Bump @types/node from 22.13.4 to 22.13.10 (#98)

Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.13.4 to 22.13.10.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=npm_and_yarn&previous-version=22.13.4&new-version=22.13.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.editorconfig

@@ -0,0 +1,20 @@
+# Check http://editorconfig.org for more information
+# This is the main config file for this project:
+root = true
+
+[*]
+charset = utf-8
+trim_trailing_whitespace = true
+end_of_line = lf
+indent_style = space
+insert_final_newline = true
+indent_size = 2
+
+[*.{rs,py,pyi}]
+indent_size = 4
+
+[*.snap]
+trim_trailing_whitespace = false
+
+[*.md]
+max_line_length = 100

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto eol=lf
+dist/** -diff linguist-generated=true

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: daily

.github/matchers/check.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "ruff-check",
+      "pattern": [
+        {
+          "regexp": "^Error: (.*):(\\d+):(\\d+): (\\w+) (.*)$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "code": 4,
+          "message": 5
+        }
+      ]
+    }
+  ]
+}

.github/matchers/format.json

@@ -0,0 +1,14 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "ruff-format",
+      "pattern": [
+        {
+          "regexp": "^(Would reformat):\\s*(.+)$",
+          "message": 1,
+          "file": 2
+        }
+      ]
+    }
+  ]
+}

.github/release-drafter.yml

@@ -0,0 +1,50 @@
+name-template: "v$RESOLVED_VERSION 🌈"
+tag-template: "v$RESOLVED_VERSION"
+categories:
+  - title: "🚨 Breaking changes"
+    labels:
+      - "breaking-change"
+  - title: "✨ New features"
+    labels:
+      - "new-feature"
+  - title: "🐛 Bug fixes"
+    labels:
+      - "bugfix"
+  - title: "🚀 Enhancements"
+    labels:
+      - "enhancement"
+      - "refactor"
+      - "performance"
+  - title: "🧰 Maintenance"
+    labels:
+      - "maintenance"
+      - "ci"
+      - "update-known-checksums"
+  - title: "📚 Documentation"
+    labels:
+      - "documentation"
+  - title: "⬆️ Dependency updates"
+    labels:
+      - "dependencies"
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
+change-title-escapes: '\<*_&' # You can add # and @ to disable mentions, and add ` to disable code blocks.
+version-resolver:
+  major:
+    labels:
+      - "major"
+      - "breaking-change"
+  minor:
+    labels:
+      - "minor"
+      - "new-feature"
+      - "enhancement"
+  patch:
+    labels:
+      - "patch"
+      - "bugfix"
+      - "default-version-update"
+  default: patch
+template: |
+  ## Changes
+
+  $CHANGES

.github/workflows/actionlint.yml

@@ -1,16 +0,0 @@
-name: actionlint
-
-on:
-  push:
-    paths:
-    - '.github/workflows/**'
-  pull_request:
-    paths: 
-    - '.github/workflows/**'
-
-jobs:
-  actionlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: reviewdog/action-actionlint@v1

.github/workflows/check-dist.yml

@@ -0,0 +1,49 @@
+# `dist/index.js` is a special file in Actions.
+# When you reference an action with `uses:` in a workflow,
+# `index.js` is the code that will run.
+# For our project, we generate this file through a build process from other source files.
+# We need to make sure the checked-in `index.js` actually matches what we expect it to be.
+name: Check dist/
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check-dist:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Rebuild the dist/ directory
+        run: |
+          npm run build
+          npm run package
+
+      - name: Compare the expected and actual dist/ directories
+        run: |
+          if [ "$(git diff --ignore-space-at-eol dist/ | wc -l)" -gt "0" ]; then
+            echo "::error::Detected uncommitted changes after build. Run 'npm run build' and commit the changes."
+            git diff --text -v
+            exit 1
+          fi
+        id: diff
+
+      # If index.js was different than expected, upload the expected version as an artifact
+      - uses: actions/upload-artifact@v4
+        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
+        with:
+          name: dist
+          path: dist/

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,71 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [main]
+  schedule:
+    - cron: "31 7 * * 3"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["TypeScript"]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          source-root: src
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/python.yml

@@ -1,12 +0,0 @@
-name: CheckPython
-
-on: [push, pull_request]
-
-jobs:
-  clean-python:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: psf/black@stable
-      - uses: chartboost/ruff-action@v0
-      - uses: jakebailey/pyright-action@v1

.github/workflows/release-drafter.yml

@@ -0,0 +1,19 @@
+---
+name: Release Drafter
+
+# yamllint disable-line rule:truthy
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  update_release_draft:
+    name: ✏️ Draft release
+    runs-on: ubuntu-latest
+    steps:
+      - name: 🚀 Run Release Drafter
+        uses: release-drafter/release-drafter@v6.1.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale.yml

@@ -1,26 +0,0 @@
-name: Mark and close stale pull requests
-
-on:
-  schedule:
-  - cron: '55 17 * * *'
-
-env:
-  PR_STALE_DAYS: 21
-  PR_CLOSE_DAYS: 7
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      issues: read
-      pull-requests: write
-    steps:
-    - uses: actions/stale@v7
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-pr-message: "This pull request has been marked as stale. It will be closed in 14 days if no further activity occurs."
-        close-pr-message: "This pull request has been closed due to lack of activity."
-        days-before-pr-stale: ${{ env.PR_STALE_DAYS }}
-        days-before-pr-close: ${{ env.PR_CLOSE_DAYS }}
-        delete-branch: true

.github/workflows/test.yml

@@ -0,0 +1,254 @@
+name: "test"
+on:
+  pull_request:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Actionlint
+        uses: eifinger/actionlint-action@23c85443d840cd73bbecb9cddfc933cc21649a38  # v1.9.1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - run: |
+          npm install
+      - run: |
+          npm run all
+      - name: Make sure no changes from linters are detected
+        run: |
+          git diff --exit-code || (echo "::error::Please run 'npm run all' to fix the issues" && exit 1)
+  test-latest-version:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, macos-14, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use latest version
+        uses: ./
+        with:
+          src: __tests__/fixtures/python-project
+          version: latest
+  test-specific-version:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruff-version: ["0.7.4", "0.7", "0.7.x", ">=0.7.0"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use version ${{ matrix.ruff-version }}
+        uses: ./
+        with:
+          version: ${{ matrix.ruff-version }}
+          src: __tests__/fixtures/python-project
+  test-version-from-version-file-pyproject:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use version from pyproject.toml
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/python-project
+          version-file: __tests__/fixtures/pyproject.toml
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.9.3" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-default-version-from-pyproject:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use default version from pyproject.toml
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/python-project
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.6.2" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-default-version-from-pyproject-dev-group:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use default version from pyproject.toml dev group
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/pyproject-dependency-dev-project
+          version-file: __tests__/fixtures/pyproject-dependency-dev-project/pyproject.toml
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.8.3" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-default-version-from-pyproject-dependency-groups:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use default version from pyproject.toml dependency groups
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/pyproject-dependency-groups-project
+          version-file: __tests__/fixtures/pyproject-dependency-groups-project/pyproject.toml
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.8.3" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-default-version-from-pyproject-optional-dependencies:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use default version from pyproject.toml optional dependencies
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/pyproject-optional-dependencies-project
+          version-file: __tests__/fixtures/pyproject-optional-dependencies-project/pyproject.toml
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.8.3" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-default-version-from-requirements:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use default version from requirements.txt
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/python-project
+          version-file: __tests__/fixtures/requirements.txt
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.9.0" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-semver-range:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use version 0.7
+        id: ruff-action
+        uses: ./
+        with:
+          version: "0.7"
+          src: __tests__/fixtures/python-project
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.7.4" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-checksum:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        checksum:
+          ["0de731c669b9ece77e799ac3f4a160c30849752714d9775c94cc4cfaf326860c"]
+        exclude:
+          - os: macos-latest
+            checksum: "0de731c669b9ece77e799ac3f4a160c30849752714d9775c94cc4cfaf326860c"
+        include:
+          - os: macos-latest
+            checksum: "af9583bff12afbca5d5670334e0187dd60c4d91bc71317d1b2dde70cb1200ba9"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Checksum matches expected
+        uses: ./
+        with:
+          version: "0.7.4"
+          checksum: ${{ matrix.checksum }}
+          src: __tests__/fixtures/python-project
+  test-with-explicit-token:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use default version
+        uses: ./
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          src: __tests__/fixtures/python-project
+  test-args:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use args
+        uses: ./
+        with:
+          args: format --check
+          src: __tests__/fixtures/python-project
+  test-failure:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Format should fail
+        id: format-should-fail
+        continue-on-error: true
+        uses: ./
+        with:
+          args: format --check
+          src: __tests__/fixtures/malformed-python-project
+      - name: Check if the action failed
+        run: |
+          if [ ${{ steps.format-should-fail.outcome }} == "success" ]; then
+            exit 1
+          fi
+      - name: Check should fail
+        id: check-should-fail
+        continue-on-error: true
+        uses: ./
+        with:
+          src: __tests__/fixtures/malformed-python-project
+      - name: Check if the action failed
+        run: |
+          if [ ${{ steps.check-should-fail.outcome }} == "success" ]; then
+            exit 1
+          fi
+  test-multiple-src:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest ]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use args
+        uses: ./
+        with:
+          args: format --check
+          src: >-
+            __tests__/fixtures/python-project/src/python_project/__init__.py
+            __tests__/fixtures/python-project/src/python_project/hello_world.py

.github/workflows/update-known-checksums.yml

@@ -0,0 +1,34 @@
+name: "Update known checksums"
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 4 * * *" # Run every day at 4am UTC
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Update known checksums
+        id: update-known-checksums
+        run:
+          node dist/update-known-checksums/index.js
+          src/download/checksum/known-checksums.ts ${{ secrets.GITHUB_TOKEN }}
+      - run: npm install && npm run all
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          commit-message: "chore: update known checksums"
+          title:
+            "chore: update known checksums for ${{
+            steps.update-known-checksums.outputs.latest-version }}"
+          body:
+            "chore: update known checksums for ${{
+            steps.update-known-checksums.outputs.latest-version }}"
+          base: main
+          labels: "automated-pr,update-known-checksums"
+          branch: update-known-checksums-pr
+          delete-branch: true

.github/workflows/update-major-minor-tags.yml

@@ -0,0 +1,46 @@
+---
+name: Update Major Minor Tags
+
+# yamllint disable-line rule:truthy
+on:
+  push:
+    branches-ignore:
+      - "**"
+    tags:
+      - "v*.*.*"
+
+jobs:
+  update_major_minor_tags:
+    name: Make sure major and minor tags are up to date on a patch release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Update Major Minor Tags
+        run: |
+          set -x
+
+          cd "${GITHUB_WORKSPACE}" || exit
+
+          # Set up variables.
+          TAG="${GITHUB_REF#refs/tags/}" # v1.2.3
+          MINOR="${TAG%.*}"              # v1.2
+          MAJOR="${MINOR%.*}"            # v1
+
+          if [ "${GITHUB_REF}" = "${TAG}" ]; then
+            echo "This workflow is not triggered by tag push: GITHUB_REF=${GITHUB_REF}"
+            exit 1
+          fi
+
+          MESSAGE="Release ${TAG}"
+
+          # Set up Git.
+          git config user.name "${GITHUB_ACTOR}"
+          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+
+          # Update MAJOR/MINOR tag
+          git tag -fa "${MAJOR}" -m "${MESSAGE}"
+          git tag -fa "${MINOR}" -m "${MESSAGE}"
+
+          # Push
+          git push --force origin "${MINOR}"
+          git push --force origin "${MAJOR}"

.gitignore

@@ -1,129 +1,102 @@
-# Byte-compiled / optimized / DLL files
+# Dependency directory
-__pycache__/
+node_modules
-*.py[cod]
-*$py.class
 
-# C extensions
+# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
-*.so
+# Logs
-
+logs
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-pip-wheel-metadata/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py,cover
-.hypothesis/
-.pytest_cache/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
 *.log
-local_settings.py
+npm-debug.log*
-db.sqlite3
+yarn-debug.log*
-db.sqlite3-journal
+yarn-error.log*
+lerna-debug.log*
 
-# Flask stuff:
+# Diagnostic reports (https://nodejs.org/api/report.html)
-instance/
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-.webassets-cache
 
-# Scrapy stuff:
+# Runtime data
-.scrapy
+pids
+*.pid
+*.seed
+*.pid.lock
 
-# Sphinx documentation
+# Directory for instrumented libs generated by jscoverage/JSCover
-docs/_build/
+lib-cov
 
-# PyBuilder
+# Coverage directory used by tools like istanbul
-target/
+coverage
+*.lcov
 
-# Jupyter Notebook
+# nyc test coverage
-.ipynb_checkpoints
+.nyc_output
 
-# IPython
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-profile_default/
+.grunt
-ipython_config.py
 
-# pyenv
+# Bower dependency directory (https://bower.io/)
-.python-version
+bower_components
 
-# pipenv
+# node-waf configuration
-#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+.lock-wscript
-#   However, in case of collaboration, if having platform-specific dependencies or dependencies
-#   having no cross-platform support, pipenv may install dependencies that don't work, or not
-#   install all needed dependencies.
-#Pipfile.lock
 
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow
+# Compiled binary addons (https://nodejs.org/api/addons.html)
-__pypackages__/
+build/Release
 
-# Celery stuff
+# Dependency directories
-celerybeat-schedule
+jspm_packages/
-celerybeat.pid
 
-# SageMath parsed files
+# TypeScript v1 declaration files
-*.sage.py
+typings/
 
-# Environments
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
 .env
-.venv
+.env.test
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
 
-# Spyder project settings
+# parcel-bundler cache (https://parceljs.org/)
-.spyderproject
+.cache
-.spyproject
 
-# Rope project settings
+# next.js build output
-.ropeproject
+.next
 
-# mkdocs documentation
+# nuxt.js build output
-/site
+.nuxt
 
-# mypy
+# vuepress build output
-.mypy_cache/
+.vuepress/dist
-.dmypy.json
-dmypy.json
 
-# Pyre type checker
+# Serverless directories
-.pyre/
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# OS metadata
+.DS_Store
+Thumbs.db
+
+# Ignore built ts files
+__tests__/runner/*
+lib/**/*
+
+# Idea IDEs (PyCharm, WebStorm, IntelliJ, etc)
+.idea/

.pre-commit-config.yaml

@@ -1,23 +0,0 @@
-repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
-    hooks:
-      - id: check-yaml
-      - id: end-of-file-fixer
-      - id: trailing-whitespace
-  - repo: https://github.com/rhysd/actionlint
-    rev: v1.6.23
-    hooks:
-      - id: actionlint
-  - repo: https://github.com/psf/black
-    rev: 23.3.0
-    hooks:
-      - id: black
-  - repo: https://github.com/charliermarsh/ruff-pre-commit
-    rev: 'v0.0.260'
-    hooks:
-      - id: ruff
-  - repo: https://github.com/RobertCraigie/pyright-python
-    rev: v1.1.301
-    hooks:
-    - id: pyright

CODEOWNERS

@@ -0,0 +1 @@
+* @eifinger

README.md

@@ -1,2 +1,192 @@
 # ruff-action
-A GitHub Action for Ruff
+
+A GitHub Action to run [ruff](https://github.com/astral-sh/ruff).
+
+This action is commonly used as a pass/fail test to ensure your repository stays
+clean, abiding the [rules](https://docs.astral.sh/ruff/rules/) specified in your
+configuration. Though it runs `ruff`, the action can do anything `ruff` can (ex,
+fix).
+
+## Contents
+
+- [Usage](#usage)
+  - [Basic](#basic)
+  - [Specify a different source directory](#specify-a-different-source-directory)
+  - [Specify multiple files](#specify-multiple-files)
+  - [Use to install ruff](#use-to-install-ruff)
+  - [Use `ruff format`](#use-ruff-format)
+  - [Install specific versions](#install-specific-versions)
+    - [Install the latest version](#install-the-latest-version)
+    - [Install a specific version](#install-a-specific-version)
+    - [Install a version by supplying a semver range](#install-a-version-by-supplying-a-semver-range)
+    - [Install a version from a specified version file](#install-a-version-from-a-specified-version-file)
+  - [Validate checksum](#validate-checksum)
+  - [GitHub authentication token](#github-authentication-token)
+- [Outputs](#outputs)
+
+## Usage
+
+| Input          | Description                                                                                                                                | Default            |
+|----------------|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------|
+| `version`      | The version of Ruff to install. See [Install specific versions](#install-specific-versions)                                                | `latest`           |
+| `version-file` | The file to read the version from. See [Install a version from a specified version file](#install-a-version-from-a-specified-version-file) | None               |
+| `args`         | The arguments to pass to the `ruff` command. See [Configuring Ruff]                                                                        | `check`            |
+| `src`          | The directory or single files to run `ruff` on.                                                                                            | [github.workspace] |
+| `checksum`     | The sha256 checksum of the downloaded executable.                                                                                          | None               |
+| `github-token` | The GitHub token to use for authentication.                                                                                                | `GITHUB_TOKEN`     |
+
+### Basic
+
+```yaml
+- uses: astral-sh/ruff-action@v3
+```
+
+### Specify a different source directory
+
+```yaml
+- uses: astral-sh/ruff-action@v3
+  with:
+    src: "./src"
+```
+
+### Specify multiple files
+
+```yaml
+- uses: astral-sh/ruff-action@v3
+  with:
+    src: >-
+      path/to/file1.py
+      path/to/file2.py
+```
+
+### Use to install ruff
+
+This action adds ruff to the PATH, so you can use it in subsequent steps.
+
+```yaml
+- uses: astral-sh/ruff-action@v3
+- run: ruff check --fix
+- run: ruff format
+```
+
+By default, this action runs `ruff check` after installation.
+If you do not want to run any `ruff` command but only install it,
+you can use the `args` input to overwrite the default value (`check`):
+
+```yaml
+- name: Install ruff without running check or format
+  uses: astral-sh/ruff-action@v3
+  with:
+    args: "--version"
+```
+
+### Use `ruff format`
+
+```yaml
+- uses: astral-sh/ruff-action@v3
+  with:
+    args: "format --check"
+```
+
+### Install specific versions
+
+By default this action looks for a pyproject.toml file in the root of the repository to determine
+the ruff version to install. If no pyproject.toml file is found, or no ruff version is defined in
+`project.dependencies`, `project.optional-dependencies`, or `dependency-groups`,
+the latest version is installed.
+
+#### Install the latest version
+
+```yaml
+- name: Install the latest version of ruff
+  uses: astral-sh/ruff-action@v3
+  with:
+    version: "latest"
+```
+
+#### Install a specific version
+
+```yaml
+- name: Install a specific version of ruff
+  uses: astral-sh/ruff-action@v3
+  with:
+    version: "0.4.4"
+```
+
+#### Install a version by supplying a semver range
+
+You can specify a [semver range](https://github.com/npm/node-semver?tab=readme-ov-file#ranges)
+to install the latest version that satisfies the range.
+
+```yaml
+- name: Install a semver range of ruff
+  uses: astral-sh/ruff-action@v3
+  with:
+    version: ">=0.4.0"
+```
+
+```yaml
+- name: Pinning a minor version of ruff
+  uses: astral-sh/ruff-action@v3
+  with:
+    version: "0.4.x"
+```
+
+#### Install a version from a specified version file
+
+You can specify a file to read the version from.
+Currently `pyproject.toml` and `requirements.txt` are supported.
+
+```yaml
+- name: Install a version from a specified version file
+  uses: astral-sh/ruff-action@v3
+  with:
+    version-file: "my-path/to/pyproject.toml-or-requirements.txt"
+```
+
+### Validate checksum
+
+You can specify a checksum to validate the downloaded executable. Checksums up to the default version
+are automatically verified by this action. The sha256 hashes can be found on the
+[releases page](https://github.com/astral-sh/ruff/releases) of the ruff repo.
+
+```yaml
+- name: Install a specific version and validate the checksum
+  uses: astral-sh/ruff-action@v3
+  with:
+    version: "0.7.4"
+    checksum: "0de731c669b9ece77e799ac3f4a160c30849752714d9775c94cc4cfaf326860c"
+```
+
+### GitHub authentication token
+
+This action uses the GitHub API to fetch the ruff release artifacts. To avoid hitting the GitHub API
+rate limit too quickly, an authentication token can be provided via the `github-token` input. By
+default, the `GITHUB_TOKEN` secret is used, which is automatically provided by GitHub Actions.
+
+If the default
+[permissions for the GitHub token](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
+are not sufficient, you can provide a custom GitHub token with the necessary permissions.
+
+```yaml
+- name: Install the latest version of ruff with a custom GitHub token
+  uses: astral-sh/ruff-action@v3
+  with:
+    github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
+```
+
+## Outputs
+
+| Output         | Description                             |
+|----------------|-----------------------------------------|
+| `ruff-version` | The version of Ruff that was installed. |
+
+
+<div align="center">
+  <a target="_blank" href="https://astral.sh" style="background:none">
+    <img src="https://raw.githubusercontent.com/astral-sh/uv/main/assets/svg/Astral.svg" alt="Made by Astral">
+  </a>
+</div>
+
+[Configuring Ruff]: https://github.com/astral-sh/ruff/blob/main/docs/configuration.md
+[github.workspace]: https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#github-context

__tests__/fixtures/checksumfile

@@ -0,0 +1 @@
+Random file content

__tests__/fixtures/malformed-python-project/pyproject.toml

@@ -0,0 +1,13 @@
+[project]
+name = "malformed-python-project"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = [
+    "ruff>=0.6.2",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

__tests__/fixtures/malformed-python-project/src/malformed_python_project/__init__.py

@@ -0,0 +1,6 @@
+def hello() -> str:
+    string_with_single_quotes = 'Hello from malformed-python-project!'
+
+
+
+    return f"{string_with_single_quotes}"

__tests__/fixtures/malformed-python-project/src/malformed_python_project/hello_world.py

@@ -0,0 +1,4 @@
+import sys
+
+print("Hello world!")
+print('How are you?')

__tests__/fixtures/pyproject-dependency-dev-project/pyproject.toml

@@ -0,0 +1,15 @@
+[project]
+name = "pyproject-dependency-dev-project"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = [
+    "ruff==0.8.3"
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

__tests__/fixtures/pyproject-dependency-dev-project/src/pyproject_dependency_dev_project/__init__.py

@@ -0,0 +1,2 @@
+def hello() -> str:
+    return "Hello from python-project!"

__tests__/fixtures/pyproject-dependency-dev-project/src/pyproject_dependency_dev_project/hello_world.py

@@ -0,0 +1 @@
+print("Hello world!")

__tests__/fixtures/pyproject-dependency-groups-project/pyproject.toml

@@ -0,0 +1,22 @@
+[project]
+name = "pyproject-dependency-groups-project"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = [
+    { include-group = "docs" },
+    { include-group = "lint" },
+]
+docs = [
+    "sphinx",
+]
+lint = [
+    "ruff==0.8.3",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

__tests__/fixtures/pyproject-dependency-groups-project/src/pyproject_dependency_dev_project/__init__.py

@@ -0,0 +1,2 @@
+def hello() -> str:
+    return "Hello from python-project!"

__tests__/fixtures/pyproject-dependency-groups-project/src/pyproject_dependency_dev_project/hello_world.py

@@ -0,0 +1 @@
+print("Hello world!")

__tests__/fixtures/pyproject-optional-dependencies-project/pyproject.toml

@@ -0,0 +1,15 @@
+[project]
+name = "pyproject-optional-dependencies-project"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.12"
+
+[project.optional-dependencies]
+lint = [
+    "ruff==0.8.3",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

__tests__/fixtures/pyproject-optional-dependencies-project/src/pyproject_dependency_dev_project/__init__.py

@@ -0,0 +1,2 @@
+def hello() -> str:
+    return "Hello from python-project!"

__tests__/fixtures/pyproject-optional-dependencies-project/src/pyproject_dependency_dev_project/hello_world.py

@@ -0,0 +1 @@
+print("Hello world!")

__tests__/fixtures/pyproject.toml

@@ -0,0 +1,13 @@
+[project]
+name = "pyython-project"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = [
+    "ruff==0.9.3",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

__tests__/fixtures/python-project/pyproject.toml

@@ -0,0 +1,13 @@
+[project]
+name = "pyython-project"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = [
+    "ruff==0.6.2",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

__tests__/fixtures/python-project/src/python_project/__init__.py

@@ -0,0 +1,2 @@
+def hello() -> str:
+    return "Hello from python-project!"

__tests__/fixtures/python-project/src/python_project/hello_world.py

@@ -0,0 +1 @@
+print("Hello world!")

__tests__/fixtures/requirements.txt

@@ -0,0 +1 @@
+ruff==0.9.0

action.yml

@@ -1,37 +1,37 @@
-name: "Ruff GH Action"
+name: "ruff-action"
-description: "A GH Action of Ruff, the extremely fast Python linter."
+description: "A GitHub Action to run Ruff, an extremely fast Python linter and code formatter."
-author: "Austin Bennett and the Ruff Community"
+author: "astral-sh"
 inputs:
   args:
-    description:
+    description: "Arguments passed to Ruff. Use `ruff --help` to see available options. Defaults to `check`."
-      "Arguments passed to Ruff. Use `ruff --help` to see available options. 
-      Default: 'check'"
     required: false
     default: "check"
   src:
-    description: "Source to run ruff. Default: '.'"
+    description: "Source to run Ruff. Defaults to the current directory."
     required: false
-    default: "."
+    default: ${{ github.workspace }}
   version:
-    description: 'The version of ruff to use, e.g. "0.0.259"'
+    description: "The version of Ruff to use, e.g., `0.6.0` Defaults to the version in pyproject.toml or 'latest'."
     required: false
     default: ""
-branding:
+  version-file:
-  color: "black"
+    description: "Path to a pyproject.toml or requirements.txt file to read the version from."
-  icon: "code"
+    required: false
+  checksum:
+    description: "The checksum of the ruff version to install"
+    required: false
+  github-token:
+    description:
+      "Used to increase the rate limit when retrieving versions and downloading
+      ruff."
+    required: false
+    default: ${{ github.token }}
+outputs:
+  ruff-version:
+    description: "The installed ruff version. Useful when using latest."
 runs:
-  using: composite
+  using: "node20"
-  steps:
+  main: "dist/ruff-action/index.js"
-    - run: |
+branding:
-        if [ "$RUNNER_OS" == "Windows" ]; then
+  icon: "code"
-          python $GITHUB_ACTION_PATH/action/main.py
+  color: "black"
-        else
-          python3 $GITHUB_ACTION_PATH/action/main.py
-        fi
-      env:
-        RUFF_FORMAT: github
-        INPUT_ARGS: ${{ inputs.args }}
-        INPUT_SRC: ${{ inputs.src }}
-        INPUT_VERSION: ${{ inputs.version }}
-        pythonioencoding: utf-8
-      shell: bash

action/main.py

@@ -1,25 +0,0 @@
-"""GitHub Action for Ruff."""
-import os
-import re
-import shlex
-import sys
-from pathlib import Path
-from subprocess import run
-
-ACTION_PATH = Path(os.environ["GITHUB_ACTION_PATH"])
-ARGS = os.getenv("INPUT_ARGS", default="")
-SRC = os.getenv("INPUT_SRC", default="")
-VERSION = os.getenv("INPUT_VERSION", default="")
-
-version_specifier = ""
-if VERSION != "":
-    if not re.match(r"v?\d\.\d{1,3}\.\d{1,3}$", VERSION):
-        print("VERSION does not match expected pattern")
-        sys.exit(1)
-    version_specifier = f"=={VERSION}"
-
-req = f"ruff{version_specifier}"
-
-proc = run(["pipx", "run", req, *shlex.split(ARGS), *shlex.split(SRC)])
-
-sys.exit(proc.returncode)

biome.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://biomejs.dev/schemas/1.9.2/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": false
+  },
+  "files": {
+    "ignoreUnknown": false,
+    "ignore": ["dist", "lib", "node_modules"]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space"
+  },
+  "organizeImports": {
+    "enabled": true
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "trailingCommas": "all"
+    }
+  }
+}

package-lock.json

@@ -0,0 +1,481 @@
+{
+  "name": "ruff-action",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "ruff-action",
+      "version": "1.0.0",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@actions/core": "^1.11.1",
+        "@actions/exec": "^1.1.1",
+        "@actions/tool-cache": "^2.0.2",
+        "@octokit/core": "^6.1.4",
+        "@octokit/plugin-paginate-rest": "^11.4.3",
+        "@octokit/plugin-rest-endpoint-methods": "^13.3.1",
+        "smol-toml": "^1.3.1"
+      },
+      "devDependencies": {
+        "@biomejs/biome": "1.9.4",
+        "@types/node": "^22.13.10",
+        "@types/semver": "^7.5.8",
+        "@vercel/ncc": "^0.38.3",
+        "js-yaml": "^4.1.0",
+        "typescript": "^5.8.2"
+      }
+    },
+    "node_modules/@actions/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "dependencies": {
+        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1"
+      }
+    },
+    "node_modules/@actions/exec": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
+      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "dependencies": {
+        "@actions/io": "^1.0.1"
+      }
+    },
+    "node_modules/@actions/http-client": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
+      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "dependencies": {
+        "tunnel": "^0.0.6",
+        "undici": "^5.25.4"
+      }
+    },
+    "node_modules/@actions/io": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
+      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
+    },
+    "node_modules/@actions/tool-cache": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/tool-cache/-/tool-cache-2.0.2.tgz",
+      "integrity": "sha512-fBhNNOWxuoLxztQebpOaWu6WeVmuwa77Z+DxIZ1B+OYvGkGQon6kTVg6Z32Cb13WCuw0szqonK+hh03mJV7Z6w==",
+      "dependencies": {
+        "@actions/core": "^1.11.1",
+        "@actions/exec": "^1.0.0",
+        "@actions/http-client": "^2.0.1",
+        "@actions/io": "^1.1.1",
+        "semver": "^6.1.0"
+      }
+    },
+    "node_modules/@biomejs/biome": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-1.9.4.tgz",
+      "integrity": "sha512-1rkd7G70+o9KkTn5KLmDYXihGoTaIGO9PIIN2ZB7UJxFrWw04CZHPYiMRjYsaDvVV7hP1dYNRLxSANLaBFGpog==",
+      "dev": true,
+      "hasInstallScript": true,
+      "bin": {
+        "biome": "bin/biome"
+      },
+      "engines": {
+        "node": ">=14.21.3"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/biome"
+      },
+      "optionalDependencies": {
+        "@biomejs/cli-darwin-arm64": "1.9.4",
+        "@biomejs/cli-darwin-x64": "1.9.4",
+        "@biomejs/cli-linux-arm64": "1.9.4",
+        "@biomejs/cli-linux-arm64-musl": "1.9.4",
+        "@biomejs/cli-linux-x64": "1.9.4",
+        "@biomejs/cli-linux-x64-musl": "1.9.4",
+        "@biomejs/cli-win32-arm64": "1.9.4",
+        "@biomejs/cli-win32-x64": "1.9.4"
+      }
+    },
+    "node_modules/@biomejs/cli-darwin-arm64": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-1.9.4.tgz",
+      "integrity": "sha512-bFBsPWrNvkdKrNCYeAp+xo2HecOGPAy9WyNyB/jKnnedgzl4W4Hb9ZMzYNbf8dMCGmUdSavlYHiR01QaYR58cw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-darwin-x64": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-1.9.4.tgz",
+      "integrity": "sha512-ngYBh/+bEedqkSevPVhLP4QfVPCpb+4BBe2p7Xs32dBgs7rh9nY2AIYUL6BgLw1JVXV8GlpKmb/hNiuIxfPfZg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-arm64": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-1.9.4.tgz",
+      "integrity": "sha512-fJIW0+LYujdjUgJJuwesP4EjIBl/N/TcOX3IvIHJQNsAqvV2CHIogsmA94BPG6jZATS4Hi+xv4SkBBQSt1N4/g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-arm64-musl": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-1.9.4.tgz",
+      "integrity": "sha512-v665Ct9WCRjGa8+kTr0CzApU0+XXtRgwmzIf1SeKSGAv+2scAlW6JR5PMFo6FzqqZ64Po79cKODKf3/AAmECqA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-x64": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-1.9.4.tgz",
+      "integrity": "sha512-lRCJv/Vi3Vlwmbd6K+oQ0KhLHMAysN8lXoCI7XeHlxaajk06u7G+UsFSO01NAs5iYuWKmVZjmiOzJ0OJmGsMwg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-x64-musl": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-1.9.4.tgz",
+      "integrity": "sha512-gEhi/jSBhZ2m6wjV530Yy8+fNqG8PAinM3oV7CyO+6c3CEh16Eizm21uHVsyVBEB6RIM8JHIl6AGYCv6Q6Q9Tg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-win32-arm64": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-1.9.4.tgz",
+      "integrity": "sha512-tlbhLk+WXZmgwoIKwHIHEBZUwxml7bRJgk0X2sPyNR3S93cdRq6XulAZRQJ17FYGGzWne0fgrXBKpl7l4M87Hg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-win32-x64": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-1.9.4.tgz",
+      "integrity": "sha512-8Y5wMhVIPaWe6jw2H+KlEm4wP/f7EW3810ZLmDlrEEy5KvBsb9ECEfu/kMWD484ijfQ8+nIi0giMgu9g1UAuuA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@fastify/busboy": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
+      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@octokit/auth-token": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-5.1.2.tgz",
+      "integrity": "sha512-JcQDsBdg49Yky2w2ld20IHAlwr8d/d8N6NiOXbtuoPCqzbsiJgF633mVUw3x4mo0H5ypataQIX7SFu3yy44Mpw==",
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-6.1.4.tgz",
+      "integrity": "sha512-lAS9k7d6I0MPN+gb9bKDt7X8SdxknYqAMh44S5L+lNqIN2NuV8nvv3g8rPp7MuRxcOpxpUIATWprO0C34a8Qmg==",
+      "dependencies": {
+        "@octokit/auth-token": "^5.0.0",
+        "@octokit/graphql": "^8.1.2",
+        "@octokit/request": "^9.2.1",
+        "@octokit/request-error": "^6.1.7",
+        "@octokit/types": "^13.6.2",
+        "before-after-hook": "^3.0.2",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "10.1.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.3.tgz",
+      "integrity": "sha512-nBRBMpKPhQUxCsQQeW+rCJ/OPSMcj3g0nfHn01zGYZXuNDvvXudF/TYY6APj5THlurerpFN4a/dQAIAaM6BYhA==",
+      "dependencies": {
+        "@octokit/types": "^13.6.2",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "8.1.2",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-8.1.2.tgz",
+      "integrity": "sha512-bdlj/CJVjpaz06NBpfHhp4kGJaRZfz7AzC+6EwUImRtrwIw8dIgJ63Xg0OzV9pRn3rIzrt5c2sa++BL0JJ8GLw==",
+      "dependencies": {
+        "@octokit/request": "^9.1.4",
+        "@octokit/types": "^13.6.2",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "23.0.1",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-23.0.1.tgz",
+      "integrity": "sha512-izFjMJ1sir0jn0ldEKhZ7xegCTj/ObmEDlEfpFrx4k/JyZSMRHbO3/rBwgE7f3m2DHt+RrNGIVw4wSmwnm3t/g=="
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "11.4.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-11.4.3.tgz",
+      "integrity": "sha512-tBXaAbXkqVJlRoA/zQVe9mUdb8rScmivqtpv3ovsC5xhje/a+NOCivs7eUhWBwCApJVsR4G5HMeaLbq7PxqZGA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.7.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "13.3.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-13.3.1.tgz",
+      "integrity": "sha512-o8uOBdsyR+WR8MK9Cco8dCgvG13H1RlM1nWnK/W7TEACQBFux/vPREgKucxUfuDQ5yi1T3hGf4C5ZmZXAERgwQ==",
+      "dependencies": {
+        "@octokit/types": "^13.8.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.2.2.tgz",
+      "integrity": "sha512-dZl0ZHx6gOQGcffgm1/Sf6JfEpmh34v3Af2Uci02vzUYz6qEN6zepoRtmybWXIGXFIK8K9ylE3b+duCWqhArtg==",
+      "dependencies": {
+        "@octokit/endpoint": "^10.1.3",
+        "@octokit/request-error": "^6.1.7",
+        "@octokit/types": "^13.6.2",
+        "fast-content-type-parse": "^2.0.0",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.7.tgz",
+      "integrity": "sha512-69NIppAwaauwZv6aOzb+VVLwt+0havz9GT5YplkeJv7fG7a40qpLt/yZKyiDxAhgz0EtgNdNcb96Z0u+Zyuy2g==",
+      "dependencies": {
+        "@octokit/types": "^13.6.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "13.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.8.0.tgz",
+      "integrity": "sha512-x7DjTIbEpEWXK99DMd01QfWy0hd5h4EN+Q7shkdKds3otGQP+oWE/y0A76i1OvH9fygo4ddvNf7ZvF0t78P98A==",
+      "dependencies": {
+        "@octokit/openapi-types": "^23.0.1"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "22.13.10",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.13.10.tgz",
+      "integrity": "sha512-I6LPUvlRH+O6VRUqYOcMudhaIdUVWfsjnZavnsraHvpBwaEyMN29ry+0UVJhImYL16xsscu0aske3yA+uPOWfw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.20.0"
+      }
+    },
+    "node_modules/@types/semver": {
+      "version": "7.5.8",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.5.8.tgz",
+      "integrity": "sha512-I8EUhyrgfLrcTkzV3TSsGyl1tSuPrEDzr0yd5m90UgNxQkyDXULk3b6MlQqTCpZpNtWe1K0hzclnZkTcLBe2UQ==",
+      "dev": true
+    },
+    "node_modules/@vercel/ncc": {
+      "version": "0.38.3",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.3.tgz",
+      "integrity": "sha512-rnK6hJBS6mwc+Bkab+PGPs9OiS0i/3kdTO+CkI8V0/VrW3vmz7O2Pxjw/owOlmo6PKEIxRSeZKv/kuL9itnpYA==",
+      "dev": true,
+      "bin": {
+        "ncc": "dist/ncc/cli.js"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true
+    },
+    "node_modules/before-after-hook": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-3.0.2.tgz",
+      "integrity": "sha512-Nik3Sc0ncrMK4UUdXQmAnRtzmNQTAAXmXIopizwZ1W1t8QmfJj+zL4OA2I7XPTPW5z5TDqv4hRo/JzouDJnX3A=="
+    },
+    "node_modules/fast-content-type-parse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-2.0.1.tgz",
+      "integrity": "sha512-nGqtvLrj5w0naR6tDPfB4cUmYCqouzyQiz6C5y/LtcDllJdrcc6WaWW6iXyIIOErTa/XRybj28aasdn4LkVk6Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ]
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "dev": true,
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/smol-toml": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.3.1.tgz",
+      "integrity": "sha512-tEYNll18pPKHroYSmLLrksq233j021G0giwW7P3D24jC54pQ5W5BXMsQ/Mvw1OJCmEYDgY+lrzT+3nNUtoNfXQ==",
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/cyyynthia"
+      }
+    },
+    "node_modules/tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+      "engines": {
+        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.8.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.2.tgz",
+      "integrity": "sha512-aJn6wq13/afZp/jT9QZmwEjDqqvSGp1VT5GVg+f/t6/oVyrgXM6BY1h9BRh/O5p3PlUPAe+WuiEZOmb/49RqoQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici": {
+      "version": "5.28.5",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
+      "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.20.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.20.0.tgz",
+      "integrity": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/universal-user-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
+      "integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q=="
+    }
+  }
+}

package.json

@@ -0,0 +1,41 @@
+{
+  "name": "ruff-action",
+  "version": "1.0.0",
+  "private": true,
+  "description": "A GitHub Action to run Ruff, an extremely fast Python linter and code formatter.",
+  "main": "dist/ruff-action/index.js",
+  "scripts": {
+    "build": "tsc",
+    "format": "biome format --fix",
+    "format-check": "biome format",
+    "lint": "biome lint --fix",
+    "package": "ncc build -o dist/ruff-action src/ruff-action.ts && ncc build -o dist/update-known-checksums src/update-known-checksums.ts",
+    "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
+    "update-known-checksums": "RUNNER_TEMP=known_checksums node dist/update-known-checksums/index.js src/download/checksum/known-checksums.ts \"$(gh auth token)\"",
+    "all": "npm install && npm run build && npm run format && npm run lint && npm run package"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/astral-sh/ruff-action.git"
+  },
+  "keywords": ["actions", "python", "ruff", "action"],
+  "author": "@eifinger",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@actions/core": "^1.11.1",
+    "@actions/exec": "^1.1.1",
+    "@actions/tool-cache": "^2.0.2",
+    "@octokit/core": "^6.1.4",
+    "@octokit/plugin-paginate-rest": "^11.4.3",
+    "@octokit/plugin-rest-endpoint-methods": "^13.3.1",
+    "smol-toml": "^1.3.1"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "1.9.4",
+    "@types/node": "^22.13.10",
+    "@types/semver": "^7.5.8",
+    "@vercel/ncc": "^0.38.3",
+    "js-yaml": "^4.1.0",
+    "typescript": "^5.8.2"
+  }
+}

pyproject.toml

@@ -1,54 +0,0 @@
-[tool.ruff]
-
-select = ["A", "ANN", "B", "C90", "D", "E", "F", "I", "N", "COM", "DTZ", "PD", "RUF", "TID", "UP", "W"]
-ignore = ["D203", "D212"]
-
-fixable = ["I", "RUF100"]
-unfixable = []
-
-# Exclude a variety of commonly ignored directories.
-exclude = [
-    ".bzr",
-    ".direnv",
-    ".eggs",
-    ".git",
-    ".hg",
-    ".mypy_cache",
-    ".nox",
-    ".pants.d",
-    ".pytype",
-    ".ruff_cache",
-    ".svn",
-    ".tox",
-    ".venv",
-    "__pypackages__",
-    "_build",
-    "buck-out",
-    "build",
-    "dist",
-    "node_modules",
-    "venv",
-]
-
-line-length = 88
-
-# Allow unused variables when underscore-prefixed.
-dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"
-
-target-version = "py311"
-
-[tool.ruff.mccabe]
-# Unlike Flake8, default to a complexity level of 10.
-max-complexity = 10
-
-
-[tool.pyright]
-typeCheckingMode = "lazy"
-defineConstant = { DEBUG = true }
-
-reportMissingImports = false
-reportMissingTypeStubs = false
-reportInvalidStringEscapeSequence = false
-
-pythonVersion = "3.11"
-pythonPlatform = "Linux"

src/download/checksum/checksum.ts

@@ -0,0 +1,57 @@
+import * as fs from "node:fs";
+import * as crypto from "node:crypto";
+
+import * as core from "@actions/core";
+import { KNOWN_CHECKSUMS } from "./known-checksums";
+import type { Architecture, Platform } from "../../utils/platforms";
+
+export async function validateChecksum(
+  checkSum: string | undefined,
+  downloadPath: string,
+  arch: Architecture,
+  platform: Platform,
+  version: string,
+): Promise<void> {
+  let isValid: boolean | undefined = undefined;
+  if (checkSum !== undefined && checkSum !== "") {
+    isValid = await validateFileCheckSum(downloadPath, checkSum);
+  } else {
+    core.debug("Checksum not provided. Checking known checksums.");
+    const key = `${arch}-${platform}-${version}`;
+    if (key in KNOWN_CHECKSUMS) {
+      const knownChecksum = KNOWN_CHECKSUMS[`${arch}-${platform}-${version}`];
+      core.debug(`Checking checksum for ${arch}-${platform}-${version}.`);
+      isValid = await validateFileCheckSum(downloadPath, knownChecksum);
+    } else {
+      core.debug(`No known checksum found for ${key}.`);
+    }
+  }
+
+  if (isValid === false) {
+    throw new Error(`Checksum for ${downloadPath} did not match ${checkSum}.`);
+  }
+  if (isValid === true) {
+    core.debug(`Checksum for ${downloadPath} is valid.`);
+  }
+}
+
+async function validateFileCheckSum(
+  filePath: string,
+  expected: string,
+): Promise<boolean> {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash("sha256");
+    const stream = fs.createReadStream(filePath);
+    stream.on("error", (err) => reject(err));
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("end", () => {
+      const actual = hash.digest("hex");
+      resolve(actual === expected);
+    });
+  });
+}
+
+export function isknownVersion(version: string): boolean {
+  const pattern = new RegExp(`^.*-.*-${version}$`);
+  return Object.keys(KNOWN_CHECKSUMS).some((key) => pattern.test(key));
+}

src/download/checksum/update-known-checksums.ts

@@ -0,0 +1,65 @@
+import { promises as fs } from "node:fs";
+import * as tc from "@actions/tool-cache";
+import { KNOWN_CHECKSUMS } from "./known-checksums";
+export async function updateChecksums(
+  filePath: string,
+  downloadUrls: string[],
+): Promise<void> {
+  await fs.rm(filePath);
+  await fs.appendFile(
+    filePath,
+    "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n",
+  );
+  let firstLine = true;
+  for (const downloadUrl of downloadUrls) {
+    const key = getKey(downloadUrl);
+    if (key === undefined) {
+      continue;
+    }
+    const checksum = await getOrDownloadChecksum(key, downloadUrl);
+    if (!firstLine) {
+      await fs.appendFile(filePath, ",\n");
+    }
+    await fs.appendFile(filePath, `  "${key}":\n    "${checksum}"`);
+    firstLine = false;
+  }
+  await fs.appendFile(filePath, ",\n};\n");
+}
+
+function getKey(downloadUrl: string): string | undefined {
+  const parts = downloadUrl.split("/");
+  const version = parts[parts.length - 2].replace("v", "");
+  const fileName = parts[parts.length - 1];
+  if (fileName.startsWith("source")) {
+    return undefined;
+  }
+  if (fileName.includes(version)) {
+    // https://github.com/astral-sh/ruff/releases/download/v0.4.10/ruff-0.4.10-aarch64-apple-darwin.tar.gz.sha256
+    const name = fileName.split(version)[1].split(".")[0].substring(1);
+    return `${name}-${version}`;
+  }
+  // https://github.com/astral-sh/ruff/releases/download/v0.1.7/ruff-aarch64-apple-darwin.tar.gz.sha256
+  // or
+  // https://github.com/astral-sh/ruff/releases/download/0.8.0/ruff-aarch64-apple-darwin.tar.gz.sha256
+  const name = fileName.split(".")[0].split("ruff-")[1];
+  return `${name}-${version}`;
+}
+
+async function getOrDownloadChecksum(
+  key: string,
+  downloadUrl: string,
+): Promise<string> {
+  let checksum: string;
+  if (key in KNOWN_CHECKSUMS) {
+    checksum = KNOWN_CHECKSUMS[key];
+  } else {
+    const content = await downloadAssetContent(downloadUrl);
+    checksum = content.split(" ")[0].trim();
+  }
+  return checksum;
+}
+
+async function downloadAssetContent(downloadUrl: string): Promise<string> {
+  const downloadPath = await tc.downloadTool(downloadUrl);
+  return await fs.readFile(downloadPath, "utf8");
+}

src/download/download-version.ts

@@ -0,0 +1,154 @@
+import * as core from "@actions/core";
+import * as tc from "@actions/tool-cache";
+import * as path from "node:path";
+import { promises as fs } from "node:fs";
+import { OWNER, REPO, TOOL_CACHE_NAME } from "../utils/constants";
+import type { Architecture, Platform } from "../utils/platforms";
+import { validateChecksum } from "./checksum/checksum";
+import { Octokit } from "@octokit/core";
+import { paginateRest } from "@octokit/plugin-paginate-rest";
+import { restEndpointMethods } from "@octokit/plugin-rest-endpoint-methods";
+
+const PaginatingOctokit = Octokit.plugin(paginateRest, restEndpointMethods);
+
+export function tryGetFromToolCache(
+  arch: Architecture,
+  version: string,
+): { version: string; installedPath: string | undefined } {
+  core.debug(`Trying to get ruff from tool cache for ${version}...`);
+  const cachedVersions = tc.findAllVersions(TOOL_CACHE_NAME, arch);
+  core.debug(`Cached versions: ${cachedVersions}`);
+  let resolvedVersion = tc.evaluateVersions(cachedVersions, version);
+  if (resolvedVersion === "") {
+    resolvedVersion = version;
+  }
+  const installedPath = tc.find(TOOL_CACHE_NAME, resolvedVersion, arch);
+  return { version: resolvedVersion, installedPath };
+}
+
+export async function downloadVersion(
+  platform: Platform,
+  arch: Architecture,
+  version: string,
+  checkSum: string | undefined,
+  githubToken: string,
+): Promise<{ version: string; cachedToolDir: string }> {
+  const artifact = `ruff-${arch}-${platform}`;
+  let extension = ".tar.gz";
+  if (platform === "pc-windows-msvc") {
+    extension = ".zip";
+  }
+  const downloadUrl = `https://github.com/${OWNER}/${REPO}/releases/download/${version}/${artifact}${extension}`;
+  core.info(`Downloading ruff from "${downloadUrl}" ...`);
+
+  const downloadPath = await tc.downloadTool(
+    downloadUrl,
+    undefined,
+    githubToken,
+  );
+  await validateChecksum(checkSum, downloadPath, arch, platform, version);
+
+  let ruffDir: string;
+  if (platform === "pc-windows-msvc") {
+    const fullPathWithExtension = `${downloadPath}${extension}`;
+    await fs.copyFile(downloadPath, fullPathWithExtension);
+    ruffDir = await tc.extractZip(fullPathWithExtension);
+    // On windows extracting the zip does not create an intermediate directory
+  } else {
+    const extractedDir = await tc.extractTar(downloadPath);
+    ruffDir = path.join(extractedDir, artifact);
+  }
+  const cachedToolDir = await tc.cacheDir(
+    ruffDir,
+    TOOL_CACHE_NAME,
+    version,
+    arch,
+  );
+  return { version: version, cachedToolDir };
+}
+
+export async function resolveVersion(
+  versionInput: string,
+  githubToken: string,
+): Promise<string> {
+  core.debug(`Resolving ${versionInput}...`);
+  const version =
+    versionInput === "latest"
+      ? await getLatestVersion(githubToken)
+      : versionInput;
+  if (tc.isExplicitVersion(version)) {
+    core.debug(`Version ${version} is an explicit version.`);
+    return version;
+  }
+  const availableVersions = await getAvailableVersions(githubToken);
+  const resolvedVersion = tc.evaluateVersions(availableVersions, version);
+  if (resolvedVersion === "") {
+    throw new Error(`No version found for ${version}`);
+  }
+  core.debug(`Resolved version: ${resolvedVersion}`);
+  return resolvedVersion;
+}
+
+async function getAvailableVersions(githubToken: string): Promise<string[]> {
+  try {
+    const octokit = new PaginatingOctokit({
+      auth: githubToken,
+    });
+    return await getReleaseTagNames(octokit);
+  } catch (err) {
+    if ((err as Error).message.includes("Bad credentials")) {
+      core.info(
+        "No (valid) GitHub token provided. Falling back to anonymous. Requests might be rate limited.",
+      );
+      const octokit = new PaginatingOctokit();
+      return await getReleaseTagNames(octokit);
+    }
+    throw err;
+  }
+}
+
+async function getReleaseTagNames(
+  octokit: InstanceType<typeof PaginatingOctokit>,
+): Promise<string[]> {
+  const response = await octokit.paginate(octokit.rest.repos.listReleases, {
+    owner: OWNER,
+    repo: REPO,
+  });
+  return response.map((release) => release.tag_name);
+}
+
+async function getLatestVersion(githubToken: string) {
+  const octokit = new PaginatingOctokit({
+    auth: githubToken,
+  });
+
+  let latestRelease: { tag_name: string } | undefined;
+  try {
+    latestRelease = await getLatestRelease(octokit);
+  } catch (err) {
+    if ((err as Error).message.includes("Bad credentials")) {
+      core.info(
+        "No (valid) GitHub token provided. Falling back to anonymous. Requests might be rate limited.",
+      );
+      const octokit = new PaginatingOctokit();
+      latestRelease = await getLatestRelease(octokit);
+    } else {
+      throw err;
+    }
+  }
+
+  if (!latestRelease) {
+    throw new Error("Could not determine latest release.");
+  }
+  return latestRelease.tag_name;
+}
+
+async function getLatestRelease(
+  octokit: InstanceType<typeof PaginatingOctokit>,
+) {
+  const { data: latestRelease } = await octokit.rest.repos.getLatestRelease({
+    owner: OWNER,
+    repo: REPO,
+  });
+  return latestRelease;
+}

src/ruff-action.ts

@@ -0,0 +1,150 @@
+import * as core from "@actions/core";
+import * as exec from "@actions/exec";
+import * as path from "node:path";
+import {
+  downloadVersion,
+  resolveVersion,
+  tryGetFromToolCache,
+} from "./download/download-version";
+
+import {
+  type Architecture,
+  getArch,
+  getPlatform,
+  type Platform,
+} from "./utils/platforms";
+import {
+  args,
+  checkSum,
+  githubToken,
+  src,
+  version,
+  versionFile as versionFileInput,
+} from "./utils/inputs";
+import { getRuffVersionFromRequirementsFile } from "./utils/pyproject";
+import * as fs from "node:fs";
+
+async function run(): Promise<void> {
+  const platform = getPlatform();
+  const arch = getArch();
+
+  try {
+    if (platform === undefined) {
+      throw new Error(`Unsupported platform: ${process.platform}`);
+    }
+    if (arch === undefined) {
+      throw new Error(`Unsupported architecture: ${process.arch}`);
+    }
+    const setupResult = await setupRuff(platform, arch, checkSum, githubToken);
+
+    addRuffToPath(setupResult.ruffDir);
+    setOutputFormat();
+    addMatchers();
+    core.setOutput("ruff-version", setupResult.version);
+    core.info(`Successfully installed ruff version ${setupResult.version}`);
+
+    await runRuff(
+      path.join(setupResult.ruffDir, "ruff"),
+      args.split(" "),
+      src.split(" "),
+    );
+
+    process.exit(0);
+  } catch (err) {
+    core.setFailed((err as Error).message);
+  }
+}
+
+async function setupRuff(
+  platform: Platform,
+  arch: Architecture,
+  checkSum: string | undefined,
+  githubToken: string,
+): Promise<{ ruffDir: string; version: string }> {
+  const resolvedVersion = await determineVersion();
+  const toolCacheResult = tryGetFromToolCache(arch, resolvedVersion);
+  if (toolCacheResult.installedPath) {
+    core.info(`Found ruffDir in tool-cache for ${toolCacheResult.version}`);
+    return {
+      ruffDir: toolCacheResult.installedPath,
+      version: toolCacheResult.version,
+    };
+  }
+
+  const downloadVersionResult = await downloadVersion(
+    platform,
+    arch,
+    resolvedVersion,
+    checkSum,
+    githubToken,
+  );
+
+  return {
+    ruffDir: downloadVersionResult.cachedToolDir,
+    version: downloadVersionResult.version,
+  };
+}
+
+async function determineVersion(): Promise<string> {
+  if (versionFileInput !== "" && version !== "") {
+    throw Error("It is not allowed to specify both version and version-file");
+  }
+  if (version !== "") {
+    return await resolveVersion(version, githubToken);
+  }
+  if (versionFileInput !== "") {
+    const versionFromPyproject =
+      getRuffVersionFromRequirementsFile(versionFileInput);
+    if (versionFromPyproject === undefined) {
+      core.warning(
+        `Could not parse version from ${versionFileInput}. Using latest version.`,
+      );
+    }
+    return await resolveVersion(versionFromPyproject || "latest", githubToken);
+  }
+  const pyProjectPath = path.join(src, "pyproject.toml");
+  if (!fs.existsSync(pyProjectPath)) {
+    core.info(`Could not find ${pyProjectPath}. Using latest version.`);
+    return await resolveVersion("latest", githubToken);
+  }
+  const versionFromPyproject =
+    getRuffVersionFromRequirementsFile(pyProjectPath);
+  if (versionFromPyproject === undefined) {
+    core.warning(
+      `Could not parse version from ${pyProjectPath}. Using latest version.`,
+    );
+  }
+  return await resolveVersion(versionFromPyproject || "latest", githubToken);
+}
+
+function addRuffToPath(cachedPath: string): void {
+  core.addPath(cachedPath);
+  core.info(`Added ${cachedPath} to the path`);
+}
+
+function setOutputFormat() {
+  core.exportVariable("RUFF_OUTPUT_FORMAT", "github");
+  core.info("Set RUFF_OUTPUT_FORMAT to github");
+}
+
+function addMatchers(): void {
+  const matchersPath = path.join(
+    __dirname,
+    `..${path.sep}..`,
+    ".github",
+    "matchers",
+  );
+  core.info(`##[add-matcher]${path.join(matchersPath, "check.json")}`);
+  core.info(`##[add-matcher]${path.join(matchersPath, "format.json")}`);
+}
+
+async function runRuff(
+  ruffExecutablePath: string,
+  args: string[],
+  src: string[],
+): Promise<void> {
+  const execArgs = [...args, ...src];
+  await exec.exec(ruffExecutablePath, execArgs);
+}
+
+run();

src/update-known-checksums.ts

@@ -0,0 +1,36 @@
+import { Octokit } from "@octokit/core";
+import * as core from "@actions/core";
+import { paginateRest } from "@octokit/plugin-paginate-rest";
+import { restEndpointMethods } from "@octokit/plugin-rest-endpoint-methods";
+
+import { OWNER, REPO } from "./utils/constants";
+import * as semver from "semver";
+
+import { updateChecksums } from "./download/checksum/update-known-checksums";
+
+const PaginatingOctokit = Octokit.plugin(paginateRest, restEndpointMethods);
+
+async function run(): Promise<void> {
+  const checksumFilePath = process.argv.slice(2)[0];
+  const github_token = process.argv.slice(2)[1];
+
+  const octokit = new PaginatingOctokit({ auth: github_token });
+
+  const response = await octokit.paginate(octokit.rest.repos.listReleases, {
+    owner: OWNER,
+    repo: REPO,
+  });
+  const downloadUrls: string[] = response.flatMap((release) =>
+    release.assets
+      .filter((asset) => asset.name.endsWith(".sha256"))
+      .map((asset) => asset.browser_download_url),
+  );
+  await updateChecksums(checksumFilePath, downloadUrls);
+
+  const latestVersion = response
+    .map((release) => release.tag_name)
+    .sort(semver.rcompare)[0];
+  core.setOutput("latest-version", latestVersion);
+}
+
+run();

src/utils/constants.ts

@@ -0,0 +1,3 @@
+export const REPO = "ruff";
+export const OWNER = "astral-sh";
+export const TOOL_CACHE_NAME = "ruff";

src/utils/inputs.ts

@@ -0,0 +1,8 @@
+import * as core from "@actions/core";
+
+export const version = core.getInput("version");
+export const checkSum = core.getInput("checksum");
+export const githubToken = core.getInput("github-token");
+export const args = core.getInput("args");
+export const src = core.getInput("src");
+export const versionFile = core.getInput("version-file");

src/utils/platforms.ts

@@ -0,0 +1,33 @@
+export type Platform =
+  | "unknown-linux-gnu"
+  | "unknown-linux-musl"
+  | "unknown-linux-musleabihf"
+  | "apple-darwin"
+  | "pc-windows-msvc";
+export type Architecture = "i686" | "x86_64" | "aarch64";
+
+export function getArch(): Architecture | undefined {
+  const arch = process.arch;
+  const archMapping: { [key: string]: Architecture } = {
+    ia32: "i686",
+    x64: "x86_64",
+    arm64: "aarch64",
+  };
+
+  if (arch in archMapping) {
+    return archMapping[arch];
+  }
+}
+
+export function getPlatform(): Platform | undefined {
+  const platform = process.platform;
+  const platformMapping: { [key: string]: Platform } = {
+    linux: "unknown-linux-gnu",
+    darwin: "apple-darwin",
+    win32: "pc-windows-msvc",
+  };
+
+  if (platform in platformMapping) {
+    return platformMapping[platform];
+  }
+}

src/utils/pyproject.ts

@@ -0,0 +1,66 @@
+import * as fs from "node:fs";
+import * as core from "@actions/core";
+import * as toml from "smol-toml";
+
+function getRuffVersionFromAllDependencies(
+  allDependencies: string[],
+): string | undefined {
+  const ruffVersionDefinition = allDependencies.find((dep: string) =>
+    dep.startsWith("ruff"),
+  );
+
+  if (ruffVersionDefinition) {
+    const ruffVersion = ruffVersionDefinition
+      .match(/^ruff([^A-Z0-9._-]+.*)$/)?.[1]
+      .trim();
+    if (ruffVersion?.startsWith("==")) {
+      return ruffVersion.slice(2);
+    }
+    core.info(`Found ruff version in pyproject.toml: ${ruffVersion}`);
+    return ruffVersion;
+  }
+
+  return undefined;
+}
+
+function parsePyproject(pyprojectContent: string): string | undefined {
+  const pyproject: {
+    project?: {
+      dependencies?: string[];
+      "optional-dependencies"?: Map<string, string[]>;
+    };
+    "dependency-groups"?: Map<string, Array<string | object>>;
+  } = toml.parse(pyprojectContent);
+  const dependencies: string[] = pyproject?.project?.dependencies || [];
+  const optionalDependencies: string[] = Object.values(
+    pyproject?.project?.["optional-dependencies"] || {},
+  ).flat();
+  const devDependencies: string[] = Object.values(
+    pyproject?.["dependency-groups"] || {},
+  )
+    .flat()
+    .filter((item: string | object) => typeof item === "string");
+  return getRuffVersionFromAllDependencies(
+    dependencies.concat(optionalDependencies, devDependencies),
+  );
+}
+
+export function getRuffVersionFromRequirementsFile(
+  filePath: string,
+): string | undefined {
+  if (!fs.existsSync(filePath)) {
+    core.warning(`Could not find file: ${filePath}`);
+    return undefined;
+  }
+  const pyprojectContent = fs.readFileSync(filePath, "utf-8");
+  if (filePath.endsWith(".txt")) {
+    return getRuffVersionFromAllDependencies(pyprojectContent.split("\n"));
+  }
+  try {
+    return parsePyproject(pyprojectContent);
+  } catch (err) {
+    const message = (err as Error).message;
+    core.warning(`Error while parsing ${filePath}: ${message}`);
+    return undefined;
+  }
+}

tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
+    "outDir": "./lib" /* Redirect output structure to the directory. */,
+    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
+    "strict": true /* Enable all strict type-checking options. */,
+    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+  },
+  "exclude": ["node_modules", "**/*.test.ts"]
+}