "0.7", "0.7.x", ">=0.7.0"]
        os: [ ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-14, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use version ${{ matrix.ruff-version }}
        uses: ./
        with:
          version: ${{ matrix.ruff-version }}
          src: __tests__/fixtures/python-project
  test-unsupported-version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Try install old version
        id: install
        continue-on-error: true
        uses: ./
        with:
          version: 0.0.246
          src: __tests__/fixtures/python-project
      - name: Check if the action failed
        run: |
          if [ "${INSTALL_OUTCOME}" == "success" ]; then
            exit 1
          fi
        env:
          INSTALL_OUTCOME: ${{ steps.install.outcome }}
  test-version-from-version-file-pyproject:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use version from pyproject.toml
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/python-project
          version-file: __tests__/fixtures/pyproject.toml
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.9.3" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-pyproject:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/python-project
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.6.2" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-pyproject-dev-group:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml dev group
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/pyproject-dependency-dev-project
          version-file: __tests__/fixtures/pyproject-dependency-dev-project/pyproject.toml
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.8.3" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-pyproject-dependency-groups:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml dependency groups
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/pyproject-dependency-groups-project
          version-file: __tests__/fixtures/pyproject-dependency-groups-project/pyproject.toml
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.8.3" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-pyproject-dependency-groups-with-env-marker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml with environment marker
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/python-project
          version-file: __tests__/fixtures/pyproject-dependency-groups-with-env-marker/pyproject.toml
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.13.3" ]; then
            echo "Expected version 0.13.3 but got $RUFF_VERSION"
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-pyproject-poetry-groups:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml poetry group dependencies
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/pyproject-dependency-poetry-grouped-project
          version-file: __tests__/fixtures/pyproject-dependency-poetry-grouped-project/pyproject.toml
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.8.3" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-pyproject-poetry:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml poetry dependencies
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/pyproject-dependency-poetry-project
          version-file: __tests__/fixtures/pyproject-dependency-poetry-project/pyproject.toml
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.8.6" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-pyproject-optional-dependencies:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml optional dependencies
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/pyproject-optional-dependencies-project
          version-file: __tests__/fixtures/pyproject-optional-dependencies-project/pyproject.toml
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.8.3" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-requirements:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from requirements.txt
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/python-project
          version-file: __tests__/fixtures/requirements.txt
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.9.0" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-requirements-with-hash:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from requirements-with-hash.txt
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/python-project
          version-file: __tests__/fixtures/requirements-with-hash.txt
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.9.0" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-default-version-from-uv-lock:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from uv.lock
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/python-project
          version-file: __tests__/fixtures/uv.lock
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.9.5" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-semver-range:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use version 0.7
        id: ruff-action
        uses: ./
        with:
          version: "0.7"
          src: __tests__/fixtures/python-project
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.7.4" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-pep440-version-specifier:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install version 0.9.10
        id: ruff-action
        uses: ./
        with:
          version: ">=0.9.9,<0.10.0"
          src: __tests__/fixtures/python-project
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.9.10" ]; then
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-checksum:
    runs-on: ${{ matrix.inputs.os }}
    strategy:
      matrix:
        inputs:
          - os: ubuntu-latest
            checksum: "0de731c669b9ece77e799ac3f4a160c30849752714d9775c94cc4cfaf326860c"
          - os: macos-latest
            checksum: "af9583bff12afbca5d5670334e0187dd60c4d91bc71317d1b2dde70cb1200ba9"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Checksum matches expected
        uses: ./
        with:
          version: "0.7.4"
          checksum: ${{ matrix.inputs.checksum }}
          src: __tests__/fixtures/python-project
  test-with-explicit-token:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version
        uses: ./
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          src: __tests__/fixtures/python-project
  test-args:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use args
        uses: ./
        with:
          args: format --check
          src: __tests__/fixtures/python-project
  test-failure:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Format should fail
        id: format-should-fail
        continue-on-error: true
        uses: ./
        with:
          args: format --check
          src: __tests__/fixtures/malformed-python-project
      - name: Check if the action failed
        run: |
          if [ "${FORMAT_SHOULD_FAIL_OUTCOME}" == "success" ]; then
            exit 1
          fi
        env:
          FORMAT_SHOULD_FAIL_OUTCOME: ${{ steps.format-should-fail.outcome }}
      - name: Check should fail
        id: check-should-fail
        continue-on-error: true
        uses: ./
        with:
          src: __tests__/fixtures/malformed-python-project
      - name: Check if the action failed
        run: |
          if [ "${CHECK_SHOULD_FAIL_OUTCOME}" == "success" ]; then
            exit 1
          fi
        env:
          CHECK_SHOULD_FAIL_OUTCOME: ${{ steps.check-should-fail.outcome }}
  test-glob-src:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use glob pattern in src
        uses: ./
        with:
          src: __tests__/fixtures/glob-project/**/*.py
  test-glob-single-star-src:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use single-star glob pattern in src
        uses: ./
        with:
          src: __tests__/fixtures/glob-single-star-project/foo/bar/*.py
  test-multiple-src:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use args
        uses: ./
        with:
          args: format --check
          src: >-
            __tests__/fixtures/python-project/src/python_project/__init__.py
            __tests__/fixtures/python-project/src/python_project/hello_world.py
  test-parent-directory-pyproject:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use version from parent directory pyproject.toml
        id: ruff-action
        uses: ./
        with:
          src: __tests__/fixtures/parent-config-project/subproject
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.10.0" ]; then
            echo "Expected version 0.10.0 but got $RUFF_VERSION"
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  test-custom-manifest-file:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Create test src
        run: |
          mkdir -p "${{ runner.temp }}/ruff-manifest-test"
          printf 'print("hello")\n' > "${{ runner.temp }}/ruff-manifest-test/hello.py"
      - name: Install from custom manifest file
        id: ruff-action
        uses: ./
        with:
          src: ${{ runner.temp }}/ruff-manifest-test
          manifest-file: "https://raw.githubusercontent.com/astral-sh/ruff-action/${{ github.ref }}/__tests__/download/custom-manifest.ndjson"
      - name: Correct version gets installed
        run: |
          if [ "$RUFF_VERSION" != "0.15.10" ]; then
            echo "Wrong ruff version: $RUFF_VERSION"
            exit 1
          fi
        env:
          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
  all-tests-passed:
    runs-on: ubuntu-latest
    needs:
      - lint
      - test-latest-version
      - test-specific-version
      - test-unsupported-version
      - test-version-from-version-file-pyproject
      - test-default-version-from-pyproject
      - test-default-version-from-pyproject-dev-group
      - test-default-version-from-pyproject-dependency-groups
      - test-default-version-from-pyproject-dependency-groups-with-env-marker
      - test-default-version-from-pyproject-poetry-groups
      - test-default-version-from-pyproject-poetry
      - test-default-version-from-pyproject-optional-dependencies
      - test-default-version-from-requirements
      - test-default-version-from-requirements-with-hash
      - test-default-version-from-uv-lock
      - test-semver-range
      - test-pep440-version-specifier
      - test-checksum
      - test-with-explicit-token
      - test-args
      - test-failure
      - test-glob-src
      - test-glob-single-star-src
      - test-multiple-src
      - test-parent-directory-pyproject
      - test-custom-manifest-file
    if: always()
    steps:
      - name: All tests passed
        run: |
          echo "All jobs passed: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}"
          # shellcheck disable=SC2242
          exit ${{ (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) && 1 || 0 }}
@@ -0,0 +1,40 @@
 name: "Update known checksums"
 on:
  workflow_dispatch:
  schedule:
    - cron: "0 4 * * *" # Run every day at 4am UTC
 jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - name: Update known checksums
        id: update-known-checksums
        run:
          node dist/update-known-checksums/index.cjs
          src/download/checksum/known-checksums.ts ${{ secrets.GITHUB_TOKEN }}
      - run: npm ci --ignore-scripts && npm run all
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          commit-message: "chore: update known checksums"
          title:
            "chore: update known checksums for ${{
            steps.update-known-checksums.outputs.latest-version }}"
          body:
            "chore: update known checksums for ${{
            steps.update-known-checksums.outputs.latest-version }}"
          base: main
          labels: "automated-pr,update-known-checksums"
          branch: update-known-checksums-pr
          delete-branch: true
@@ -0,0 +1,50 @@
 ---
 name: Update Major Minor Tags
 # yamllint disable-line rule:truthy
 on:
  push:
    branches-ignore:
      - "**"
    tags:
      - "v*.*.*"
 jobs:
  update_major_minor_tags:
    name: Make sure major and minor tags are up to date on a patch release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: true
      - name: Update Major Minor Tags
        run: |
          set -x
          cd "${GITHUB_WORKSPACE}" || exit
          # Set up variables.
          TAG="${GITHUB_REF#refs/tags/}" # v1.2.3
          MINOR="${TAG%.*}"              # v1.2
          MAJOR="${MINOR%.*}"            # v1
          if [ "${GITHUB_REF}" = "${TAG}" ]; then
            echo "This workflow is not triggered by tag push: GITHUB_REF=${GITHUB_REF}"
            exit 1
          fi
          MESSAGE="Release ${TAG}"
          # Set up Git.
          git config user.name "${GITHUB_ACTOR}"
          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
          # Update MAJOR/MINOR tag
          git tag -fa "${MAJOR}" -m "${MESSAGE}"
          git tag -fa "${MINOR}" -m "${MESSAGE}"
          # Push
          git push --force origin "${MINOR}"
          git push --force origin "${MAJOR}"
@@ -1,129 +1,102 @@
-# Byte-compiled / optimized / DLL files
+# Dependency directory
-__pycache__/
+node_modules
 *.py[cod]
 *$py.class
-# C extensions
+# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
-*.so
+# Logs
-
+logs
 # Distribution / packaging
 .Python
 build/
 develop-eggs/
 dist/
 downloads/
 eggs/
 .eggs/
 lib/
 lib64/
 parts/
 sdist/
 var/
 wheels/
 pip-wheel-metadata/
 share/python-wheels/
 *.egg-info/
 .installed.cfg
 *.egg
 MANIFEST
 # PyInstaller
 #  Usually these files are written by a python script from a template
 #  before PyInstaller builds the exe, so as to inject date/other infos into it.
 *.manifest
 *.spec
 # Installer logs
 pip-log.txt
 pip-delete-this-directory.txt
 # Unit test / coverage reports
 htmlcov/
 .tox/
 .nox/
 .coverage
 .coverage.*
 .cache
 nosetests.xml
 coverage.xml
 *.cover
 *.py,cover
 .hypothesis/
 .pytest_cache/
 # Translations
 *.mo
 *.pot
 # Django stuff:
 *.log
-local_settings.py
+npm-debug.log*
-db.sqlite3
+yarn-debug.log*
-db.sqlite3-journal
+yarn-error.log*
 lerna-debug.log*
-# Flask stuff:
+# Diagnostic reports (https://nodejs.org/api/report.html)
-instance/
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
 .webassets-cache
-# Scrapy stuff:
+# Runtime data
-.scrapy
+pids
 *.pid
 *.seed
 *.pid.lock
-# Sphinx documentation
+# Directory for instrumented libs generated by jscoverage/JSCover
-docs/_build/
+lib-cov
-# PyBuilder
+# Coverage directory used by tools like istanbul
-target/
+coverage
 *.lcov
-# Jupyter Notebook
+# nyc test coverage
-.ipynb_checkpoints
+.nyc_output
-# IPython
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-profile_default/
+.grunt
 ipython_config.py
-# pyenv
+# Bower dependency directory (https://bower.io/)
-.python-version
+bower_components
-# pipenv
+# node-waf configuration
-#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+.lock-wscript
 #   However, in case of collaboration, if having platform-specific dependencies or dependencies
 #   having no cross-platform support, pipenv may install dependencies that don't work, or not
 #   install all needed dependencies.
 #Pipfile.lock
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow
+# Compiled binary addons (https://nodejs.org/api/addons.html)
-__pypackages__/
+build/Release
-# Celery stuff
+# Dependency directories
-celerybeat-schedule
+jspm_packages/
 celerybeat.pid
-# SageMath parsed files
+# TypeScript v1 declaration files
-*.sage.py
+typings/
-# Environments
+# TypeScript cache
 *.tsbuildinfo
 # Optional npm cache directory
 .npm
 # Optional eslint cache
 .eslintcache
 # Optional REPL history
 .node_repl_history
 # Output of 'npm pack'
 *.tgz
 # Yarn Integrity file
 .yarn-integrity
 # dotenv environment variables file
 .env
-.venv
+.env.test
 env/
 venv/
 ENV/
 env.bak/
 venv.bak/
-# Spyder project settings
+# parcel-bundler cache (https://parceljs.org/)
-.spyderproject
+.cache
 .spyproject
-# Rope project settings
+# next.js build output
-.ropeproject
+.next
-# mkdocs documentation
+# nuxt.js build output
-/site
+.nuxt
-# mypy
+# vuepress build output
-.mypy_cache/
+.vuepress/dist
 .dmypy.json
 dmypy.json
-# Pyre type checker
+# Serverless directories
-.pyre/
+.serverless/
 # FuseBox cache
 .fusebox/
 # DynamoDB Local files
 .dynamodb/
 # OS metadata
 .DS_Store
 Thumbs.db
 # Ignore built ts files
 __tests__/runner/*
 lib/**/*
 # Idea IDEs (PyCharm, WebStorm, IntelliJ, etc)
 .idea/
@@ -0,0 +1 @@
 24
@@ -1,23 +0,0 @@
 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: check-yaml
      - id: end-of-file-fixer
      - id: trailing-whitespace
  - repo: https://github.com/rhysd/actionlint
    rev: v1.6.26
    hooks:
      - id: actionlint
  - repo: https://github.com/psf/black
    rev: 24.1.1
    hooks:
      - id: black
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: 'v0.2.1'
    hooks:
      - id: ruff
  - repo: https://github.com/RobertCraigie/pyright-python
    rev: v1.1.350
    hooks:
    - id: pyright
@@ -0,0 +1,3 @@
 {
  "recommendations": ["biomejs.biome"]
 }
@@ -0,0 +1,16 @@
 {
  "editor.codeActionsOnSave": {
    "source.action.useSortedAttributes.biome": "explicit",
    "source.action.useSortedKeys.biome": "explicit",
    "source.fixAll.biome": "explicit"
  },
  "editor.defaultFormatter": "biomejs.biome",
  "editor.formatOnSave": true,
  "explorer.excludeGitIgnore": false,
  "search.defaultViewMode": "list",
  "search.exclude": {
    "**/node_modules": true
  },
  "typescript.enablePromptUseWorkspaceTsdk": true,
  "typescript.tsdk": "node_modules/typescript/lib"
 }
@@ -0,0 +1 @@
 * @eifinger
@@ -1,96 +1,261 @@
 # ruff-action
-> [!NOTE]
+A GitHub Action to run [ruff](https://github.com/astral-sh/ruff).
 >
 > This Action is a fork of
 > [chartboost/ruff-action](https://github.com/ChartBoost/ruff-action), which is
 > no longer maintained. The Action is largely unchanged, but will be overhauled
 > in a future major release.
 A [GitHub Action](https://github.com/features/actions) to run
 [Ruff](https://github.com/astral-sh/ruff).
 This action is commonly used as a pass/fail test to ensure your repository stays
-clean, abiding the [Rules](https://docs.astral.sh/ruff/rules/) specified in your
+clean, abiding the [rules](https://docs.astral.sh/ruff/rules/) specified in your
-configuration. Though it runs `ruff`, the action can do anything `ruff` can (ex,
+configuration. Though it runs `ruff check` by default, the action can do
-fix).
+anything `ruff` can (ex, fix).
-## Compatibility
+## Contents
-This action is known to support all GitHub-hosted runner OSes. It likely can run
+- [Usage](#usage)
-on self-hosted runners, but might need specific dependencies. Only published
+  - [Basic](#basic)
-versions of Ruff are supported (i.e., whatever is available on
+  - [Specify a different source directory](#specify-a-different-source-directory)
-[PyPI](https://pypi.org/project/ruff/)).
+  - [Specify multiple files](#specify-multiple-files)
  - [Use to install ruff](#use-to-install-ruff)
  - [Use `ruff format`](#use-ruff-format)
  - [Install specific versions](#install-specific-versions)
    - [Install the latest version](#install-the-latest-version)
    - [Install a specific version](#install-a-specific-version)
    - [Install a version by supplying a semver range or pep440 specifier](#install-a-version-by-supplying-a-semver-range-or-pep440-specifier)
    - [Install a version from a specified version file](#install-a-version-from-a-specified-version-file)
    - [Install using a custom manifest URL](#install-using-a-custom-manifest-url)
  - [Validate checksum](#validate-checksum)
  - [GitHub authentication token](#github-authentication-token)
 - [Outputs](#outputs)
-## Basic Usage
+## Usage
-Create a file (ex: `.github/workflows/ruff.yml`) inside your repository with:
+| Input           | Description                                                                                                                                | Default            |
 |-----------------|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------|
 | `version`       | The version of Ruff to install. See [Install specific versions](#install-specific-versions)                                                | discovered from `pyproject.toml`, else `latest` |
 | `version-file`  | The file to read the version from. See [Install a version from a specified version file](#install-a-version-from-a-specified-version-file) | None               |
 | `manifest-file` | URL to a custom Ruff manifest in the `astral-sh/versions` format.                                                                          | None               |
 | `download-from-astral-mirror` | Download Ruff from the Astral mirror instead of directly from GitHub Releases.                                                   | `true`             |
 | `args`          | The arguments to pass to the `ruff` command. See [Configuring Ruff]                                                                        | `check`            |
 | `src`           | Source path(s) to run `ruff` on. Supports glob patterns.                                                                                   | [github.workspace] |
 | `checksum`      | The sha256 checksum of the downloaded artifact.                                                                                            | None               |
 | `github-token`  | The GitHub token to use when downloading Ruff release artifacts from GitHub.                                                               | `GITHUB_TOKEN`     |
 By default, Ruff version metadata is resolved from the
 [`astral-sh/versions` Ruff manifest](https://github.com/astral-sh/versions/blob/main/v1/ruff.ndjson).
 ### Basic
 ```yaml
-name: Ruff
+- uses: astral-sh/ruff-action@v4.0.0
 on: [push, pull_request]
 jobs:
  ruff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/ruff-action@v1
 ```
 ## Advanced Usage
 The Ruff action can be customized via optional configuration parameters passed
 to Ruff (using `with:`):
 - `version`: Must be a Ruff release available on
  [PyPI](https://pypi.org/project/ruff/). Defaults to the latest Ruff release.
  You can pin a version, or use any valid version specifier.
 - `args`: The arguments to pass to the `ruff` command. Defaults to `check`,
  which lints the current directory.
 - `src`: The directory to run `ruff` in. Defaults to the root of the repository.
 See
 [Configuring Ruff](https://github.com/astral-sh/ruff/blob/main/docs/configuration.md)
 for details
 ### Use a different ruff version
 ```yaml
 - uses: astral-sh/ruff-action@v1
  with:
    version: 0.2.2
 ```
 ### Specify a different source directory
 ```yaml
- uses: astral-sh/ruff-action@v1
+- uses: astral-sh/ruff-action@v4.0.0
  with:
    src: "./src"
 ```
 ### Specify multiple files
 Separate multiple `src` values with whitespace.
 ```yaml
 - uses: astral-sh/ruff-action@v4.0.0
  with:
    src: >-
      path/to/file1.py
      path/to/file2.py
 ```
 ### Use glob patterns
 Glob patterns (`*`, `?`, `[...]`, and `**`) are expanded by the action using
 [`@actions/glob`](https://github.com/actions/toolkit/tree/main/packages/glob),
 so they work consistently across Linux, macOS, and Windows runners. This action
 does not emulate Bash, PowerShell, or other shell-specific glob expansion.
 Hidden files and directories are skipped by default; target them explicitly, for
 example with `.venv/**/*.py`, to include them. If a pattern does not match any
 files, the original pattern is passed to Ruff so Ruff can report the missing
 path. Literal glob metacharacters in file or directory names must be escaped
 using `@actions/glob` syntax.
 ```yaml
 - uses: astral-sh/ruff-action@v3
  with:
    src: "src/**/*.py"
 ```
 > [!NOTE]
 > When using multiple patterns, only the first is used to search for
 > `pyproject.toml` to determine the Ruff version. Use the `version` input
 > for explicit control. Large glob expansions may hit command-line length limits,
 > especially on Windows.
 ### Use to install ruff
 This action adds ruff to the PATH, so you can use it in subsequent steps.
 ```yaml
 - uses: astral-sh/ruff-action@v4.0.0
 - run: ruff check --fix
 - run: ruff format
 ```
 By default, this action runs `ruff check` after installation.
 If you do not want to run any `ruff` command but only install it,
 you can use the `args` input to overwrite the default value (`check`):
 ```yaml
 - name: Install ruff without running check or format
  uses: astral-sh/ruff-action@v4.0.0
  with:
    args: "--version"
 ```
 ### Use `ruff format`
 ```yaml
- uses: astral-sh/ruff-action@v1
+- uses: astral-sh/ruff-action@v4.0.0
  with:
-    args: "format --check"
+    args: "format --check --diff"
 ```
-### Only run ruff on changed files
+### Install specific versions
 By default this action searches upward from `src` until the workspace root to find the nearest
 `pyproject.toml` and determine the Ruff version to install. If no `pyproject.toml` file is found,
 or no Ruff version is defined in `project.dependencies`, `project.optional-dependencies`,
 `dependency-groups`, or supported Poetry dependency tables, the latest version is installed.
 > [!NOTE]
 > This action does only support ruff versions v0.0.247 and above.
 #### Install the latest version
 ```yaml
- uses: astral-sh/ruff-action@v1
+- name: Install the latest version of ruff
  uses: astral-sh/ruff-action@v4.0.0
  with:
-    changed-files: "true"
+    version: "latest"
 ```
-## License
+#### Install a specific version
 ```yaml
 - name: Install a specific version of ruff
  uses: astral-sh/ruff-action@v4.0.0
  with:
    version: "0.4.4"
 ```
 #### Install a version by supplying a semver range or pep440 specifier
 You can specify a [semver range](https://github.com/npm/node-semver?tab=readme-ov-file#ranges)
 or [pep440 specifier](https://peps.python.org/pep-0440/#version-specifiers)
 to install the latest version that satisfies the range.
 ```yaml
 - name: Install a semver range of ruff
  uses: astral-sh/ruff-action@v4.0.0
  with:
    version: ">=0.4.0"
 ```
 ```yaml
 - name: Pinning a minor version of ruff
  uses: astral-sh/ruff-action@v4.0.0
  with:
    version: "0.4.x"
 ```
 ```yaml
 - name: Install a pep440-specifier-satisfying version of ruff
  uses: astral-sh/ruff-action@v4.0.0
  with:
    version: ">=0.11.10,<0.12.0"
 ```
 #### Install a version from a specified version file
 You can specify a file to read the version from.
 Currently `pyproject.toml`, `requirements.txt` and `uv.lock` are supported. If the file cannot
 be parsed or does not contain a Ruff version, the action warns and falls back to `latest`.
 ```yaml
 - name: Install a version from a specified version file
  uses: astral-sh/ruff-action@v4.0.0
  with:
    version-file: "my-path/to/pyproject.toml-requirements.txt-or-uv.lock"
 ```
 Version resolution precedence is:
 1. `version`
 2. `version-file`
 3. nearest discoverable `pyproject.toml` found by searching upward from `src`
 4. `latest`
 #### Install using a custom manifest URL
 You can override the default `astral-sh/versions` manifest with `manifest-file`.
 This affects both version resolution and artifact selection.
 ```yaml
 - name: Install Ruff from a custom manifest
  uses: astral-sh/ruff-action@v4.0.0
  with:
    version: "latest"
    manifest-file: "https://example.com/ruff.ndjson"
 ```
 ### Validate checksum
 You can specify a checksum to validate the downloaded executable. Checksums up to the default version
 are automatically verified by this action. The sha256 hashes can be found on the
 [releases page](https://github.com/astral-sh/ruff/releases) of the ruff repo.
 ```yaml
 - name: Install a specific version and validate the checksum
  uses: astral-sh/ruff-action@v4.0.0
  with:
    version: "0.7.4"
    checksum: "0de731c669b9ece77e799ac3f4a160c30849752714d9775c94cc4cfaf326860c"
 ```
 ### GitHub authentication token
 By default, this action resolves available Ruff versions from
 [`astral-sh/versions`](https://github.com/astral-sh/versions) and downloads release artifacts from `https://releases.astral.sh`. If this fails this action falls back to downloading from the GitHub releases page of the Ruff repository.
 Set `download-from-astral-mirror` to `false` to skip the Astral mirror and download directly from GitHub Releases.
 You can provide a token via `github-token` to authenticate GitHub Releases downloads. By default, the
 `GITHUB_TOKEN` secret is used, which is automatically provided by GitHub Actions.
 If the default
 [permissions for the GitHub token](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
 are not sufficient, you can provide a custom GitHub token with the necessary permissions.
 ```yaml
 - name: Install the latest version of ruff with a custom GitHub token
  uses: astral-sh/ruff-action@v4.0.0
  with:
    github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
 ```
 ## Outputs
 | Output         | Description                             |
 |----------------|-----------------------------------------|
 | `ruff-version` | The version of Ruff that was installed. |
 Apache
 <div align="center">
  <a target="_blank" href="https://astral.sh" style="background:none">
    <img src="https://raw.githubusercontent.com/astral-sh/uv/main/assets/svg/Astral.svg" alt="Made by Astral">
  </a>
 </div>
 [Configuring Ruff]: https://github.com/astral-sh/ruff/blob/main/docs/configuration.md
 [github.workspace]: https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#github-context
@@ -0,0 +1 @@
 {"version":"0.15.10","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://github.com/astral-sh/ruff/releases/download/0.15.10/ruff-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"e3e9e5c791542f00d95edc74a506e1ac24efc0af9574de01ab338187bf1ff9f6"}]}
@@ -0,0 +1,537 @@
 import { beforeEach, describe, expect, it, jest } from "@jest/globals";
 import * as semver from "semver";
 const mockInfo = jest.fn();
 const mockWarning = jest.fn();
 jest.unstable_mockModule("@actions/core", () => ({
  debug: jest.fn(),
  info: mockInfo,
  warning: mockWarning,
 }));
 const mockDownloadTool = jest.fn();
 const mockExtractTar = jest.fn();
 const mockExtractZip = jest.fn();
 const mockCacheDir = jest.fn();
 jest.unstable_mockModule("@actions/tool-cache", () => ({
  cacheDir: mockCacheDir,
  downloadTool: mockDownloadTool,
  evaluateVersions: (versions: string[], range: string) =>
    semver.maxSatisfying(versions, range) ?? "",
  extractTar: mockExtractTar,
  extractZip: mockExtractZip,
  find: () => "",
  findAllVersions: () => [],
  isExplicitVersion: (version: string) => semver.valid(version) !== null,
 }));
 const mockGetLatestVersion = jest.fn();
 const mockGetAllVersions = jest.fn();
 const mockGetArtifact = jest.fn();
 jest.unstable_mockModule("../../src/download/manifest", () => ({
  getAllVersions: mockGetAllVersions,
  getArtifact: mockGetArtifact,
  getLatestVersion: mockGetLatestVersion,
 }));
 const mockValidateChecksum = jest.fn();
 jest.unstable_mockModule("../../src/download/checksum/checksum", () => ({
  validateChecksum: mockValidateChecksum,
 }));
 const mockCopyFile = jest.fn();
 const mockReaddir = jest.fn();
 jest.unstable_mockModule("node:fs", () => ({
  default: {},
  promises: {
    copyFile: mockCopyFile,
    readdir: mockReaddir,
  },
 }));
 const { downloadVersion, rewriteToMirror } = await import(
  "../../src/download/download-version"
 );
 const { resolveVersion } = await import("../../src/version/resolve");
 describe("download-version", () => {
  beforeEach(() => {
    mockInfo.mockReset();
    mockWarning.mockReset();
    mockDownloadTool.mockReset();
    mockExtractTar.mockReset();
    mockExtractZip.mockReset();
    mockCacheDir.mockReset();
    mockGetLatestVersion.mockReset();
    mockGetAllVersions.mockReset();
    mockGetArtifact.mockReset();
    mockValidateChecksum.mockReset();
    mockCopyFile.mockReset();
    mockReaddir.mockReset();
    mockDownloadTool.mockResolvedValue("/tmp/downloaded");
    mockExtractTar.mockResolvedValue("/tmp/extracted");
    mockExtractZip.mockResolvedValue("/tmp/extracted");
    mockCacheDir.mockResolvedValue("/tmp/cached");
    mockReaddir.mockResolvedValue(["ruff"]);
  });
  describe("resolveVersion", () => {
    it("uses the default manifest to resolve latest", async () => {
      mockGetLatestVersion.mockResolvedValue("0.15.8");
      const version = await resolveVersion("latest", undefined);
      expect(version).toBe("0.15.8");
      expect(mockGetLatestVersion).toHaveBeenCalledTimes(1);
      expect(mockGetLatestVersion).toHaveBeenCalledWith(undefined);
    });
    it("uses the default manifest to resolve available versions", async () => {
      mockGetAllVersions.mockResolvedValue(["0.15.8", "0.15.7"]);
      const version = await resolveVersion("0.15.x", undefined);
      expect(version).toBe("0.15.8");
      expect(mockGetAllVersions).toHaveBeenCalledTimes(1);
      expect(mockGetAllVersions).toHaveBeenCalledWith(undefined);
    });
    it("uses manifest-file when provided", async () => {
      mockGetAllVersions.mockResolvedValue(["0.15.8", "0.15.7"]);
      const version = await resolveVersion(
        "0.15.x",
        "https://example.com/custom.ndjson",
      );
      expect(version).toBe("0.15.8");
      expect(mockGetAllVersions).toHaveBeenCalledWith(
        "https://example.com/custom.ndjson",
      );
    });
  });
  describe("downloadVersion", () => {
    it("fails when manifest lookup fails", async () => {
      mockGetArtifact.mockRejectedValue(new Error("manifest unavailable"));
      await expect(
        downloadVersion(
          "unknown-linux-gnu",
          "x86_64",
          "0.15.8",
          undefined,
          "token",
        ),
      ).rejects.toThrow("manifest unavailable");
      expect(mockDownloadTool).not.toHaveBeenCalled();
      expect(mockValidateChecksum).not.toHaveBeenCalled();
    });
    it("fails when no matching artifact exists in the default manifest", async () => {
      mockGetArtifact.mockResolvedValue(undefined);
      await expect(
        downloadVersion(
          "unknown-linux-gnu",
          "x86_64",
          "0.15.8",
          undefined,
          "token",
        ),
      ).rejects.toThrow(
        "Could not find artifact for version 0.15.8, arch x86_64, platform unknown-linux-gnu in https://raw.githubusercontent.com/astral-sh/versions/main/v1/ruff.ndjson .",
      );
      expect(mockDownloadTool).not.toHaveBeenCalled();
      expect(mockValidateChecksum).not.toHaveBeenCalled();
    });
    it("uses built-in checksums for default manifest downloads", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "manifest-checksum-that-should-be-ignored",
        downloadUrl: "https://example.com/ruff.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        undefined,
        "token",
      );
      expect(mockValidateChecksum).toHaveBeenCalledWith(
        undefined,
        "/tmp/downloaded",
        "x86_64",
        "unknown-linux-gnu",
        "0.15.8",
      );
    });
    it("rewrites GitHub Releases URLs to the Astral mirror", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        undefined,
        "token",
      );
      expect(mockDownloadTool).toHaveBeenCalledWith(
        "https://releases.astral.sh/github/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
        undefined,
        undefined,
      );
    });
    it("does not rewrite non-GitHub URLs", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl: "https://example.com/ruff.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        undefined,
        "token",
      );
      expect(mockDownloadTool).toHaveBeenCalledWith(
        "https://example.com/ruff.tar.gz",
        undefined,
        undefined,
      );
    });
    it("falls back to GitHub Releases when the mirror download fails", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
      });
      mockDownloadTool
        .mockRejectedValueOnce(new Error("mirror unavailable"))
        .mockResolvedValueOnce("/tmp/downloaded");
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        undefined,
        "token",
      );
      expect(mockDownloadTool).toHaveBeenCalledTimes(2);
      expect(mockDownloadTool).toHaveBeenNthCalledWith(
        1,
        "https://releases.astral.sh/github/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
        undefined,
        undefined,
      );
      expect(mockDownloadTool).toHaveBeenNthCalledWith(
        2,
        "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
        undefined,
        "token",
      );
      expect(mockWarning).toHaveBeenCalledWith(
        "Failed to download from mirror, falling back to GitHub Releases: mirror unavailable",
      );
    });
    it("falls back to the canonical old GitHub Releases URL", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.4.7/ruff-x86_64-unknown-linux-gnu.tar.gz",
      });
      mockDownloadTool
        .mockRejectedValueOnce(new Error("mirror unavailable"))
        .mockResolvedValueOnce("/tmp/downloaded");
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.4.7",
        undefined,
        "token",
      );
      expect(mockDownloadTool).toHaveBeenNthCalledWith(
        2,
        "https://github.com/astral-sh/ruff/releases/download/v0.4.7/ruff-0.4.7-x86_64-unknown-linux-gnu.tar.gz",
        undefined,
        "token",
      );
    });
    it("does not fall back when checksum validation fails", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
      });
      mockValidateChecksum.mockRejectedValue(new Error("bad checksum"));
      await expect(
        downloadVersion(
          "unknown-linux-gnu",
          "x86_64",
          "0.15.8",
          undefined,
          "token",
        ),
      ).rejects.toThrow("bad checksum");
      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
      expect(mockWarning).not.toHaveBeenCalled();
    });
    it("does not fall back when extraction fails", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
      });
      mockExtractTar.mockRejectedValue(new Error("extract failed"));
      await expect(
        downloadVersion(
          "unknown-linux-gnu",
          "x86_64",
          "0.15.8",
          undefined,
          "token",
        ),
      ).rejects.toThrow("extract failed");
      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
      expect(mockWarning).not.toHaveBeenCalled();
    });
    it("does not fall back for non-GitHub URLs", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl: "https://example.com/ruff.tar.gz",
      });
      mockDownloadTool.mockRejectedValue(new Error("download failed"));
      await expect(
        downloadVersion(
          "unknown-linux-gnu",
          "x86_64",
          "0.15.8",
          undefined,
          "token",
        ),
      ).rejects.toThrow("download failed");
      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
    });
    it("skips the Astral mirror when downloadFromAstralMirror is false", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        undefined,
        "token",
        undefined,
        false,
      );
      expect(mockDownloadTool).toHaveBeenCalledWith(
        "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
        undefined,
        "token",
      );
      expect(mockDownloadTool).toHaveBeenCalledTimes(1);
    });
    it("uses manifest-file checksum metadata when checksum input is unset", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "manifest-checksum",
        downloadUrl: "https://example.com/custom-ruff.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        "",
        "token",
        "https://example.com/custom.ndjson",
      );
      expect(mockValidateChecksum).toHaveBeenCalledWith(
        "manifest-checksum",
        "/tmp/downloaded",
        "x86_64",
        "unknown-linux-gnu",
        "0.15.8",
      );
    });
    it("prefers checksum input over manifest-file checksum metadata", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "manifest-checksum",
        downloadUrl: "https://example.com/custom-ruff.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        "user-checksum",
        "token",
        "https://example.com/custom.ndjson",
      );
      expect(mockValidateChecksum).toHaveBeenCalledWith(
        "user-checksum",
        "/tmp/downloaded",
        "x86_64",
        "unknown-linux-gnu",
        "0.15.8",
      );
    });
    it("preserves tar extraction behavior for newer versions", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl: "https://example.com/ruff.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.15.8",
        "user-checksum",
        "token",
      );
      expect(mockExtractTar).toHaveBeenCalledWith("/tmp/downloaded");
      expect(mockCacheDir).toHaveBeenCalledWith(
        "/tmp/extracted/ruff-x86_64-unknown-linux-gnu",
        "ruff",
        "0.15.8",
        "x86_64",
      );
    });
    it("preserves tar extraction behavior for older versions", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "tar.gz",
        checksum: "abc123",
        downloadUrl: "https://example.com/ruff.tar.gz",
      });
      await downloadVersion(
        "unknown-linux-gnu",
        "x86_64",
        "0.4.10",
        undefined,
        "token",
      );
      expect(mockCacheDir).toHaveBeenCalledWith(
        "/tmp/extracted",
        "ruff",
        "0.4.10",
        "x86_64",
      );
    });
    it("preserves zip extraction behavior on Windows", async () => {
      mockGetArtifact.mockResolvedValue({
        archiveFormat: "zip",
        checksum: "abc123",
        downloadUrl: "https://example.com/ruff.zip",
      });
      await downloadVersion(
        "pc-windows-msvc",
        "x86_64",
        "0.15.8",
        undefined,
        "token",
      );
      expect(mockCopyFile).toHaveBeenCalledWith(
        "/tmp/downloaded",
        "/tmp/downloaded.zip",
      );
      expect(mockExtractZip).toHaveBeenCalledWith("/tmp/downloaded.zip");
      expect(mockCacheDir).toHaveBeenCalledWith(
        "/tmp/extracted",
        "ruff",
        "0.15.8",
        "x86_64",
      );
    });
  });
  describe("rewriteToMirror", () => {
    it("rewrites a GitHub Releases URL to the Astral mirror", () => {
      expect(
        rewriteToMirror(
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
        ),
      ).toBe(
        "https://releases.astral.sh/github/ruff/releases/download/0.15.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
      );
    });
    it("returns undefined for non-GitHub URLs", () => {
      expect(
        rewriteToMirror("https://example.com/ruff.tar.gz"),
      ).toBeUndefined();
    });
    it("returns undefined for a different GitHub repo", () => {
      expect(
        rewriteToMirror(
          "https://github.com/other/repo/releases/download/v1.0/file.tar.gz",
        ),
      ).toBeUndefined();
    });
  });
 });
@@ -0,0 +1,196 @@
 import { beforeEach, describe, expect, it, jest } from "@jest/globals";
 const mockFetch = jest.fn();
 jest.unstable_mockModule("@actions/core", () => ({
  debug: jest.fn(),
  info: jest.fn(),
 }));
 jest.unstable_mockModule("../../src/utils/fetch", () => ({
  fetch: mockFetch,
 }));
 const {
  clearManifestCache,
  fetchManifest,
  getAllVersions,
  getArtifact,
  getLatestVersion,
  parseManifest,
 } = await import("../../src/download/manifest");
 const sampleManifestResponse = `{"version":"0.15.8","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f"},{"platform":"x86_64-pc-windows-msvc","variant":"default","url":"https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-pc-windows-msvc.zip","archive_format":"zip","sha256":"eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036"}]}
 {"version":"0.15.7","artifacts":[{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/ruff/releases/download/0.15.7/ruff-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"606b3c6949d971709f2526fa0d9f0fd23ccf60e09f117999b406b424af18a6a6"}]}`;
 const multiVariantManifestResponse = `{"version":"0.15.8","artifacts":[{"platform":"aarch64-apple-darwin","variant":"python-managed","url":"https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-aarch64-apple-darwin-managed.tar.gz","archive_format":"tar.gz","sha256":"managed-checksum"},{"platform":"aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-aarch64-apple-darwin.zip","archive_format":"zip","sha256":"default-checksum"}]}`;
 const oldVersionManifestResponse = `{"version":"v0.4.7","artifacts":[{"platform":"0.4.7-aarch64-apple-darwin","variant":"default","url":"https://github.com/astral-sh/ruff/releases/download/v0.4.7/ruff-0.4.7-aarch64-apple-darwin.tar.gz","archive_format":"tar.gz","sha256":"old-checksum"}]}`;
 function createMockResponse(
  ok: boolean,
  status: number,
  statusText: string,
  data: string,
 ) {
  return {
    ok,
    status,
    statusText,
    text: async () => data,
  };
 }
 describe("manifest", () => {
  beforeEach(() => {
    clearManifestCache();
    mockFetch.mockReset();
  });
  describe("fetchManifest", () => {
    it("fetches and parses manifest data", async () => {
      mockFetch.mockResolvedValue(
        createMockResponse(true, 200, "OK", sampleManifestResponse),
      );
      const versions = await fetchManifest();
      expect(versions).toHaveLength(2);
      expect(versions[0]?.version).toBe("0.15.8");
      expect(versions[1]?.version).toBe("0.15.7");
    });
    it("throws on a failed fetch", async () => {
      mockFetch.mockResolvedValue(
        createMockResponse(false, 500, "Internal Server Error", ""),
      );
      await expect(fetchManifest()).rejects.toThrow(
        "Failed to fetch manifest data: 500 Internal Server Error",
      );
    });
    it("caches results per URL", async () => {
      mockFetch.mockResolvedValue(
        createMockResponse(true, 200, "OK", sampleManifestResponse),
      );
      await fetchManifest("https://example.com/custom.ndjson");
      await fetchManifest("https://example.com/custom.ndjson");
      expect(mockFetch).toHaveBeenCalledTimes(1);
    });
  });
  describe("getAllVersions", () => {
    it("returns all version strings", async () => {
      mockFetch.mockResolvedValue(
        createMockResponse(true, 200, "OK", sampleManifestResponse),
      );
      const versions = await getAllVersions(
        "https://example.com/custom.ndjson",
      );
      expect(versions).toEqual(["0.15.8", "0.15.7"]);
    });
  });
  describe("getLatestVersion", () => {
    it("returns the first version string", async () => {
      mockFetch.mockResolvedValue(
        createMockResponse(true, 200, "OK", sampleManifestResponse),
      );
      await expect(
        getLatestVersion("https://example.com/custom.ndjson"),
      ).resolves.toBe("0.15.8");
    });
  });
  describe("getArtifact", () => {
    beforeEach(() => {
      mockFetch.mockResolvedValue(
        createMockResponse(true, 200, "OK", sampleManifestResponse),
      );
    });
    it("finds an artifact by version and platform", async () => {
      const artifact = await getArtifact("0.15.8", "aarch64", "apple-darwin");
      expect(artifact).toEqual({
        archiveFormat: "tar.gz",
        checksum:
          "fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-aarch64-apple-darwin.tar.gz",
      });
    });
    it("finds a windows artifact", async () => {
      const artifact = await getArtifact("0.15.8", "x86_64", "pc-windows-msvc");
      expect(artifact).toEqual({
        archiveFormat: "zip",
        checksum:
          "eb02fd95d8e0eed462b4a67ecdd320d865b38c560bffcda9a0b87ec944bdf036",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-x86_64-pc-windows-msvc.zip",
      });
    });
    it("prefers the default variant when multiple artifacts share a platform", async () => {
      mockFetch.mockResolvedValue(
        createMockResponse(true, 200, "OK", multiVariantManifestResponse),
      );
      const artifact = await getArtifact("0.15.8", "aarch64", "apple-darwin");
      expect(artifact).toEqual({
        archiveFormat: "zip",
        checksum: "default-checksum",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/0.15.8/ruff-aarch64-apple-darwin.zip",
      });
    });
    it("finds an old artifact when the manifest version has a v prefix", async () => {
      mockFetch.mockResolvedValue(
        createMockResponse(true, 200, "OK", oldVersionManifestResponse),
      );
      const artifact = await getArtifact("0.4.7", "aarch64", "apple-darwin");
      expect(artifact).toEqual({
        archiveFormat: "tar.gz",
        checksum: "old-checksum",
        downloadUrl:
          "https://github.com/astral-sh/ruff/releases/download/v0.4.7/ruff-0.4.7-aarch64-apple-darwin.tar.gz",
      });
    });
    it("returns undefined for an unknown version", async () => {
      const artifact = await getArtifact("0.0.1", "aarch64", "apple-darwin");
      expect(artifact).toBeUndefined();
    });
    it("returns undefined for an unknown platform", async () => {
      const artifact = await getArtifact(
        "0.15.8",
        "aarch64",
        "unknown-linux-musl",
      );
      expect(artifact).toBeUndefined();
    });
  });
  describe("parseManifest", () => {
    it("throws for malformed manifest data", () => {
      expect(() => parseManifest('{"version":"0.1.0"', "test-source")).toThrow(
        "Failed to parse manifest data from test-source",
      );
    });
  });
 });
@@ -0,0 +1 @@
 Random file content
@@ -0,0 +1,13 @@
 [project]
 name = "pyython-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
    "ruff==0.6.2",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1 @@
 print("hello")
@@ -0,0 +1 @@
 print("deeper")
@@ -0,0 +1 @@
 print("check me")
@@ -0,0 +1,2 @@
 # This file should be ignored when using foo/bar/*.py glob
 print("ignore me")
@@ -0,0 +1,13 @@
 [project]
 name = "glob-single-star-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
    "ruff==0.6.2",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,13 @@
 [project]
 name = "malformed-python-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
    "ruff>=0.6.2",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,6 @@
 def hello() -> str:
    string_with_single_quotes = 'Hello from malformed-python-project!'
    return f"{string_with_single_quotes}"
@@ -0,0 +1,4 @@
 import sys
 print("Hello world!")
 print('How are you?')
@@ -0,0 +1,13 @@
 [project]
 name = "parent-config-project"
 version = "0.1.0"
 description = "Test fixture for parent directory pyproject.toml search"
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
    "ruff==0.10.0",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,3 @@
 """Hello world example."""
 print("Hello, world!")
@@ -0,0 +1,15 @@
 [project]
 name = "pyproject-dependency-dev-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 [dependency-groups]
 dev = [
    "ruff==0.8.3"
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,2 @@
 def hello() -> str:
    return "Hello from python-project!"
@@ -0,0 +1 @@
 print("Hello world!")
@@ -0,0 +1,22 @@
 [project]
 name = "pyproject-dependency-groups-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 [dependency-groups]
 dev = [
    { include-group = "docs" },
    { include-group = "lint" },
 ]
 docs = [
    "sphinx",
 ]
 lint = [
    "ruff==0.8.3",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,2 @@
 def hello() -> str:
    return "Hello from python-project!"
@@ -0,0 +1 @@
 print("Hello world!")
@@ -0,0 +1,15 @@
 [project]
 name = "pyproject-dependency-groups-with-env-marker"
 version = "0.1.0"
 description = "Test fixture for issue #256 - environment markers"
 readme = "README.md"
 requires-python = ">=3.12"
 [dependency-groups]
 dev = [
    "ruff~=0.13 ; python_version >= '3.11'",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,14 @@
 [project]
 name = "pyproject-dependency-poetry-grouped-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 [tool.poetry.group.dev.dependencies]
 sphinx = "*"
 ruff = "0.8.3"
 [build-system]
 requires = ["poetry-core>=2.0.0,<3.0.0"]
 build-backend = "poetry.core.masonry.api"
@@ -0,0 +1,2 @@
 def hello() -> str:
    return "Hello from python-project!"
@@ -0,0 +1 @@
 print("Hello world!")
@@ -0,0 +1,14 @@
 [project]
 name = "pyproject-dependency-poetry-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 [tool.poetry.dependencies]
 sphinx = "*"
 ruff = "~0.8.2"
 [build-system]
 requires = ["poetry-core>=2.0.0,<3.0.0"]
 build-backend = "poetry.core.masonry.api"
@@ -0,0 +1,2 @@
 def hello() -> str:
    return "Hello from python-project!"
@@ -0,0 +1 @@
 print("Hello world!")
@@ -0,0 +1,15 @@
 [project]
 name = "pyproject-optional-dependencies-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 [project.optional-dependencies]
 lint = [
    "ruff==0.8.3",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,2 @@
 def hello() -> str:
    return "Hello from python-project!"
@@ -0,0 +1 @@
 print("Hello world!")
@@ -0,0 +1,13 @@
 [project]
 name = "pyython-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
    "ruff==0.9.3",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,13 @@
 [project]
 name = "pyython-project"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
    "ruff==0.6.2",
 ]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
@@ -0,0 +1,2 @@
 def hello() -> str:
    return "Hello from python-project!"
@@ -0,0 +1 @@
 print("Hello world!")
@@ -0,0 +1,2 @@
 ruff==0.9.0 \
    --hash=sha256:badc0de
@@ -0,0 +1 @@
 ruff==0.9.0
@@ -0,0 +1,20 @@
 version = 1
 revision = 1
 requires-python = ">=3.11"
 [[package]]
 name = "example-project"
 version = "0.1.0"
 source = { editable = "." }
 dependencies = [
    { name = "ruff" },
 ]
 [package.metadata]
 requires-dist = [{ name = "ruff", specifier = ">=0.9.0" }]
 [[package]]
 name = "ruff"
 version = "0.9.5"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/source/r/ruff/ruff-0.9.5.tar.gz", hash = "sha256:11aecd7a633932875ab3cb05a484c99970b9d52606ce9ea912b690b02653d56c", size = 3634177 }
@@ -0,0 +1,122 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { beforeEach, describe, expect, it, jest } from "@jest/globals";
 const debug = jest.fn();
 const info = jest.fn();
 jest.unstable_mockModule("@actions/core", () => ({
  debug,
  info,
 }));
 const { findPyprojectToml } = await import("../../src/utils/pyproject-finder");
 const testFilePath = fileURLToPath(import.meta.url);
 const testDir = path.dirname(testFilePath);
 const repoRoot = path.resolve(testDir, "..", "..");
 const fixturesDir = path.join(repoRoot, "__tests__", "fixtures");
 describe("findPyprojectToml", () => {
  beforeEach(() => {
    debug.mockReset();
    info.mockReset();
  });
  describe("when pyproject.toml exists in src directory", () => {
    it("should return the exact path", () => {
      const result = findPyprojectToml(fixturesDir, repoRoot);
      expect(result).toContain("pyproject.toml");
      expect(result).toContain("fixtures");
      expect(info).toHaveBeenCalled();
    });
  });
  describe("when pyproject.toml exists only in parent directory", () => {
    it("should search upwards and find the parent's pyproject.toml", () => {
      const subprojectDir = path.join(
        fixturesDir,
        "parent-config-project",
        "subproject",
      );
      const result = findPyprojectToml(subprojectDir, repoRoot);
      expect(result).toBeTruthy();
      expect(result).toContain("pyproject.toml");
      expect(result).toContain("parent-config-project");
      expect(info).toHaveBeenCalled();
    });
  });
  describe("boundary conditions", () => {
    it("should stop searching at workspace root and return undefined when not found", () => {
      const nodeModulesDir = path.join(repoRoot, "node_modules", "@actions");
      const result = findPyprojectToml(nodeModulesDir, repoRoot);
      expect(result).toBeUndefined();
      expect(info).not.toHaveBeenCalledWith(
        expect.stringContaining("Found pyproject.toml"),
      );
    });
    it("should find pyproject.toml when it exists at workspace root", () => {
      const parentConfigProjectDir = path.join(
        fixturesDir,
        "parent-config-project",
      );
      const subprojectDir = path.join(parentConfigProjectDir, "subproject");
      const result = findPyprojectToml(subprojectDir, parentConfigProjectDir);
      expect(result).toBeTruthy();
      expect(result).toContain("pyproject.toml");
      expect(result).toContain("parent-config-project");
    });
    it("should stop at workspace root even if searching from it", () => {
      const result = findPyprojectToml(fixturesDir, fixturesDir);
      expect(result).toBeTruthy();
      expect(result).toContain("pyproject.toml");
      expect(result).toContain("fixtures");
    });
  });
  describe("edge cases", () => {
    it("should handle relative paths", () => {
      const result = findPyprojectToml("./__tests__/fixtures", ".");
      expect(result).toBeTruthy();
      expect(result).toContain("pyproject.toml");
    });
    it("should handle when src equals workspace root", () => {
      const result = findPyprojectToml(fixturesDir, fixturesDir);
      expect(result).toBeTruthy();
      expect(result).toContain("pyproject.toml");
      expect(result).toContain("fixtures");
    });
    it("should log debug messages for each checked path", () => {
      const pythonProjectDir = path.join(fixturesDir, "python-project");
      findPyprojectToml(pythonProjectDir, repoRoot);
      expect(debug).toHaveBeenCalled();
      expect(debug.mock.calls.length).toBeGreaterThan(0);
      expect(debug.mock.calls[0][0]).toContain("Checking for");
      expect(debug.mock.calls[0][0]).toContain("python-project");
    });
    it("should handle paths with trailing slashes", () => {
      const result = findPyprojectToml(`${fixturesDir}/`, repoRoot);
      expect(result).toBeTruthy();
      expect(result).toContain("pyproject.toml");
    });
  });
 });
@@ -0,0 +1,374 @@
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { afterEach, describe, expect, it, jest } from "@jest/globals";
 jest.unstable_mockModule("@actions/core", () => ({
  debug: jest.fn(),
  info: jest.fn(),
 }));
 const {
  expandSourceInput,
  getSourceBasePath,
  getVersionSourceDirectory,
  splitInput,
 } = await import("../../src/utils/source-input");
 const { findPyprojectToml } = await import("../../src/utils/pyproject-finder");
 let tempDir: string | undefined;
 afterEach(async () => {
  if (tempDir !== undefined) {
    await fs.rm(tempDir, { force: true, recursive: true });
    tempDir = undefined;
  }
 });
 async function createTempProject(): Promise<string> {
  tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "ruff-action-source-"));
  await fs.mkdir(path.join(tempDir, "src", "package", "nested"), {
    recursive: true,
  });
  await fs.writeFile(path.join(tempDir, "src", "package", "__init__.py"), "");
  await fs.writeFile(path.join(tempDir, "src", "package", "main.py"), "");
  await fs.writeFile(
    path.join(tempDir, "src", "package", "nested", "mod.py"),
    "",
  );
  await fs.writeFile(path.join(tempDir, "src", "package", "notes.txt"), "");
  await fs.mkdir(path.join(tempDir, "src", "pkg[legacy]"), {
    recursive: true,
  });
  await fs.writeFile(path.join(tempDir, "src", "pkg[legacy]", "main.py"), "");
  await fs.mkdir(path.join(tempDir, "src", "pkgl"), { recursive: true });
  await fs.writeFile(path.join(tempDir, "src", "pkgl", "main.py"), "");
  return tempDir;
 }
 describe("splitInput", () => {
  it("splits whitespace-delimited inputs", () => {
    expect(splitInput(" check   --fix\n--diff ")).toEqual([
      "check",
      "--fix",
      "--diff",
    ]);
  });
  it("returns an empty array for empty input", () => {
    expect(splitInput("  \n\t ")).toEqual([]);
  });
 });
 describe("expandSourceInput", () => {
  it("leaves non-glob sources unchanged", async () => {
    await expect(expandSourceInput("src file.py")).resolves.toEqual([
      "src",
      "file.py",
    ]);
  });
  it("expands recursive globs without relying on shell behavior", async () => {
    const projectDir = await createTempProject();
    const pattern = path.join(projectDir, "src", "**", "*.py");
    await expect(expandSourceInput(pattern)).resolves.toEqual([
      path.join(projectDir, "src", "package", "__init__.py"),
      path.join(projectDir, "src", "package", "main.py"),
      path.join(projectDir, "src", "package", "nested", "mod.py"),
      path.join(projectDir, "src", "pkg[legacy]", "main.py"),
      path.join(projectDir, "src", "pkgl", "main.py"),
    ]);
  });
  it("preserves relative source patterns as relative paths", async () => {
    const projectDir = await createTempProject();
    const originalCwd = process.cwd();
    try {
      process.chdir(projectDir);
      await expect(expandSourceInput("src/**/*.py")).resolves.toEqual([
        path.join("src", "package", "__init__.py"),
        path.join("src", "package", "main.py"),
        path.join("src", "package", "nested", "mod.py"),
        path.join("src", "pkg[legacy]", "main.py"),
        path.join("src", "pkgl", "main.py"),
      ]);
    } finally {
      process.chdir(originalCwd);
    }
  });
  it("maps relative root glob matches to . instead of an empty argument", async () => {
    const projectDir = await createTempProject();
    const originalCwd = process.cwd();
    try {
      process.chdir(projectDir);
      for (const pattern of ["**", "**/", "./**"]) {
        const sources = await expandSourceInput(pattern);
        expect(sources).toContain(".");
        expect(sources).not.toContain("");
      }
    } finally {
      process.chdir(originalCwd);
    }
  });
  it("excludes hidden paths by default while allowing explicit hidden patterns", async () => {
    const projectDir = await createTempProject();
    const originalCwd = process.cwd();
    await fs.mkdir(path.join(projectDir, ".venv"));
    await fs.writeFile(path.join(projectDir, ".venv", "ignored.py"), "");
    await fs.mkdir(path.join(projectDir, ".tox"));
    await fs.writeFile(path.join(projectDir, ".tox", "ignored.py"), "");
    try {
      process.chdir(projectDir);
      const defaultSources = await expandSourceInput("**/*.py");
      expect(defaultSources).not.toContain(path.join(".venv", "ignored.py"));
      expect(defaultSources).not.toContain(path.join(".tox", "ignored.py"));
      await expect(expandSourceInput(".venv/**/*.py")).resolves.toEqual([
        path.join(".venv", "ignored.py"),
      ]);
    } finally {
      process.chdir(originalCwd);
    }
  });
  it("preserves unmatched globs for Ruff to report", async () => {
    const projectDir = await createTempProject();
    const pattern = path.join(projectDir, "src", "**", "missing-*.py");
    await expect(expandSourceInput(pattern)).resolves.toEqual([pattern]);
  });
  it("expands multiple sources in input order", async () => {
    const projectDir = await createTempProject();
    const first = path.join(projectDir, "src", "package", "main.py");
    const second = path.join(projectDir, "src", "package", "nested", "*.py");
    await expect(expandSourceInput(`${first} ${second}`)).resolves.toEqual([
      first,
      path.join(projectDir, "src", "package", "nested", "mod.py"),
    ]);
  });
  it("uses @actions/glob syntax for paths that contain glob metacharacters", async () => {
    const projectDir = await createTempProject();
    await expect(
      expandSourceInput(path.join(projectDir, "src", "pkg[legacy]")),
    ).resolves.toEqual([path.join(projectDir, "src", "pkgl")]);
    await expect(
      expandSourceInput(path.join(projectDir, "src", "pkg[legacy]", "*.py")),
    ).resolves.toEqual([path.join(projectDir, "src", "pkgl", "main.py")]);
  });
  it("supports @actions/glob escaping for literal glob metacharacters", async () => {
    const projectDir = await createTempProject();
    const pattern = path.join(projectDir, "src", "pkg[[]legacy]", "*.py");
    await expect(expandSourceInput(pattern)).resolves.toEqual([
      path.join(projectDir, "src", "pkg[legacy]", "main.py"),
    ]);
  });
  it("does not traverse symlinked directories", async () => {
    const projectDir = await createTempProject();
    const externalDir = path.join(projectDir, "external");
    const symlinkPath = path.join(projectDir, "src", "linked");
    await fs.mkdir(externalDir);
    await fs.writeFile(path.join(externalDir, "external.py"), "");
    await fs.symlink(externalDir, symlinkPath, "dir");
    const sources = await expandSourceInput(
      path.join(projectDir, "src", "**", "*.py"),
    );
    expect(sources).not.toContain(path.join(symlinkPath, "external.py"));
  });
  it("still expands missing paths that contain glob metacharacters", async () => {
    const projectDir = await createTempProject();
    const pattern = path.join(projectDir, "src", "pkg[l]");
    await expect(expandSourceInput(pattern)).resolves.toEqual([
      path.join(projectDir, "src", "pkgl"),
    ]);
  });
 });
 describe("getVersionSourceDirectory", () => {
  it("does not scan src globs when version input is explicit", async () => {
    await expect(
      getVersionSourceDirectory("../**/*.py", "0.1.0", undefined),
    ).resolves.toBe(".");
  });
  it("does not scan src globs when version-file input is explicit", async () => {
    await expect(
      getVersionSourceDirectory("../**/*.py", undefined, "pyproject.toml"),
    ).resolves.toBe(".");
  });
  it("uses source discovery when no version input is explicit", async () => {
    await expect(
      getVersionSourceDirectory("../**/*.py", undefined, undefined),
    ).rejects.toThrow("Invalid pattern '../**/*.py'");
  });
 });
 describe("getSourceBasePath", () => {
  it("returns the directory for a plain path", async () => {
    await expect(getSourceBasePath("my-project")).resolves.toBe("my-project");
  });
  it("returns the directory for a dotted path", async () => {
    await expect(getSourceBasePath("./src")).resolves.toBe("./src");
  });
  it("preserves filesystem root paths", async () => {
    const root = path.parse(process.cwd()).root;
    await expect(getSourceBasePath(root)).resolves.toBe(root);
  });
  it("strips glob pattern and returns parent directory", async () => {
    await expect(getSourceBasePath("src/**/*.py")).resolves.toBe("src");
  });
  it("returns . for a top-level glob", async () => {
    await expect(getSourceBasePath("*.py")).resolves.toBe(".");
  });
  it("returns . for empty string", async () => {
    await expect(getSourceBasePath("")).resolves.toBe(".");
  });
  it("uses only the first whitespace-delimited token", async () => {
    await expect(getSourceBasePath("sub1/*.py sub2/")).resolves.toBe("sub1");
  });
  it("handles trailing slash in prefix", async () => {
    await expect(getSourceBasePath("sub/*.py")).resolves.toBe("sub");
  });
  it("uses the parent directory when a glob appears in a filename", async () => {
    await expect(getSourceBasePath("src/file*.py")).resolves.toBe("src");
  });
  it("handles ? glob", async () => {
    await expect(getSourceBasePath("file?.py")).resolves.toBe(".");
  });
  it("handles bracket glob", async () => {
    await expect(getSourceBasePath("file[0-9].py")).resolves.toBe(".");
  });
  it("uses @actions/glob syntax for base paths with glob metacharacters", async () => {
    const projectDir = await createTempProject();
    const originalCwd = process.cwd();
    try {
      process.chdir(projectDir);
      await expect(getSourceBasePath("src/pkg[legacy]")).resolves.toBe(
        path.join("src", "pkgl"),
      );
      await expect(getSourceBasePath("src/pkg[legacy]/*.py")).resolves.toBe(
        path.join("src", "pkgl", "main.py"),
      );
    } finally {
      process.chdir(originalCwd);
    }
  });
  it("supports @actions/glob escaping for version discovery from literal glob metacharacters", async () => {
    const projectDir = await createTempProject();
    const originalCwd = process.cwd();
    const pyprojectPath = path.join(
      projectDir,
      "src",
      "pkg[legacy]",
      "pyproject.toml",
    );
    await fs.writeFile(
      pyprojectPath,
      "[project]\ndependencies = ['ruff==0.6.2']\n",
    );
    try {
      process.chdir(projectDir);
      const sourceBasePath = await getSourceBasePath(
        "src/pkg[[]legacy]/main.py",
      );
      expect(findPyprojectToml(sourceBasePath, projectDir)).toBe(
        await fs.realpath(pyprojectPath),
      );
    } finally {
      process.chdir(originalCwd);
    }
  });
  it("uses the first expanded glob match for version discovery", async () => {
    const projectDir = await createTempProject();
    const originalCwd = process.cwd();
    const pyprojectPath = path.join(
      projectDir,
      "packages",
      "foo",
      "pyproject.toml",
    );
    await fs.mkdir(path.join(projectDir, "packages", "foo", "src"), {
      recursive: true,
    });
    await fs.writeFile(
      pyprojectPath,
      "[project]\ndependencies = ['ruff==0.10.0']\n",
    );
    await fs.writeFile(
      path.join(projectDir, "packages", "foo", "src", "module.py"),
      "",
    );
    try {
      process.chdir(projectDir);
      const sourceBasePath = await getSourceBasePath("packages/*/src/**/*.py");
      expect(sourceBasePath).toBe(
        path.join("packages", "foo", "src", "module.py"),
      );
      const workspaceRoot = await fs.realpath(projectDir);
      expect(findPyprojectToml(sourceBasePath, workspaceRoot)).toBe(
        await fs.realpath(pyprojectPath),
      );
    } finally {
      process.chdir(originalCwd);
    }
  });
  it("uses the unmatched glob fallback when version-discovery glob has no matches", async () => {
    const projectDir = await createTempProject();
    const originalCwd = process.cwd();
    await fs.mkdir(path.join(projectDir, "packages"));
    try {
      process.chdir(projectDir);
      await expect(getSourceBasePath("packages/*/src/**/*.py")).resolves.toBe(
        "packages",
      );
    } finally {
      process.chdir(originalCwd);
    }
  });
  it("does not treat brace expansion as glob syntax", async () => {
    await expect(getSourceBasePath("src/{a,b}/*.py")).resolves.toBe(
      "src/{a,b}",
    );
  });
 });
@@ -0,0 +1,151 @@
 import { beforeEach, describe, expect, it, jest } from "@jest/globals";
 const info = jest.fn();
 const warning = jest.fn();
 jest.unstable_mockModule("@actions/core", () => ({
  debug: jest.fn(),
  info,
  warning,
 }));
 const {
  findRuffVersionInSpec,
  getRuffVersionFromFile,
  getRuffVersionFromUvLockContent,
 } = await import("../../src/version/file-parser");
 describe("file-parser", () => {
  beforeEach(() => {
    info.mockReset();
    warning.mockReset();
  });
  describe("findRuffVersionInSpec", () => {
    it("extracts version from 'ruff==0.9.3'", () => {
      const result = findRuffVersionInSpec("ruff==0.9.3");
      expect(result).toBe("0.9.3");
      expect(info).toHaveBeenCalledWith(
        "Found ruff version in requirements file: 0.9.3",
      );
      expect(warning).not.toHaveBeenCalled();
    });
    it("extracts version from 'ruff>=0.14'", () => {
      const result = findRuffVersionInSpec("ruff>=0.14");
      expect(result).toBe(">=0.14");
      expect(warning).not.toHaveBeenCalled();
    });
    it("extracts version from 'ruff ~=1.0.0'", () => {
      const result = findRuffVersionInSpec("ruff ~=1.0.0");
      expect(result).toBe("~=1.0.0");
      expect(warning).not.toHaveBeenCalled();
    });
    it("extracts version from 'ruff>=0.14,<1.0'", () => {
      const result = findRuffVersionInSpec("ruff>=0.14,<1.0");
      expect(result).toBe(">=0.14,<1.0");
      expect(warning).not.toHaveBeenCalled();
    });
    it("extracts version from 'ruff>=0.14,<2.0,!=1.5.0'", () => {
      const result = findRuffVersionInSpec("ruff>=0.14,<2.0,!=1.5.0");
      expect(result).toBe(">=0.14,<2.0,!=1.5.0");
      expect(warning).not.toHaveBeenCalled();
    });
    it("returns undefined for non-ruff dependencies", () => {
      const result = findRuffVersionInSpec("another-dep==0.1.6");
      expect(result).toBeUndefined();
      expect(info).not.toHaveBeenCalled();
      expect(warning).not.toHaveBeenCalled();
    });
    it("strips trailing backslash", () => {
      const result = findRuffVersionInSpec("ruff==0.9.3 \\");
      expect(result).toBe("0.9.3");
      expect(info).toHaveBeenCalledWith(
        "Found ruff version in requirements file: 0.9.3",
      );
      expect(warning).not.toHaveBeenCalled();
    });
    it("strips environment markers and warns", () => {
      const result = findRuffVersionInSpec(
        'ruff>=0.14 ; python_version >= "3.11"',
      );
      expect(result).toBe(">=0.14");
      expect(info).toHaveBeenCalledWith(
        "Found ruff version in requirements file: >=0.14",
      );
      expect(warning).toHaveBeenCalledWith(
        "Environment markers are ignored. ruff is a standalone tool that works independently of Python version.",
      );
    });
    it("handles whitespace", () => {
      const result = findRuffVersionInSpec("  ruff  >=0.14  ");
      expect(result).toBe(">=0.14");
      expect(warning).not.toHaveBeenCalled();
    });
    it("returns undefined for empty strings", () => {
      const result = findRuffVersionInSpec("");
      expect(result).toBeUndefined();
      expect(info).not.toHaveBeenCalled();
      expect(warning).not.toHaveBeenCalled();
    });
  });
  describe("getRuffVersionFromFile", () => {
    it("reads the version from requirements.txt", () => {
      const result = getRuffVersionFromFile(
        "__tests__/fixtures/requirements.txt",
      );
      expect(result).toBe("0.9.0");
    });
    it("reads the version from requirements files with hashes", () => {
      const result = getRuffVersionFromFile(
        "__tests__/fixtures/requirements-with-hash.txt",
      );
      expect(result).toBe("0.9.0");
    });
    it("reads the version from pyproject.toml dependencies", () => {
      const result = getRuffVersionFromFile(
        "__tests__/fixtures/pyproject.toml",
      );
      expect(result).toBe("0.9.3");
    });
    it("reads the version from Poetry dependencies", () => {
      const result = getRuffVersionFromFile(
        "__tests__/fixtures/pyproject-dependency-poetry-project/pyproject.toml",
      );
      expect(result).toBe("~0.8.2");
    });
    it("reads the version from uv.lock", () => {
      const result = getRuffVersionFromFile("__tests__/fixtures/uv.lock");
      expect(result).toBe("0.9.5");
    });
  });
  describe("getRuffVersionFromUvLockContent", () => {
    it("extracts the ruff version from uv.lock content", () => {
      const result = getRuffVersionFromUvLockContent(
        '[[package]]\nname = "other"\nversion = "1.0.0"\n\n[[package]]\nname = "ruff"\nversion = "0.9.5"\n',
      );
      expect(result).toBe("0.9.5");
    });
    it("returns undefined when ruff is not in uv.lock", () => {
      const result = getRuffVersionFromUvLockContent(
        '[[package]]\nname = "other"\nversion = "1.0.0"\n',
      );
      expect(result).toBeUndefined();
    });
  });
 });
@@ -0,0 +1,164 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import {
  afterEach,
  beforeEach,
  describe,
  expect,
  it,
  jest,
 } from "@jest/globals";
 const debug = jest.fn();
 const info = jest.fn();
 const warning = jest.fn();
 jest.unstable_mockModule("@actions/core", () => ({
  debug,
  info,
  warning,
 }));
 const { resolveVersionRequest } = await import(
  "../../src/version/version-request-resolver"
 );
 const tempDirs: string[] = [];
 function createTempProject(files: Record<string, string> = {}): string {
  const dir = fs.mkdtempSync(
    path.join(os.tmpdir(), "ruff-action-version-test-"),
  );
  tempDirs.push(dir);
  for (const [relativePath, content] of Object.entries(files)) {
    const filePath = path.join(dir, relativePath);
    fs.mkdirSync(path.dirname(filePath), { recursive: true });
    fs.writeFileSync(filePath, content);
  }
  return dir;
 }
 afterEach(() => {
  for (const dir of tempDirs.splice(0)) {
    fs.rmSync(dir, { force: true, recursive: true });
  }
 });
 describe("resolveVersionRequest", () => {
  beforeEach(() => {
    debug.mockReset();
    info.mockReset();
    warning.mockReset();
  });
  it("prefers explicit input over workspace discovery", () => {
    const workspaceRoot = createTempProject({
      "pyproject.toml": `[project]\ndependencies = ["ruff==0.5.14"]\n`,
    });
    const request = resolveVersionRequest({
      sourceDirectory: workspaceRoot,
      version: "==0.6.0",
      workspaceRoot,
    });
    expect(request).toEqual({
      source: "input",
      specifier: "0.6.0",
    });
  });
  it("uses requirements.txt when it is passed via version-file", () => {
    const workspaceRoot = createTempProject({
      "requirements.txt": "ruff==0.6.17\nruff-api==0.1.0\n",
    });
    const request = resolveVersionRequest({
      sourceDirectory: workspaceRoot,
      versionFile: path.join(workspaceRoot, "requirements.txt"),
      workspaceRoot,
    });
    expect(request).toEqual({
      format: "requirements",
      source: "version-file",
      sourcePath: path.join(workspaceRoot, "requirements.txt"),
      specifier: "0.6.17",
    });
  });
  it("warns and falls back to latest when version-file does not resolve a version", () => {
    const workspaceRoot = createTempProject({
      "requirements.txt": "ruff-api==0.1.0\n",
    });
    const request = resolveVersionRequest({
      sourceDirectory: workspaceRoot,
      versionFile: path.join(workspaceRoot, "requirements.txt"),
      workspaceRoot,
    });
    expect(request).toEqual({
      source: "default",
      specifier: "latest",
    });
    expect(warning).toHaveBeenCalledWith(
      `Could not parse version from ${path.join(workspaceRoot, "requirements.txt")}. Using latest version.`,
    );
  });
  it("discovers pyproject.toml by searching upward from src", () => {
    const workspaceRoot = createTempProject({
      "pyproject.toml": `[project]\ndependencies = ["ruff==0.10.0"]\n`,
      "subproject/nested/example.py": 'print("hello")\n',
    });
    const sourceDirectory = path.join(workspaceRoot, "subproject", "nested");
    const request = resolveVersionRequest({
      sourceDirectory,
      workspaceRoot,
    });
    expect(request).toEqual({
      format: "pyproject.toml",
      source: "pyproject.toml",
      sourcePath: path.join(workspaceRoot, "pyproject.toml"),
      specifier: "0.10.0",
    });
  });
  it("falls back to latest when no workspace version source is found", () => {
    const workspaceRoot = createTempProject({
      "subproject/example.py": 'print("hello")\n',
    });
    const request = resolveVersionRequest({
      sourceDirectory: path.join(workspaceRoot, "subproject"),
      workspaceRoot,
    });
    expect(request).toEqual({
      source: "default",
      specifier: "latest",
    });
    expect(info).toHaveBeenCalledWith(
      "Could not find pyproject.toml. Using latest version.",
    );
  });
  it("throws when both version and version-file are specified", () => {
    const workspaceRoot = createTempProject();
    expect(() =>
      resolveVersionRequest({
        sourceDirectory: workspaceRoot,
        version: "0.6.0",
        versionFile: path.join(workspaceRoot, "requirements.txt"),
        workspaceRoot,
      }),
    ).toThrow("It is not allowed to specify both version and version-file");
  });
 });
@@ -7,41 +7,37 @@ inputs:
    required: false
    default: "check"
  src:
-    description: "Source to run Ruff. Defaults to the current directory."
+    description: "Source path(s) or @actions/glob pattern(s) to run Ruff on. Defaults to the current workspace."
    required: false
-    default: "."
+    default: ${{ github.workspace }}
  version:
-    description: 'The version of Ruff to use, e.g., `0.6.0` Defaults to the latest version.'
+    description: "The version of Ruff to use, e.g., `0.6.0`. Defaults to the first discoverable version in pyproject.toml searched upward from `src`, or `latest`."
    required: false
    default: ""
-  changed-files:
+  version-file:
-    description: 'Whether to only run Ruff on changed files. Defaults to `false`.'
+    description: "Path to a pyproject.toml, requirements.txt or uv.lock file to read the version from. If parsing fails, the action warns and falls back to `latest`."
    required: false
-    default: "false"
+  checksum:
-branding:
+    description: "The checksum of the ruff version to install"
-  color: "black"
+    required: false
-  icon: "code"
+  manifest-file:
    description: "URL to a custom manifest file in the astral-sh/versions format."
    required: false
  download-from-astral-mirror:
    description: "Download Ruff from the Astral mirror instead of directly from GitHub Releases."
    required: false
    default: "true"
  github-token:
    description:
      "Used for authenticated downloads of Ruff release artifacts from GitHub."
    required: false
    default: ${{ github.token }}
 outputs:
  ruff-version:
    description: "The installed ruff version. Useful when using latest."
 runs:
-  using: composite
+  using: "node24"
-  steps:
+  main: "dist/ruff-action/index.cjs"
-    - name: Get changed files
+branding:
-      id: changed-files
+  icon: "code"
-      if: ${{ inputs.changed-files == 'true' }}
+  color: "black"
      uses: tj-actions/changed-files@v45
      with:
        files: '**.py'
    - run: |
        if [ "$RUNNER_OS" == "Windows" ]; then
          python $GITHUB_ACTION_PATH/action/main.py
        else
          python3 $GITHUB_ACTION_PATH/action/main.py
        fi
      env:
        RUFF_OUTPUT_FORMAT: github
        INPUT_ARGS: ${{ inputs.args }}
        INPUT_SRC: ${{ inputs.src }}
        INPUT_VERSION: ${{ inputs.version }}
        IS_CHANGED_FILES_ENABLED: ${{ inputs.changed-files }}
        CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
        pythonioencoding: utf-8
      shell: bash
@@ -1,36 +0,0 @@
 """GitHub Action for Ruff."""
 import os
 import re
 import shlex
 import sys
 from pathlib import Path
 from subprocess import run
 ACTION_PATH = Path(os.environ["GITHUB_ACTION_PATH"])
 ARGS = os.getenv("INPUT_ARGS", default="")
 SRC = os.getenv("INPUT_SRC", default="")
 VERSION = os.getenv("INPUT_VERSION", default="")
 CHANGED_FILES = os.getenv("CHANGED_FILES", "")
 IS_CHANGED_FILES_ENABLED = os.getenv("IS_CHANGED_FILES_ENABLED", default="false")
 version_specifier = ""
 if VERSION != "":
    if not re.match(r"v?\d\.\d{1,3}\.\d{1,3}$", VERSION):
        print("VERSION does not match expected pattern")
        sys.exit(1)
    version_specifier = f"=={VERSION}"
 req = f"ruff{version_specifier}"
 # If `CHANGED_FILES` is not empty, split it into a list; otherwise, use `SRC`.
 files_to_check = shlex.split(CHANGED_FILES or SRC)
 # If IS_CHANGED_FILES_ENABLED is true and CHANGED_FILES was empty, there were no files to check
 # Short circuit to prevent ruff from running on all files because it got no file argument
 if IS_CHANGED_FILES_ENABLED == "true" and not CHANGED_FILES:
    sys.exit(0)
 proc = run(["pipx", "run", req, *shlex.split(ARGS), *files_to_check])
 sys.exit(proc.returncode)
@@ -0,0 +1,45 @@
 {
  "$schema": "https://biomejs.dev/schemas/2.4.9/schema.json",
  "assist": {
    "actions": {
      "source": {
        "organizeImports": "on",
        "useSortedAttributes": "on",
        "useSortedKeys": "on"
      }
    }
  },
  "files": {
    "ignoreUnknown": false,
    "includes": [
      "**",
      "!**/coverage",
      "!**/dist",
      "!**/lib",
      "!**/node_modules",
      "!**/package*.json",
      "!**/known-checksums.*"
    ]
  },
  "formatter": {
    "enabled": true,
    "indentStyle": "space"
  },
  "javascript": {
    "formatter": {
      "quoteStyle": "double",
      "trailingCommas": "all"
    }
  },
  "linter": {
    "enabled": true,
    "rules": {
      "recommended": true
    }
  },
  "vcs": {
    "clientKind": "git",
    "enabled": true,
    "useIgnoreFile": false
  }
 }
@@ -0,0 +1,12 @@
 import { createDefaultEsmPreset } from "ts-jest";
 const preset = createDefaultEsmPreset();
 /** @type {import('jest').Config} */
 export default {
  ...preset,
  collectCoverageFrom: ["src/**/*.ts", "!src/**/*.d.ts"],
  moduleFileExtensions: ["ts", "js", "mjs"],
  testEnvironment: "node",
  testMatch: ["<rootDir>/__tests__/**/*.test.ts"],
 };
@@ -0,0 +1,54 @@
 {
  "name": "ruff-action",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "description": "A GitHub Action to run Ruff, an extremely fast Python linter and code formatter.",
  "main": "dist/ruff-action/index.cjs",
  "scripts": {
    "build": "tsc --noEmit",
    "check": "biome check --write",
    "package": "node scripts/build-dist.mjs",
    "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
    "update-known-checksums": "RUNNER_TEMP=known_checksums node dist/update-known-checksums/index.cjs src/download/checksum/known-checksums.ts \"$(gh auth token)\"",
    "test:unit": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js",
    "test": "npm run build && npm run test:unit",
    "all": "npm run build && npm run check && npm run package && npm run test:unit"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/astral-sh/ruff-action.git"
  },
  "keywords": [
    "actions",
    "python",
    "ruff",
    "action"
  ],
  "author": "@eifinger",
  "license": "Apache-2.0",
  "dependencies": {
    "@actions/core": "^3.0.0",
    "@actions/exec": "^3.0.0",
    "@actions/glob": "^0.7.0",
    "@actions/tool-cache": "^4.0.0",
    "@octokit/core": "^7.0.6",
    "@octokit/plugin-paginate-rest": "^13.1.1",
    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
    "@renovatebot/pep440": "^4.2.1",
    "smol-toml": "^1.6.0",
    "undici": "^6.24.1"
  },
  "devDependencies": {
    "@biomejs/biome": "^2.4.7",
    "@types/jest": "^29.5.14",
    "@types/js-yaml": "^4.0.9",
    "@types/node": "^25.5.0",
    "@types/semver": "^7.7.1",
    "esbuild": "^0.27.4",
    "jest": "^30.3.0",
    "js-yaml": "^4.1.1",
    "ts-jest": "^29.4.6",
    "typescript": "^5.9.3"
  }
 }
@@ -1,18 +0,0 @@
 [tool.ruff]
 target-version = "py311"
 [tool.ruff.lint]
 extend-select = ["B", "UP"]
 fixable = ["I", "RUF100"]
 unfixable = []
 [tool.pyright]
 typeCheckingMode = "lazy"
 defineConstant = { DEBUG = true }
 reportMissingImports = false
 reportMissingTypeStubs = false
 reportInvalidStringEscapeSequence = false
 pythonVersion = "3.11"
 pythonPlatform = "Linux"
@@ -0,0 +1,41 @@
 import { mkdir, rm } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { build } from "esbuild";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const repoRoot = path.resolve(__dirname, "..");
 const builds = [
  {
    entryPoint: path.join(repoRoot, "src", "ruff-action.ts"),
    outfile: path.join(repoRoot, "dist", "ruff-action", "index.cjs"),
    staleOutfile: path.join(repoRoot, "dist", "ruff-action", "index.js"),
  },
  {
    entryPoint: path.join(repoRoot, "src", "update-known-checksums.ts"),
    outfile: path.join(repoRoot, "dist", "update-known-checksums", "index.cjs"),
    staleOutfile: path.join(
      repoRoot,
      "dist",
      "update-known-checksums",
      "index.js",
    ),
  },
 ];
 await Promise.all(
  builds.map(async ({ entryPoint, outfile, staleOutfile }) => {
    await rm(staleOutfile, { force: true });
    await mkdir(path.dirname(outfile), { recursive: true });
    await build({
      bundle: true,
      entryPoints: [entryPoint],
      format: "cjs",
      outfile,
      platform: "node",
      target: "node24",
    });
  }),
 );
@@ -0,0 +1,57 @@
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as core from "@actions/core";
 import type { Architecture, Platform } from "../../utils/platforms";
 import { KNOWN_CHECKSUMS } from "./known-checksums";
 export async function validateChecksum(
  checkSum: string | undefined,
  downloadPath: string,
  arch: Architecture,
  platform: Platform,
  version: string,
 ): Promise<void> {
  let isValid: boolean | undefined;
  if (checkSum !== undefined && checkSum !== "") {
    isValid = await validateFileCheckSum(downloadPath, checkSum);
  } else {
    core.debug("Checksum not provided. Checking known checksums.");
    const key = `${arch}-${platform}-${version}`;
    if (key in KNOWN_CHECKSUMS) {
      const knownChecksum = KNOWN_CHECKSUMS[`${arch}-${platform}-${version}`];
      core.debug(`Checking checksum for ${arch}-${platform}-${version}.`);
      isValid = await validateFileCheckSum(downloadPath, knownChecksum);
    } else {
      core.debug(`No known checksum found for ${key}.`);
    }
  }
  if (isValid === false) {
    throw new Error(`Checksum for ${downloadPath} did not match ${checkSum}.`);
  }
  if (isValid === true) {
    core.debug(`Checksum for ${downloadPath} is valid.`);
  }
 }
 async function validateFileCheckSum(
  filePath: string,
  expected: string,
 ): Promise<boolean> {
  return new Promise((resolve, reject) => {
    const hash = crypto.createHash("sha256");
    const stream = fs.createReadStream(filePath);
    stream.on("error", (err) => reject(err));
    stream.on("data", (chunk) => hash.update(chunk));
    stream.on("end", () => {
      const actual = hash.digest("hex");
      resolve(actual === expected);
    });
  });
 }
 export function isknownVersion(version: string): boolean {
  const pattern = new RegExp(`^.*-.*-${version}$`);
  return Object.keys(KNOWN_CHECKSUMS).some((key) => pattern.test(key));
 }
@@ -0,0 +1,65 @@
 import { promises as fs } from "node:fs";
 import * as tc from "@actions/tool-cache";
 import { KNOWN_CHECKSUMS } from "./known-checksums";
 export async function updateChecksums(
  filePath: string,
  downloadUrls: string[],
 ): Promise<void> {
  await fs.rm(filePath);
  await fs.appendFile(
    filePath,
    "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n",
  );
  let firstLine = true;
  for (const downloadUrl of downloadUrls) {
    const key = getKey(downloadUrl);
    if (key === undefined) {
      continue;
    }
    const checksum = await getOrDownloadChecksum(key, downloadUrl);
    if (!firstLine) {
      await fs.appendFile(filePath, ",\n");
    }
    await fs.appendFile(filePath, `  "${key}":\n    "${checksum}"`);
    firstLine = false;
  }
  await fs.appendFile(filePath, ",\n};\n");
 }
 function getKey(downloadUrl: string): string | undefined {
  const parts = downloadUrl.split("/");
  const version = parts[parts.length - 2].replace("v", "");
  const fileName = parts[parts.length - 1];
  if (fileName.startsWith("source")) {
    return undefined;
  }
  if (fileName.includes(version)) {
    // https://github.com/astral-sh/ruff/releases/download/v0.4.10/ruff-0.4.10-aarch64-apple-darwin.tar.gz.sha256
    const name = fileName.split(version)[1].split(".")[0].substring(1);
    return `${name}-${version}`;
  }
  // https://github.com/astral-sh/ruff/releases/download/v0.1.7/ruff-aarch64-apple-darwin.tar.gz.sha256
  // or
  // https://github.com/astral-sh/ruff/releases/download/0.8.0/ruff-aarch64-apple-darwin.tar.gz.sha256
  const name = fileName.split(".")[0].split("ruff-")[1];
  return `${name}-${version}`;
 }
 async function getOrDownloadChecksum(
  key: string,
  downloadUrl: string,
 ): Promise<string> {
  let checksum: string;
  if (key in KNOWN_CHECKSUMS) {
    checksum = KNOWN_CHECKSUMS[key];
  } else {
    const content = await downloadAssetContent(downloadUrl);
    checksum = content.split(" ")[0].trim();
  }
  return checksum;
 }
 async function downloadAssetContent(downloadUrl: string): Promise<string> {
  const downloadPath = await tc.downloadTool(downloadUrl);
  return await fs.readFile(downloadPath, "utf8");
 }
@@ -0,0 +1,226 @@
 import { promises as fs } from "node:fs";
 import * as path from "node:path";
 import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
 import * as semver from "semver";
 import {
  ASTRAL_MIRROR_PREFIX,
  GITHUB_RELEASES_PREFIX,
  TOOL_CACHE_NAME,
  VERSIONS_MANIFEST_URL,
 } from "../utils/constants";
 import type { Architecture, Platform } from "../utils/platforms";
 import { validateChecksum } from "./checksum/checksum";
 import { getArtifact } from "./manifest";
 export function tryGetFromToolCache(
  arch: Architecture,
  version: string,
 ): { version: string; installedPath: string | undefined } {
  core.debug(`Trying to get ruff from tool cache for ${version}...`);
  const cachedVersions = tc.findAllVersions(TOOL_CACHE_NAME, arch);
  core.debug(`Cached versions: ${cachedVersions}`);
  let resolvedVersion = tc.evaluateVersions(cachedVersions, version);
  if (resolvedVersion === "") {
    resolvedVersion = version;
  }
  const installedPath = tc.find(TOOL_CACHE_NAME, resolvedVersion, arch);
  return { installedPath, version: resolvedVersion };
 }
 export async function downloadVersion(
  platform: Platform,
  arch: Architecture,
  version: string,
  checksum: string | undefined,
  githubToken: string,
  manifestUrl?: string,
  downloadFromAstralMirror = true,
 ): Promise<{ version: string; cachedToolDir: string }> {
  const artifact = await getArtifact(version, arch, platform, manifestUrl);
  if (!artifact) {
    throw new Error(
      getMissingArtifactMessage(version, arch, platform, manifestUrl),
    );
  }
  // For the default astral-sh/versions source, checksum validation relies on
  // user input or the built-in KNOWN_CHECKSUMS table, not manifest sha256 values.
  const resolvedChecksum =
    manifestUrl === undefined
      ? checksum
      : resolveChecksum(checksum, artifact.checksum);
  const downloadPath = await downloadArtifact(
    artifact.downloadUrl,
    platform,
    arch,
    version,
    getDownloadToken(artifact.downloadUrl, githubToken),
    downloadFromAstralMirror,
  );
  await validateChecksum(
    resolvedChecksum,
    downloadPath,
    arch,
    platform,
    version,
  );
  const extractedDir = await extractDownloadedArtifact(
    version,
    downloadPath,
    getExtension(platform),
    platform,
    `ruff-${arch}-${platform}`,
  );
  const cachedToolDir = await tc.cacheDir(
    extractedDir,
    TOOL_CACHE_NAME,
    version,
    arch,
  );
  return { cachedToolDir, version };
 }
 /**
 * Rewrite a GitHub Releases URL to the Astral mirror.
 * Returns `undefined` if the URL does not match the expected GitHub prefix.
 */
 export function rewriteToMirror(url: string): string | undefined {
  if (!url.startsWith(GITHUB_RELEASES_PREFIX)) {
    return undefined;
  }
  return ASTRAL_MIRROR_PREFIX + url.slice(GITHUB_RELEASES_PREFIX.length);
 }
 async function downloadArtifact(
  downloadUrl: string,
  platform: Platform,
  arch: Architecture,
  version: string,
  githubToken: string | undefined,
  downloadFromAstralMirror: boolean,
 ): Promise<string> {
  const mirrorUrl = downloadFromAstralMirror
    ? rewriteToMirror(downloadUrl)
    : undefined;
  const resolvedDownloadUrl = mirrorUrl ?? downloadUrl;
  try {
    return await downloadFile(
      resolvedDownloadUrl,
      mirrorUrl !== undefined ? undefined : githubToken,
    );
  } catch (err) {
    if (mirrorUrl === undefined) {
      throw err;
    }
    core.warning(
      `Failed to download from mirror, falling back to GitHub Releases: ${(err as Error).message}`,
    );
    return await downloadFile(
      constructDownloadUrl(version, platform, arch),
      githubToken,
    );
  }
 }
 async function downloadFile(
  downloadUrl: string,
  githubToken: string | undefined,
 ): Promise<string> {
  core.info(`Downloading ruff from "${downloadUrl}" ...`);
  const downloadPath = await tc.downloadTool(
    downloadUrl,
    undefined,
    githubToken,
  );
  core.debug(`Downloaded ruff to "${downloadPath}"`);
  return downloadPath;
 }
 async function extractDownloadedArtifact(
  version: string,
  downloadPath: string,
  extension: string,
  platform: Platform,
  artifact: string,
 ): Promise<string> {
  let ruffDir: string;
  if (platform === "pc-windows-msvc") {
    const fullPathWithExtension = `${downloadPath}${extension}`;
    await fs.copyFile(downloadPath, fullPathWithExtension);
    ruffDir = await tc.extractZip(fullPathWithExtension);
    // On windows extracting the zip does not create an intermediate directory.
  } else {
    ruffDir = await tc.extractTar(downloadPath);
    if (semver.gte(version, "v0.5.0")) {
      // Since v0.5.0 an intermediate directory is created
      ruffDir = path.join(ruffDir, artifact);
    }
  }
  const files = await fs.readdir(ruffDir);
  core.debug(`Contents of ${ruffDir}: ${files.join(", ")}`);
  return ruffDir;
 }
 function getMissingArtifactMessage(
  version: string,
  arch: Architecture,
  platform: Platform,
  manifestUrl?: string,
 ): string {
  if (manifestUrl === undefined) {
    return `Could not find artifact for version ${version}, arch ${arch}, platform ${platform} in ${VERSIONS_MANIFEST_URL} .`;
  }
  return `manifest-file does not contain version ${version}, arch ${arch}, platform ${platform}.`;
 }
 function resolveChecksum(
  checksum: string | undefined,
  manifestChecksum: string,
 ): string {
  return checksum !== undefined && checksum !== ""
    ? checksum
    : manifestChecksum;
 }
 function getDownloadToken(
  downloadUrl: string,
  githubToken: string,
 ): string | undefined {
  return downloadUrl.startsWith(GITHUB_RELEASES_PREFIX)
    ? githubToken
    : undefined;
 }
 function constructDownloadUrl(
  version: string,
  platform: Platform,
  arch: Architecture,
 ): string {
  const normalizedVersion = stripVersionPrefix(version);
  const artifactVersionSuffix =
    semver.lte(version, "v0.4.10") && semver.gte(version, "v0.1.8")
      ? `-${normalizedVersion}`
      : "";
  const artifact = `ruff${artifactVersionSuffix}-${arch}-${platform}`;
  const versionPrefix = semver.lte(version, "v0.4.10") ? "v" : "";
  return `${GITHUB_RELEASES_PREFIX}${versionPrefix}${normalizedVersion}/${artifact}${getExtension(platform)}`;
 }
 function stripVersionPrefix(version: string): string {
  return version.startsWith("v") ? version.slice(1) : version;
 }
 function getExtension(platform: Platform): string {
  return platform === "pc-windows-msvc" ? ".zip" : ".tar.gz";
 }
@@ -0,0 +1,243 @@
 import * as core from "@actions/core";
 import { VERSIONS_MANIFEST_URL } from "../utils/constants";
 import { fetch } from "../utils/fetch";
 import { selectDefaultVariant } from "./variant-selection";
 export interface ManifestArtifact {
  platform: string;
  variant?: string;
  url: string;
  archive_format: string;
  sha256: string;
 }
 export interface ManifestVersion {
  version: string;
  artifacts: ManifestArtifact[];
 }
 export interface ArtifactResult {
  archiveFormat: string;
  checksum: string;
  downloadUrl: string;
 }
 const cachedManifestData = new Map<string, ManifestVersion[]>();
 export async function fetchManifest(
  manifestUrl: string = VERSIONS_MANIFEST_URL,
 ): Promise<ManifestVersion[]> {
  const cachedVersions = cachedManifestData.get(manifestUrl);
  if (cachedVersions !== undefined) {
    core.debug(`Using cached manifest data from ${manifestUrl}`);
    return cachedVersions;
  }
  core.info(`Fetching manifest data from ${manifestUrl} ...`);
  const response = await fetch(manifestUrl, {});
  if (!response.ok) {
    throw new Error(
      `Failed to fetch manifest data: ${response.status} ${response.statusText}`,
    );
  }
  const body = await response.text();
  const versions = parseManifest(body, manifestUrl);
  cachedManifestData.set(manifestUrl, versions);
  return versions;
 }
 export function parseManifest(
  data: string,
  sourceDescription: string,
 ): ManifestVersion[] {
  const trimmed = data.trim();
  if (trimmed === "") {
    throw new Error(`Manifest at ${sourceDescription} is empty.`);
  }
  if (trimmed.startsWith("[")) {
    throw new Error(
      `Legacy JSON array manifests are no longer supported in ${sourceDescription}. Use the astral-sh/versions manifest format instead.`,
    );
  }
  const versions: ManifestVersion[] = [];
  for (const [index, line] of data.split("\n").entries()) {
    const record = line.trim();
    if (record === "") {
      continue;
    }
    let parsed: unknown;
    try {
      parsed = JSON.parse(record);
    } catch (error) {
      throw new Error(
        `Failed to parse manifest data from ${sourceDescription} at line ${index + 1}: ${(error as Error).message}`,
      );
    }
    if (!isManifestVersion(parsed)) {
      throw new Error(
        `Invalid manifest record in ${sourceDescription} at line ${index + 1}.`,
      );
    }
    versions.push(parsed);
  }
  if (versions.length === 0) {
    throw new Error(`No manifest data found in ${sourceDescription}.`);
  }
  return versions;
 }
 export async function getLatestVersion(
  manifestUrl: string = VERSIONS_MANIFEST_URL,
 ): Promise<string> {
  const latestVersion = (await fetchManifest(manifestUrl))[0]?.version;
  if (latestVersion === undefined) {
    throw new Error("No versions found in manifest data");
  }
  core.debug(`Latest version from manifest: ${latestVersion}`);
  return latestVersion;
 }
 export async function getAllVersions(
  manifestUrl: string = VERSIONS_MANIFEST_URL,
 ): Promise<string[]> {
  core.info(
    `Getting available versions from ${manifestSource(manifestUrl)} ...`,
  );
  const versions = await fetchManifest(manifestUrl);
  return versions.map((versionData) => versionData.version);
 }
 export async function getArtifact(
  version: string,
  arch: string,
  platform: string,
  manifestUrl: string = VERSIONS_MANIFEST_URL,
 ): Promise<ArtifactResult | undefined> {
  const versions = await fetchManifest(manifestUrl);
  const versionData = versions.find((candidate) =>
    matchesManifestVersion(candidate.version, version),
  );
  if (!versionData) {
    core.debug(`Version ${version} not found in manifest ${manifestUrl}`);
    return undefined;
  }
  const targetPlatforms = getTargetPlatforms(
    versionData.version,
    arch,
    platform,
  );
  const matchingArtifacts = versionData.artifacts.filter((candidate) =>
    targetPlatforms.includes(candidate.platform),
  );
  if (matchingArtifacts.length === 0) {
    core.debug(
      `Artifact for ${targetPlatforms.join(" or ")} not found in version ${version}. Available platforms: ${versionData.artifacts
        .map((candidate) => candidate.platform)
        .join(", ")}`,
    );
    return undefined;
  }
  const artifact = selectDefaultVariant(
    matchingArtifacts,
    `Multiple artifacts found for ${targetPlatforms.join(" or ")} in version ${version}`,
  );
  return {
    archiveFormat: artifact.archive_format,
    checksum: artifact.sha256,
    downloadUrl: artifact.url,
  };
 }
 export function clearManifestCache(manifestUrl?: string): void {
  if (manifestUrl === undefined) {
    cachedManifestData.clear();
    return;
  }
  cachedManifestData.delete(manifestUrl);
 }
 function manifestSource(manifestUrl: string): string {
  if (manifestUrl === VERSIONS_MANIFEST_URL) {
    return VERSIONS_MANIFEST_URL;
  }
  return `manifest-file ${manifestUrl}`;
 }
 function matchesManifestVersion(
  manifestVersion: string,
  requestedVersion: string,
 ): boolean {
  return (
    manifestVersion === requestedVersion ||
    manifestVersion === withVersionPrefix(requestedVersion)
  );
 }
 function getTargetPlatforms(
  manifestVersion: string,
  arch: string,
  platform: string,
 ): string[] {
  const targetPlatform = `${arch}-${platform}`;
  const versionPrefixedTargetPlatform = `${stripVersionPrefix(manifestVersion)}-${targetPlatform}`;
  return [targetPlatform, versionPrefixedTargetPlatform];
 }
 function withVersionPrefix(version: string): string {
  return version.startsWith("v") ? version : `v${version}`;
 }
 function stripVersionPrefix(version: string): string {
  return version.startsWith("v") ? version.slice(1) : version;
 }
 function isManifestVersion(value: unknown): value is ManifestVersion {
  if (!isRecord(value)) {
    return false;
  }
  if (typeof value.version !== "string" || !Array.isArray(value.artifacts)) {
    return false;
  }
  return value.artifacts.every(isManifestArtifact);
 }
 function isManifestArtifact(value: unknown): value is ManifestArtifact {
  if (!isRecord(value)) {
    return false;
  }
  const variantIsValid =
    typeof value.variant === "string" || value.variant === undefined;
  return (
    typeof value.archive_format === "string" &&
    typeof value.platform === "string" &&
    typeof value.sha256 === "string" &&
    typeof value.url === "string" &&
    variantIsValid
  );
 }
 function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === "object" && value !== null;
 }
@@ -0,0 +1,39 @@
 interface VariantAwareEntry {
  variant?: string;
 }
 export function selectDefaultVariant<T extends VariantAwareEntry>(
  entries: T[],
  duplicateEntryDescription: string,
 ): T {
  const firstEntry = entries[0];
  if (firstEntry === undefined) {
    throw new Error("selectDefaultVariant requires at least one candidate.");
  }
  if (entries.length === 1) {
    return firstEntry;
  }
  const defaultEntries = entries.filter((entry) =>
    isDefaultVariant(entry.variant),
  );
  if (defaultEntries.length === 1) {
    return defaultEntries[0];
  }
  throw new Error(
    `${duplicateEntryDescription} with variants ${formatVariants(entries)}. ruff-action currently requires a single default variant for duplicate platform entries.`,
  );
 }
 function isDefaultVariant(variant: string | undefined): boolean {
  return variant === undefined || variant === "default";
 }
 function formatVariants<T extends VariantAwareEntry>(entries: T[]): string {
  return entries
    .map((entry) => entry.variant ?? "default")
    .sort((left, right) => left.localeCompare(right))
    .join(", ");
 }
@@ -0,0 +1,149 @@
 import * as path from "node:path";
 import * as core from "@actions/core";
 import * as exec from "@actions/exec";
 import * as semver from "semver";
 import {
  downloadVersion,
  tryGetFromToolCache,
 } from "./download/download-version";
 import {
  args,
  checkSum,
  downloadFromAstralMirror,
  githubToken,
  manifestFile,
  src,
  version,
  versionFile as versionFileInput,
 } from "./utils/inputs";
 import {
  type Architecture,
  getArch,
  getPlatform,
  type Platform,
 } from "./utils/platforms";
 import {
  expandSourceInput,
  getVersionSourceDirectory,
  splitInput,
 } from "./utils/source-input";
 import { resolveRuffVersion } from "./version/resolve";
 async function run(): Promise<void> {
  const platform = getPlatform();
  const arch = getArch();
  try {
    if (platform === undefined) {
      throw new Error(`Unsupported platform: ${process.platform}`);
    }
    if (arch === undefined) {
      throw new Error(`Unsupported architecture: ${process.arch}`);
    }
    const setupResult = await setupRuff(
      platform,
      arch,
      checkSum,
      githubToken,
      downloadFromAstralMirror,
    );
    addRuffToPath(setupResult.ruffDir);
    setOutputFormat();
    addMatchers();
    core.setOutput("ruff-version", setupResult.version);
    core.info(`Successfully installed ruff version ${setupResult.version}`);
    await runRuff(path.join(setupResult.ruffDir, "ruff"), args, src);
    process.exit(0);
  } catch (err) {
    core.setFailed((err as Error).message);
  }
 }
 async function setupRuff(
  platform: Platform,
  arch: Architecture,
  checkSum: string | undefined,
  githubToken: string,
  downloadFromAstralMirror: boolean,
 ): Promise<{ ruffDir: string; version: string }> {
  const resolvedVersion = await determineVersion();
  const manifestUrl = manifestFile || undefined;
  if (semver.lt(resolvedVersion, "v0.0.247")) {
    throw Error(
      "This action does not support ruff versions older than 0.0.247",
    );
  }
  const toolCacheResult = tryGetFromToolCache(arch, resolvedVersion);
  if (toolCacheResult.installedPath) {
    core.info(`Found ruffDir in tool-cache for ${toolCacheResult.version}`);
    return {
      ruffDir: toolCacheResult.installedPath,
      version: toolCacheResult.version,
    };
  }
  const downloadVersionResult = await downloadVersion(
    platform,
    arch,
    resolvedVersion,
    checkSum,
    githubToken,
    manifestUrl,
    downloadFromAstralMirror,
  );
  return {
    ruffDir: downloadVersionResult.cachedToolDir,
    version: downloadVersionResult.version,
  };
 }
 async function determineVersion(): Promise<string> {
  return await resolveRuffVersion({
    manifestFile: manifestFile || undefined,
    sourceDirectory: await getVersionSourceDirectory(
      src,
      version,
      versionFileInput,
    ),
    version,
    versionFile: versionFileInput,
    workspaceRoot: process.env.GITHUB_WORKSPACE || ".",
  });
 }
 function addRuffToPath(cachedPath: string): void {
  core.addPath(cachedPath);
  core.info(`Added ${cachedPath} to the path`);
 }
 function setOutputFormat() {
  core.exportVariable("RUFF_OUTPUT_FORMAT", "github");
  core.info("Set RUFF_OUTPUT_FORMAT to github");
 }
 function addMatchers(): void {
  const actionRoot = getActionRoot();
  const matchersPath = path.join(actionRoot, ".github", "matchers");
  core.info(`##[add-matcher]${path.join(matchersPath, "check.json")}`);
  core.info(`##[add-matcher]${path.join(matchersPath, "format.json")}`);
 }
 function getActionRoot(): string {
  const entrypoint = process.argv[1] ?? process.cwd();
  return path.resolve(path.dirname(entrypoint), "..", "..");
 }
 async function runRuff(
  ruffExecutablePath: string,
  args: string,
  src: string,
 ): Promise<void> {
  const execArgs = [...splitInput(args), ...(await expandSourceInput(src))];
  await exec.exec(ruffExecutablePath, execArgs);
 }
 run();
@@ -0,0 +1,34 @@
 import * as core from "@actions/core";
 import { Octokit } from "@octokit/core";
 import { paginateRest } from "@octokit/plugin-paginate-rest";
 import { restEndpointMethods } from "@octokit/plugin-rest-endpoint-methods";
 import * as semver from "semver";
 import { updateChecksums } from "./download/checksum/update-known-checksums";
 import { OWNER, REPO } from "./utils/constants";
 const PaginatingOctokit = Octokit.plugin(paginateRest, restEndpointMethods);
 async function run(): Promise<void> {
  const checksumFilePath = process.argv.slice(2)[0];
  const githubToken = process.argv.slice(2)[1];
  const octokit = new PaginatingOctokit({ auth: githubToken });
  const response = await octokit.paginate(octokit.rest.repos.listReleases, {
    owner: OWNER,
    repo: REPO,
  });
  const downloadUrls: string[] = response.flatMap((release) =>
    release.assets
      .filter((asset) => asset.name.endsWith(".sha256"))
      .map((asset) => asset.browser_download_url),
  );
  await updateChecksums(checksumFilePath, downloadUrls);
  const latestVersion = response
    .map((release) => release.tag_name)
    .sort(semver.rcompare)[0];
  core.setOutput("latest-version", latestVersion);
 }
 run();
@@ -0,0 +1,9 @@
 export const REPO = "ruff";
 export const OWNER = "astral-sh";
 export const TOOL_CACHE_NAME = "ruff";
 export const VERSIONS_MANIFEST_URL =
  "https://raw.githubusercontent.com/astral-sh/versions/main/v1/ruff.ndjson";
 export const GITHUB_RELEASES_PREFIX =
  "https://github.com/astral-sh/ruff/releases/download/";
 export const ASTRAL_MIRROR_PREFIX =
  "https://releases.astral.sh/github/ruff/releases/download/";
@@ -0,0 +1,21 @@
 import { ProxyAgent, type RequestInit, fetch as undiciFetch } from "undici";
 export function getProxyAgent() {
  const httpProxy = process.env.HTTP_PROXY || process.env.http_proxy;
  if (httpProxy) {
    return new ProxyAgent(httpProxy);
  }
  const httpsProxy = process.env.HTTPS_PROXY || process.env.https_proxy;
  if (httpsProxy) {
    return new ProxyAgent(httpsProxy);
  }
  return undefined;
 }
 export const fetch = async (url: string, opts: RequestInit) =>
  await undiciFetch(url, {
    dispatcher: getProxyAgent(),
    ...opts,
  });
@@ -0,0 +1,20 @@
 import * as core from "@actions/core";
 export const version = core.getInput("version");
 export const checkSum = core.getInput("checksum");
 export const githubToken = core.getInput("github-token");
 export const args = core.getInput("args");
 export const src = core.getInput("src");
 export const versionFile = core.getInput("version-file");
 export const manifestFile = core.getInput("manifest-file");
 export const downloadFromAstralMirror = getBooleanInput(
  "download-from-astral-mirror",
  true,
 );
 function getBooleanInput(name: string, defaultValue: boolean): boolean {
  if (core.getInput(name) === "") {
    return defaultValue;
  }
  return core.getBooleanInput(name);
 }
@@ -0,0 +1,33 @@
 export type Platform =
  | "unknown-linux-gnu"
  | "unknown-linux-musl"
  | "unknown-linux-musleabihf"
  | "apple-darwin"
  | "pc-windows-msvc";
 export type Architecture = "i686" | "x86_64" | "aarch64";
 export function getArch(): Architecture | undefined {
  const arch = process.arch;
  const archMapping: { [key: string]: Architecture } = {
    arm64: "aarch64",
    ia32: "i686",
    x64: "x86_64",
  };
  if (arch in archMapping) {
    return archMapping[arch];
  }
 }
 export function getPlatform(): Platform | undefined {
  const platform = process.platform;
  const platformMapping: { [key: string]: Platform } = {
    darwin: "apple-darwin",
    linux: "unknown-linux-gnu",
    win32: "pc-windows-msvc",
  };
  if (platform in platformMapping) {
    return platformMapping[platform];
  }
 }
@@ -0,0 +1,74 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as core from "@actions/core";
 /**
 * Search for a pyproject.toml file starting from the given source path
 * and traversing upwards through parent directories until reaching
 * the GitHub workspace root.
 *
 * If the source path points to a file, the search begins in that file's
 * parent directory.
 *
 * @param startPath The source path to start the search from (file or directory)
 * @param workspaceRoot The GitHub workspace directory (GITHUB_WORKSPACE)
 * @returns The path to the found pyproject.toml, or undefined if not found
 */
 export function findPyprojectToml(
  startPath: string,
  workspaceRoot: string,
 ): string | undefined {
  let currentDir = resolveStartDirectory(startPath);
  const resolvedWorkspaceRoot = path.resolve(workspaceRoot);
  while (true) {
    const pyprojectPath = path.join(currentDir, "pyproject.toml");
    core.debug(`Checking for ${pyprojectPath}`);
    if (fs.existsSync(pyprojectPath)) {
      core.info(`Found pyproject.toml at ${pyprojectPath}`);
      return pyprojectPath;
    }
    if (currentDir === resolvedWorkspaceRoot) {
      return undefined;
    }
    const parentDir = path.dirname(currentDir);
    if (
      parentDir === currentDir ||
      !isPathWithinWorkspace(parentDir, resolvedWorkspaceRoot)
    ) {
      return undefined;
    }
    currentDir = parentDir;
  }
 }
 function resolveStartDirectory(startPath: string): string {
  const resolvedStartPath = path.resolve(startPath);
  if (!fs.existsSync(resolvedStartPath)) {
    return resolvedStartPath;
  }
  const stats = fs.statSync(resolvedStartPath);
  return stats.isDirectory()
    ? resolvedStartPath
    : path.dirname(resolvedStartPath);
 }
 /**
 * Check if a given path is within or equal to the workspace root.
 *
 * @param checkPath The path to check
 * @param workspaceRoot The workspace root directory
 * @returns true if within or equal to workspace, false if outside, undefined if can't determine
 */
 function isPathWithinWorkspace(
  checkPath: string,
  workspaceRoot: string,
 ): boolean {
  const relativePath = path.relative(workspaceRoot, checkPath);
  return !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
 }
@@ -0,0 +1,161 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as glob from "@actions/glob";
 const GLOB_PATTERN = /[*?[]/;
 /**
 * Split an action input into whitespace-delimited tokens.
 *
 * The action has historically documented both `args` and `src` as plain
 * whitespace-delimited inputs. Keep that behavior instead of invoking a shell.
 */
 export function splitInput(input: string): string[] {
  return input.trim().split(/\s+/).filter(Boolean);
 }
 /**
 * Expand glob patterns from the `src` input in a cross-platform way.
 *
 * Glob syntax is defined by @actions/glob. This action does not emulate shell
 * expansion. Unmatched patterns are preserved so Ruff can report the missing
 * path.
 */
 export async function expandSourceInput(srcInput: string): Promise<string[]> {
  const sources = splitInput(srcInput);
  if (sources.length === 0) {
    return [];
  }
  const expandedSources: string[] = [];
  for (const source of sources) {
    if (!hasGlobPattern(source)) {
      expandedSources.push(source);
      continue;
    }
    const matches = await globMatches(source);
    expandedSources.push(...(matches.length > 0 ? matches : [source]));
  }
  return expandedSources;
 }
 /**
 * Resolve the starting path for version discovery from the `src` input.
 *
 * Takes the first whitespace-delimited token. Literal paths are preserved. Glob
 * patterns use their first sorted match when available, so pyproject.toml
 * discovery starts from a path Ruff will actually check. Unmatched globs fall
 * back to @actions/glob's search path.
 */
 export async function getVersionSourceDirectory(
  srcInput: string,
  versionInput: string | undefined,
  versionFileInput: string | undefined,
 ): Promise<string> {
  if (hasInput(versionInput) || hasInput(versionFileInput)) {
    return ".";
  }
  return await getSourceBasePath(srcInput);
 }
 export async function getSourceBasePath(srcInput: string): Promise<string> {
  const firstSource = splitInput(srcInput)[0] ?? ".";
  if (!hasGlobPattern(firstSource)) {
    return stripTrailingSeparators(firstSource);
  }
  const globber = await createGlobber(firstSource);
  const matches = (await globber.glob()).sort();
  if (matches.length > 0) {
    return (
      (await preserveSourcePathStyle(firstSource, [matches[0] ?? "."]))[0] ??
      "."
    );
  }
  const searchPaths = globber.getSearchPaths().sort();
  if (searchPaths.length > 0) {
    return (
      (
        await preserveSourcePathStyle(firstSource, [searchPaths[0] ?? "."])
      )[0] ?? "."
    );
  }
  return ".";
 }
 function hasInput(input: string | undefined): boolean {
  return input !== undefined && input.trim() !== "";
 }
 function hasGlobPattern(source: string): boolean {
  return GLOB_PATTERN.test(source);
 }
 function stripTrailingSeparators(source: string): string {
  const root = path.parse(source).root;
  const strippedSource = source.replace(/[/\\]+$/, "");
  if (root !== "" && strippedSource.length < root.length) {
    return root;
  }
  return strippedSource || root || ".";
 }
 async function globMatches(pattern: string): Promise<string[]> {
  const globber = await createGlobber(pattern);
  const matches = await globber.glob();
  return await preserveSourcePathStyle(pattern, matches.sort());
 }
 async function createGlobber(pattern: string): Promise<glob.Globber> {
  return await glob.create(normalizeGlobPattern(pattern), {
    excludeHiddenFiles: !explicitlyTargetsHiddenPath(pattern),
    followSymbolicLinks: false,
    implicitDescendants: false,
  });
 }
 async function preserveSourcePathStyle(
  pattern: string,
  matches: string[],
 ): Promise<string[]> {
  if (path.isAbsolute(pattern)) {
    return matches;
  }
  const cwd = await fs.realpath(process.cwd());
  return matches.map((match) => path.relative(cwd, match) || ".");
 }
 function explicitlyTargetsHiddenPath(pattern: string): boolean {
  return splitSourcePath(pattern).some(isHiddenPathSegment);
 }
 function splitSourcePath(source: string): string[] {
  const root = path.parse(source).root;
  const relativePath = source.slice(root.length);
  const separatorPattern = process.platform === "win32" ? /[/\\]+/ : /\/+/;
  return relativePath.split(separatorPattern).filter(Boolean);
 }
 function isHiddenPathSegment(segment: string): boolean {
  return segment.startsWith(".") && segment !== "." && segment !== "..";
 }
 function normalizeGlobPattern(pattern: string): string {
  if (process.platform !== "win32") {
    return pattern;
  }
  return pattern.replace(/\\/g, "/");
 }
@@ -0,0 +1,209 @@
 import fs from "node:fs";
 import * as core from "@actions/core";
 import * as toml from "smol-toml";
 import { normalizeVersionSpecifier } from "./specifier";
 import type { ParsedVersionFile, VersionFileFormat } from "./types";
 interface VersionFileParser {
  format: VersionFileFormat;
  parse(filePath: string): string | undefined;
  supports(filePath: string): boolean;
 }
 interface Pyproject {
  project?: {
    dependencies?: string[];
    "optional-dependencies"?: Record<string, string[]>;
  };
  "dependency-groups"?: Record<string, Array<string | object>>;
  tool?: {
    poetry?: {
      dependencies?: Record<string, string | object>;
      group?: Record<string, { dependencies: Record<string, string | object> }>;
    };
  };
 }
 interface UvLock {
  package?: Array<{ name?: string; version?: string }>;
 }
 const VERSION_FILE_PARSERS: VersionFileParser[] = [
  {
    format: "pyproject.toml",
    parse: (filePath) => {
      const fileContent = fs.readFileSync(filePath, "utf-8");
      return getRuffVersionFromPyprojectContent(fileContent);
    },
    supports: (filePath) => filePath.endsWith("pyproject.toml"),
  },
  {
    format: "uv.lock",
    parse: (filePath) => {
      const fileContent = fs.readFileSync(filePath, "utf-8");
      return getRuffVersionFromUvLockContent(fileContent);
    },
    supports: (filePath) => filePath.endsWith("uv.lock"),
  },
  {
    format: "requirements",
    parse: (filePath) => {
      const fileContent = fs.readFileSync(filePath, "utf-8");
      return getRuffVersionFromRequirementsText(fileContent);
    },
    supports: (filePath) => filePath.endsWith(".txt"),
  },
 ];
 export function getParsedVersionFile(
  filePath: string,
 ): ParsedVersionFile | undefined {
  core.info(`Trying to find version for ruff in: ${filePath}`);
  if (!fs.existsSync(filePath)) {
    core.warning(`Could not find file: ${filePath}`);
    return undefined;
  }
  const parser = getVersionFileParser(filePath);
  if (parser === undefined) {
    return undefined;
  }
  try {
    const specifier = parser.parse(filePath);
    if (specifier === undefined) {
      return undefined;
    }
    const normalizedSpecifier = normalizeVersionSpecifier(specifier);
    core.info(`Found version for ruff in ${filePath}: ${normalizedSpecifier}`);
    return {
      format: parser.format,
      specifier: normalizedSpecifier,
    };
  } catch (error) {
    core.warning(
      `Error while parsing ${filePath}: ${(error as Error).message}`,
    );
    return undefined;
  }
 }
 export function getRuffVersionFromFile(filePath: string): string | undefined {
  return getParsedVersionFile(filePath)?.specifier;
 }
 export function findRuffVersionInSpec(spec: string): string | undefined {
  const trimmedSpec = spec.trim();
  if (!trimmedSpec.startsWith("ruff")) {
    return undefined;
  }
  let versionSpec = trimmedSpec.slice("ruff".length);
  if (!versionSpec.match(/^(?:\s+|[=<>~!])/)) {
    return undefined;
  }
  versionSpec = versionSpec.replace(/\\$/, "").trim();
  const match = versionSpec.match(/^([^;]+)(?:;.*)?$/);
  if (match) {
    let version = match[1].trim();
    if (version) {
      version = normalizeVersionSpecifier(version);
      if (trimmedSpec.includes(";")) {
        core.warning(
          "Environment markers are ignored. ruff is a standalone tool that works independently of Python version.",
        );
      }
      core.info(`Found ruff version in requirements file: ${version}`);
      return version;
    }
  }
  return undefined;
 }
 export function getRuffVersionFromRequirementsText(
  fileContent: string,
 ): string | undefined {
  return getRuffVersionFromAllDependencies(fileContent.split("\n"));
 }
 export function getRuffVersionFromPyprojectContent(
  pyprojectContent: string,
 ): string | undefined {
  const pyproject = parsePyprojectContent(pyprojectContent);
  return getRuffVersionFromParsedPyproject(pyproject);
 }
 export function parsePyprojectContent(pyprojectContent: string): Pyproject {
  return toml.parse(pyprojectContent) as Pyproject;
 }
 export function getRuffVersionFromUvLockContent(
  uvLockContent: string,
 ): string | undefined {
  const uvLock = toml.parse(uvLockContent) as UvLock;
  const ruffPackage = (uvLock.package || []).find((pkg) => pkg.name === "ruff");
  if (ruffPackage?.version === undefined) {
    return undefined;
  }
  core.info(`Found ruff version in uv.lock: ${ruffPackage.version}`);
  return ruffPackage.version;
 }
 function getVersionFileParser(filePath: string): VersionFileParser | undefined {
  return VERSION_FILE_PARSERS.find((parser) => parser.supports(filePath));
 }
 function getRuffVersionFromParsedPyproject(
  pyproject: Pyproject,
 ): string | undefined {
  const dependencies: string[] = pyproject.project?.dependencies || [];
  const optionalDependencies: string[] = Object.values(
    pyproject.project?.["optional-dependencies"] || {},
  ).flat();
  const devDependencies: string[] = Object.values(
    pyproject["dependency-groups"] || {},
  )
    .flat()
    .filter((item: string | object) => typeof item === "string");
  return (
    getRuffVersionFromAllDependencies(
      dependencies.concat(optionalDependencies, devDependencies),
    ) || getRuffVersionFromPoetryGroups(pyproject)
  );
 }
 function getRuffVersionFromPoetryGroups(
  pyproject: Pyproject,
 ): string | undefined {
  const poetry = pyproject.tool?.poetry || {};
  const poetryGroups = Object.values(poetry.group || {});
  if (poetry.dependencies) {
    poetryGroups.unshift({ dependencies: poetry.dependencies });
  }
  return poetryGroups
    .flatMap((group) => Object.entries(group.dependencies))
    .map(([name, spec]) => {
      if (typeof spec === "string") {
        return findRuffVersionInSpec(`${name} ${spec}`);
      }
      return undefined;
    })
    .find((version) => version !== undefined);
 }
 function getRuffVersionFromAllDependencies(
  allDependencies: string[],
 ): string | undefined {
  return allDependencies
    .map((dependency) => findRuffVersionInSpec(dependency))
    .find((version) => version !== undefined);
 }
@@ -0,0 +1,125 @@
 import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
 import * as pep440 from "@renovatebot/pep440";
 import { getAllVersions, getLatestVersion } from "../download/manifest";
 import {
  type ParsedVersionSpecifier,
  parseVersionSpecifier,
 } from "./specifier";
 import type { ResolveRuffVersionOptions } from "./types";
 import { resolveVersionRequest } from "./version-request-resolver";
 interface ConcreteVersionResolutionContext {
  manifestUrl?: string;
  parsedSpecifier: ParsedVersionSpecifier;
 }
 interface ConcreteVersionResolver {
  resolve(
    context: ConcreteVersionResolutionContext,
  ): Promise<string | undefined>;
 }
 class ExactVersionResolver implements ConcreteVersionResolver {
  async resolve(
    context: ConcreteVersionResolutionContext,
  ): Promise<string | undefined> {
    if (context.parsedSpecifier.kind !== "exact") {
      return undefined;
    }
    core.debug(
      `Version ${context.parsedSpecifier.normalized} is an explicit version.`,
    );
    return context.parsedSpecifier.normalized;
  }
 }
 class LatestVersionResolver implements ConcreteVersionResolver {
  async resolve(
    context: ConcreteVersionResolutionContext,
  ): Promise<string | undefined> {
    if (context.parsedSpecifier.kind !== "latest") {
      return undefined;
    }
    return await getLatestVersion(context.manifestUrl);
  }
 }
 class RangeVersionResolver implements ConcreteVersionResolver {
  async resolve(
    context: ConcreteVersionResolutionContext,
  ): Promise<string | undefined> {
    if (context.parsedSpecifier.kind !== "range") {
      return undefined;
    }
    const availableVersions = await getAllVersions(context.manifestUrl);
    const resolvedVersion = maxSatisfying(
      availableVersions,
      context.parsedSpecifier.normalized,
    );
    if (resolvedVersion === undefined) {
      throw new Error(`No version found for ${context.parsedSpecifier.raw}`);
    }
    core.debug(`Resolved version: ${resolvedVersion}`);
    return resolvedVersion;
  }
 }
 const CONCRETE_VERSION_RESOLVERS: ConcreteVersionResolver[] = [
  new ExactVersionResolver(),
  new LatestVersionResolver(),
  new RangeVersionResolver(),
 ];
 export async function resolveRuffVersion(
  options: ResolveRuffVersionOptions,
 ): Promise<string> {
  const request = resolveVersionRequest(options);
  return await resolveVersion(request.specifier, options.manifestFile);
 }
 export async function resolveVersion(
  versionInput: string,
  manifestUrl?: string,
 ): Promise<string> {
  core.debug(`Resolving ${versionInput}...`);
  const context: ConcreteVersionResolutionContext = {
    manifestUrl,
    parsedSpecifier: parseVersionSpecifier(versionInput),
  };
  for (const resolver of CONCRETE_VERSION_RESOLVERS) {
    const version = await resolver.resolve(context);
    if (version !== undefined) {
      return version;
    }
  }
  throw new Error(`No version found for ${versionInput}`);
 }
 function maxSatisfying(
  versions: string[],
  version: string,
 ): string | undefined {
  const maxSemver = tc.evaluateVersions(versions, version);
  if (maxSemver !== "") {
    core.debug(`Found a version that satisfies the semver range: ${maxSemver}`);
    return maxSemver;
  }
  const maxPep440 = pep440.maxSatisfying(versions, version);
  if (maxPep440 !== null) {
    core.debug(
      `Found a version that satisfies the pep440 specifier: ${maxPep440}`,
    );
    return maxPep440;
  }
  return undefined;
 }
--- a/Show More
+++ b/Show More
		`@@ -0,0 +1,2 @@`
							`* text=auto eol=lf`
							`dist/** -diff linguist-generated=true`
		`@@ -0,0 +1 @@`
							`{"version":"0.15.10","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://github.com/astral-sh/ruff/releases/download/0.15.10/ruff-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"e3e9e5c791542f00d95edc74a506e1ac24efc0af9574de01ab338187bf1ff9f6"}]}`
		`@@ -0,0 +1,2 @@`
							`# This file should be ignored when using foo/bar/*.py glob`
							`print("ignore me")`
		`@@ -0,0 +1,3 @@`
							`"""Hello world example."""`

							`print("Hello, world!")`
		`@@ -0,0 +1,2 @@`
							`def hello() -> str:`
							`return "Hello from python-project!"`