Retrieve version metadata from astral-sh/versions ndjson instead of the GitHub API

src/download/checksum/checksum.ts

@@ -11,24 +11,35 @@ export async function validateChecksum(
   arch: Architecture,
   platform: Platform,
   version: string,
+  ndjsonChecksum?: string,
 ): Promise<void> {
   let isValid: boolean | undefined;
+  let checksumUsed: string | undefined;
+
+  // Priority: user-provided checksum > KNOWN_CHECKSUMS > NDJSON fallback
   if (checkSum !== undefined && checkSum !== "") {
+    checksumUsed = checkSum;
+    core.debug("Using user-provided checksum.");
     isValid = await validateFileCheckSum(downloadPath, checkSum);
   } else {
-    core.debug("Checksum not provided. Checking known checksums.");
     const key = `${arch}-${platform}-${version}`;
     if (key in KNOWN_CHECKSUMS) {
-      const knownChecksum = KNOWN_CHECKSUMS[`${arch}-${platform}-${version}`];
-      core.debug(`Checking checksum for ${arch}-${platform}-${version}.`);
-      isValid = await validateFileCheckSum(downloadPath, knownChecksum);
+      checksumUsed = KNOWN_CHECKSUMS[key];
+      core.debug(`Using known checksum for ${key}.`);
+      isValid = await validateFileCheckSum(downloadPath, checksumUsed);
+    } else if (ndjsonChecksum !== undefined && ndjsonChecksum !== "") {
+      checksumUsed = ndjsonChecksum;
+      core.debug("Using checksum from NDJSON version data.");
+      isValid = await validateFileCheckSum(downloadPath, ndjsonChecksum);
     } else {
-      core.debug(`No known checksum found for ${key}.`);
+      core.debug(`No checksum found for ${key}.`);
     }
   }
 
   if (isValid === false) {
-    throw new Error(`Checksum for ${downloadPath} did not match ${checkSum}.`);
+    throw new Error(
+      `Checksum for ${downloadPath} did not match ${checksumUsed}.`,
+    );
   }
   if (isValid === true) {
     core.debug(`Checksum for ${downloadPath} is valid.`);

src/download/checksum/update-known-checksums.ts

@@ -1,9 +1,13 @@
 import { promises as fs } from "node:fs";
-import * as tc from "@actions/tool-cache";
-import { KNOWN_CHECKSUMS } from "./known-checksums";
+
+export interface ChecksumEntry {
+  key: string;
+  checksum: string;
+}
+
 export async function updateChecksums(
   filePath: string,
-  downloadUrls: string[],
+  checksumEntries: ChecksumEntry[],
 ): Promise<void> {
   await fs.rm(filePath);
   await fs.appendFile(
@@ -11,49 +15,12 @@ export async function updateChecksums(
     "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n",
   );
   let firstLine = true;
-  for (const downloadUrl of downloadUrls) {
-    const key = getKey(downloadUrl);
-    if (key === undefined) {
-      continue;
-    }
-    const checksum = await getOrDownloadChecksum(key, downloadUrl);
+  for (const entry of checksumEntries) {
     if (!firstLine) {
       await fs.appendFile(filePath, ",\n");
     }
-    await fs.appendFile(filePath, `  "${key}":\n    "${checksum}"`);
+    await fs.appendFile(filePath, `  "${entry.key}":\n    "${entry.checksum}"`);
     firstLine = false;
   }
   await fs.appendFile(filePath, ",\n};\n");
 }
-
-function getKey(downloadUrl: string): string | undefined {
-  // https://github.com/astral-sh/uv/releases/download/0.3.2/uv-aarch64-apple-darwin.tar.gz.sha256
-  const parts = downloadUrl.split("/");
-  const fileName = parts[parts.length - 1];
-  if (fileName.startsWith("source")) {
-    return undefined;
-  }
-  const name = fileName.split(".")[0].split("uv-")[1];
-  const version = parts[parts.length - 2];
-  return `${name}-${version}`;
-}
-
-async function getOrDownloadChecksum(
-  key: string,
-  downloadUrl: string,
-): Promise<string> {
-  let checksum = "";
-  if (key in KNOWN_CHECKSUMS) {
-    checksum = KNOWN_CHECKSUMS[key];
-  } else {
-    const content = await downloadAssetContent(downloadUrl);
-    checksum = content.split(" ")[0].trim();
-  }
-  return checksum;
-}
-
-async function downloadAssetContent(downloadUrl: string): Promise<string> {
-  const downloadPath = await tc.downloadTool(downloadUrl);
-  const content = await fs.readFile(downloadPath, "utf8");
-  return content;
-}

src/download/download-version.ts

@@ -2,20 +2,21 @@ import { promises as fs } from "node:fs";
 import * as path from "node:path";
 import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
-import type { Endpoints } from "@octokit/types";
 import * as pep440 from "@renovatebot/pep440";
 import * as semver from "semver";
 import { OWNER, REPO, TOOL_CACHE_NAME } from "../utils/constants";
-import { Octokit } from "../utils/octokit";
 import type { Architecture, Platform } from "../utils/platforms";
 import { validateChecksum } from "./checksum/checksum";
 import {
   getDownloadUrl,
   getLatestKnownVersion as getLatestVersionInManifest,
 } from "./version-manifest";
-
-type Release =
-  Endpoints["GET /repos/{owner}/{repo}/releases"]["response"]["data"][number];
+import {
+  type ArtifactResult,
+  getAllVersions,
+  getArtifact,
+  getLatestVersion as getLatestVersionFromNdjson,
+} from "./versions-client";
 
 export function tryGetFromToolCache(
   arch: Architecture,
@@ -41,7 +42,19 @@ export async function downloadVersionFromGithub(
 ): Promise<{ version: string; cachedToolDir: string }> {
   const artifact = `uv-${arch}-${platform}`;
   const extension = getExtension(platform);
-  const downloadUrl = `https://github.com/${OWNER}/${REPO}/releases/download/${version}/${artifact}${extension}`;
+
+  // Try to get artifact info from NDJSON (includes checksum)
+  let artifactInfo: ArtifactResult | undefined;
+  try {
+    artifactInfo = await getArtifact(version, arch, platform);
+  } catch (err) {
+    core.debug(`Failed to get artifact from NDJSON: ${(err as Error).message}`);
+  }
+
+  const downloadUrl =
+    artifactInfo?.url ??
+    `https://github.com/${OWNER}/${REPO}/releases/download/${version}/${artifact}${extension}`;
+
   return await downloadVersion(
     downloadUrl,
     artifact,
@@ -50,6 +63,7 @@ export async function downloadVersionFromGithub(
     version,
     checkSum,
     githubToken,
+    artifactInfo?.sha256,
   );
 }
 
@@ -79,6 +93,16 @@ export async function downloadVersionFromManifest(
       githubToken,
     );
   }
+
+  // Try to get checksum from NDJSON for manifest downloads too
+  let ndjsonChecksum: string | undefined;
+  try {
+    const artifactInfo = await getArtifact(version, arch, platform);
+    ndjsonChecksum = artifactInfo?.sha256;
+  } catch (err) {
+    core.debug(`Failed to get artifact from NDJSON: ${(err as Error).message}`);
+  }
+
   return await downloadVersion(
     downloadUrl,
     `uv-${arch}-${platform}`,
@@ -87,6 +111,7 @@ export async function downloadVersionFromManifest(
     version,
     checkSum,
     githubToken,
+    ndjsonChecksum,
   );
 }
 
@@ -98,6 +123,7 @@ async function downloadVersion(
   version: string,
   checkSum: string | undefined,
   githubToken: string,
+  ndjsonChecksum?: string,
 ): Promise<{ version: string; cachedToolDir: string }> {
   core.info(`Downloading uv from "${downloadUrl}" ...`);
   const downloadPath = await tc.downloadTool(
@@ -105,7 +131,14 @@ async function downloadVersion(
     undefined,
     githubToken,
   );
-  await validateChecksum(checkSum, downloadPath, arch, platform, version);
+  await validateChecksum(
+    checkSum,
+    downloadPath,
+    arch,
+    platform,
+    version,
+    ndjsonChecksum,
+  );
 
   let uvDir: string;
   if (platform === "pc-windows-msvc") {
@@ -143,7 +176,6 @@ function getExtension(platform: Platform): string {
 export async function resolveVersion(
   versionInput: string,
   manifestFile: string | undefined,
-  githubToken: string,
   resolutionStrategy: "highest" | "lowest" = "highest",
 ): Promise<string> {
   core.debug(`Resolving version: ${versionInput}`);
@@ -163,7 +195,7 @@ export async function resolveVersion(
   } else {
     version =
       versionInput === "latest" || resolveVersionSpecifierToLatest
-        ? await getLatestVersion(githubToken)
+        ? await getLatestVersionFromNdjson()
         : versionInput;
   }
   if (tc.isExplicitVersion(version)) {
@@ -175,7 +207,7 @@ export async function resolveVersion(
     }
     return version;
   }
-  const availableVersions = await getAvailableVersions(githubToken);
+  const availableVersions = await getAvailableVersions();
   core.debug(`Available versions: ${availableVersions}`);
   const resolvedVersion =
     resolutionStrategy === "lowest"
@@ -187,79 +219,9 @@ export async function resolveVersion(
   return resolvedVersion;
 }
 
-async function getAvailableVersions(githubToken: string): Promise<string[]> {
-  core.info("Getting available versions from GitHub API...");
-  try {
-    const octokit = new Octokit({
-      auth: githubToken,
-    });
-    return await getReleaseTagNames(octokit);
-  } catch (err) {
-    if ((err as Error).message.includes("Bad credentials")) {
-      core.info(
-        "No (valid) GitHub token provided. Falling back to anonymous. Requests might be rate limited.",
-      );
-      const octokit = new Octokit();
-      return await getReleaseTagNames(octokit);
-    }
-    throw err;
-  }
-}
-
-async function getReleaseTagNames(octokit: Octokit): Promise<string[]> {
-  const response: Release[] = await octokit.paginate(
-    octokit.rest.repos.listReleases,
-    {
-      owner: OWNER,
-      repo: REPO,
-    },
-  );
-  const releaseTagNames = response.map((release) => release.tag_name);
-  if (releaseTagNames.length === 0) {
-    throw Error(
-      "Github API request failed while getting releases. Check the GitHub status page for outages. Try again later.",
-    );
-  }
-  return releaseTagNames;
-}
-
-async function getLatestVersion(githubToken: string) {
-  core.info("Getting latest version from GitHub API...");
-  const octokit = new Octokit({
-    auth: githubToken,
-  });
-
-  let latestRelease: { tag_name: string } | undefined;
-  try {
-    latestRelease = await getLatestRelease(octokit);
-  } catch (err) {
-    if ((err as Error).message.includes("Bad credentials")) {
-      core.info(
-        "No (valid) GitHub token provided. Falling back to anonymous. Requests might be rate limited.",
-      );
-      const octokit = new Octokit();
-      latestRelease = await getLatestRelease(octokit);
-    } else {
-      core.error(
-        "Github API request failed while getting latest release. Check the GitHub status page for outages. Try again later.",
-      );
-      throw err;
-    }
-  }
-
-  if (!latestRelease) {
-    throw new Error("Could not determine latest release.");
-  }
-  core.debug(`Latest version: ${latestRelease.tag_name}`);
-  return latestRelease.tag_name;
-}
-
-async function getLatestRelease(octokit: Octokit) {
-  const { data: latestRelease } = await octokit.rest.repos.getLatestRelease({
-    owner: OWNER,
-    repo: REPO,
-  });
-  return latestRelease;
+async function getAvailableVersions(): Promise<string[]> {
+  core.info("Getting available versions from NDJSON...");
+  return await getAllVersions();
 }
 
 function maxSatisfying(

src/download/versions-client.ts

@@ -0,0 +1,140 @@
+import * as core from "@actions/core";
+import { VERSIONS_NDJSON_URL } from "../utils/constants";
+import { fetch } from "../utils/fetch";
+
+export interface NdjsonArtifact {
+  platform: string;
+  variant: string;
+  url: string;
+  archive_format: string;
+  sha256: string;
+}
+
+export interface NdjsonVersion {
+  version: string;
+  artifacts: NdjsonArtifact[];
+}
+
+let cachedVersionData: NdjsonVersion[] | null = null;
+
+export async function fetchVersionData(): Promise<NdjsonVersion[]> {
+  if (cachedVersionData !== null) {
+    core.debug("Using cached NDJSON version data");
+    return cachedVersionData;
+  }
+
+  core.info(`Fetching version data from ${VERSIONS_NDJSON_URL}...`);
+  const response = await fetch(VERSIONS_NDJSON_URL, {});
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch version data: ${response.status} ${response.statusText}`,
+    );
+  }
+
+  const versions: NdjsonVersion[] = [];
+
+  if (!response.body) {
+    throw new Error("Response body is null");
+  }
+
+  // Stream and parse NDJSON line by line
+  const decoder = new TextDecoder();
+  let buffer = "";
+
+  for await (const chunk of response.body) {
+    buffer += decoder.decode(chunk, { stream: true });
+
+    // Process complete lines
+    const lines = buffer.split("\n");
+    // Keep the last potentially incomplete line in buffer
+    buffer = lines.pop() ?? "";
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (trimmed === "") {
+        continue;
+      }
+      try {
+        const version = JSON.parse(trimmed) as NdjsonVersion;
+        versions.push(version);
+      } catch {
+        core.debug(`Failed to parse NDJSON line: ${trimmed}`);
+      }
+    }
+  }
+
+  // Process any remaining content in buffer
+  const remaining = buffer.trim();
+  if (remaining !== "") {
+    try {
+      const version = JSON.parse(remaining) as NdjsonVersion;
+      versions.push(version);
+    } catch {
+      core.debug(`Failed to parse NDJSON line: ${remaining}`);
+    }
+  }
+
+  if (versions.length === 0) {
+    throw new Error("No version data found in NDJSON file");
+  }
+
+  cachedVersionData = versions;
+  return versions;
+}
+
+export async function getLatestVersion(): Promise<string> {
+  const versions = await fetchVersionData();
+  // The NDJSON file lists versions in order, newest first
+  const latestVersion = versions[0]?.version;
+  if (!latestVersion) {
+    throw new Error("No versions found in NDJSON data");
+  }
+  core.debug(`Latest version from NDJSON: ${latestVersion}`);
+  return latestVersion;
+}
+
+export async function getAllVersions(): Promise<string[]> {
+  const versions = await fetchVersionData();
+  return versions.map((v) => v.version);
+}
+
+export interface ArtifactResult {
+  url: string;
+  sha256: string;
+}
+
+export async function getArtifact(
+  version: string,
+  arch: string,
+  platform: string,
+): Promise<ArtifactResult | undefined> {
+  const versions = await fetchVersionData();
+  const versionData = versions.find((v) => v.version === version);
+  if (!versionData) {
+    core.debug(`Version ${version} not found in NDJSON data`);
+    return undefined;
+  }
+
+  // The NDJSON artifact platform format is like "x86_64-apple-darwin"
+  // We need to match against arch-platform
+  const targetPlatform = `${arch}-${platform}`;
+  const artifact = versionData.artifacts.find(
+    (a) => a.platform === targetPlatform,
+  );
+
+  if (!artifact) {
+    core.debug(
+      `Artifact for ${targetPlatform} not found in version ${version}. Available platforms: ${versionData.artifacts.map((a) => a.platform).join(", ")}`,
+    );
+    return undefined;
+  }
+
+  return {
+    sha256: artifact.sha256,
+    url: artifact.url,
+  };
+}
+
+export function clearCache(): void {
+  cachedVersionData = null;
+}

src/setup-uv.ts

@@ -157,12 +157,7 @@ async function determineVersion(
   manifestFile: string | undefined,
 ): Promise<string> {
   if (versionInput !== "") {
-    return await resolveVersion(
-      versionInput,
-      manifestFile,
-      githubToken,
-      resolutionStrategy,
-    );
+    return await resolveVersion(versionInput, manifestFile, resolutionStrategy);
   }
   if (versionFileInput !== "") {
     const versionFromFile = getUvVersionFromFile(versionFileInput);
@@ -174,7 +169,6 @@ async function determineVersion(
     return await resolveVersion(
       versionFromFile,
       manifestFile,
-      githubToken,
       resolutionStrategy,
     );
   }
@@ -192,7 +186,6 @@ async function determineVersion(
   return await resolveVersion(
     versionFromUvToml || versionFromPyproject || "latest",
     manifestFile,
-    githubToken,
     resolutionStrategy,
   );
 }

src/update-known-versions.ts

@@ -1,63 +1,117 @@
 import * as core from "@actions/core";
-import type { Endpoints } from "@octokit/types";
 import * as semver from "semver";
 import { updateChecksums } from "./download/checksum/update-known-checksums";
+import { getLatestKnownVersion } from "./download/version-manifest";
 import {
-  getLatestKnownVersion,
-  updateVersionManifest,
-} from "./download/version-manifest";
-import { OWNER, REPO } from "./utils/constants";
-import { Octokit } from "./utils/octokit";
+  fetchVersionData,
+  getLatestVersion,
+  type NdjsonVersion,
+} from "./download/versions-client";
 
-type Release =
-  Endpoints["GET /repos/{owner}/{repo}/releases"]["response"]["data"][number];
+interface ChecksumEntry {
+  key: string;
+  checksum: string;
+}
+
+interface ArtifactEntry {
+  version: string;
+  artifactName: string;
+  arch: string;
+  platform: string;
+  downloadUrl: string;
+}
+
+function extractChecksumsFromNdjson(
+  versions: NdjsonVersion[],
+): ChecksumEntry[] {
+  const checksums: ChecksumEntry[] = [];
+
+  for (const version of versions) {
+    for (const artifact of version.artifacts) {
+      // The platform field contains the target triple like "x86_64-apple-darwin"
+      const key = `${artifact.platform}-${version.version}`;
+      checksums.push({
+        checksum: artifact.sha256,
+        key,
+      });
+    }
+  }
+
+  return checksums;
+}
+
+function extractArtifactsFromNdjson(
+  versions: NdjsonVersion[],
+): ArtifactEntry[] {
+  const artifacts: ArtifactEntry[] = [];
+
+  for (const version of versions) {
+    for (const artifact of version.artifacts) {
+      // The platform field contains the target triple like "x86_64-apple-darwin"
+      // Split into arch and platform (e.g., "x86_64-apple-darwin" -> ["x86_64", "apple-darwin"])
+      const parts = artifact.platform.split("-");
+      const arch = parts[0];
+      const platform = parts.slice(1).join("-");
+
+      // Construct artifact name from platform and archive format
+      const artifactName = `uv-${artifact.platform}.${artifact.archive_format}`;
+
+      artifacts.push({
+        arch,
+        artifactName,
+        downloadUrl: artifact.url,
+        platform,
+        version: version.version,
+      });
+    }
+  }
+
+  return artifacts;
+}
 
 async function run(): Promise<void> {
   const checksumFilePath = process.argv.slice(2)[0];
   const versionsManifestFile = process.argv.slice(2)[1];
-  const githubToken = process.argv.slice(2)[2];
-
-  const octokit = new Octokit({
-    auth: githubToken,
-  });
-
-  const { data: latestRelease } = await octokit.rest.repos.getLatestRelease({
-    owner: OWNER,
-    repo: REPO,
-  });
 
+  const latestVersion = await getLatestVersion();
   const latestKnownVersion = await getLatestKnownVersion(undefined);
 
-  if (semver.lte(latestRelease.tag_name, latestKnownVersion)) {
+  if (semver.lte(latestVersion, latestKnownVersion)) {
     core.info(
-      `Latest release (${latestRelease.tag_name}) is not newer than the latest known version (${latestKnownVersion}). Skipping update.`,
+      `Latest release (${latestVersion}) is not newer than the latest known version (${latestKnownVersion}). Skipping update.`,
     );
     return;
   }
 
-  const releases: Release[] = await octokit.paginate(
-    octokit.rest.repos.listReleases,
-    {
-      owner: OWNER,
-      repo: REPO,
-    },
-  );
-  const checksumDownloadUrls: string[] = releases.flatMap((release) =>
-    release.assets
-      .filter((asset) => asset.name.endsWith(".sha256"))
-      .map((asset) => asset.browser_download_url),
-  );
-  await updateChecksums(checksumFilePath, checksumDownloadUrls);
+  const versions = await fetchVersionData();
 
-  const artifactDownloadUrls: string[] = releases.flatMap((release) =>
-    release.assets
-      .filter((asset) => !asset.name.endsWith(".sha256"))
-      .map((asset) => asset.browser_download_url),
-  );
+  // Extract checksums from NDJSON
+  const checksumEntries = extractChecksumsFromNdjson(versions);
+  await updateChecksums(checksumFilePath, checksumEntries);
 
-  await updateVersionManifest(versionsManifestFile, artifactDownloadUrls);
+  // Extract artifact URLs for version manifest
+  const artifactEntries = extractArtifactsFromNdjson(versions);
+  await updateVersionManifestFromEntries(versionsManifestFile, artifactEntries);
 
-  core.setOutput("latest-version", latestRelease.tag_name);
+  core.setOutput("latest-version", latestVersion);
+}
+
+async function updateVersionManifestFromEntries(
+  filePath: string,
+  entries: ArtifactEntry[],
+): Promise<void> {
+  const { promises: fs } = await import("node:fs");
+
+  const manifest = entries.map((entry) => ({
+    arch: entry.arch,
+    artifactName: entry.artifactName,
+    downloadUrl: entry.downloadUrl,
+    platform: entry.platform,
+    version: entry.version,
+  }));
+
+  core.debug(`Updating manifest-file: ${JSON.stringify(manifest)}`);
+  await fs.writeFile(filePath, JSON.stringify(manifest));
 }
 
 run();

src/utils/constants.ts

@@ -3,3 +3,5 @@ export const OWNER = "astral-sh";
 export const TOOL_CACHE_NAME = "uv";
 export const STATE_UV_PATH = "uv-path";
 export const STATE_UV_VERSION = "uv-version";
+export const VERSIONS_NDJSON_URL =
+  "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";

src/utils/octokit.ts

@@ -1,34 +0,0 @@
-import type { OctokitOptions } from "@octokit/core";
-import { Octokit as Core } from "@octokit/core";
-import {
-  type PaginateInterface,
-  paginateRest,
-} from "@octokit/plugin-paginate-rest";
-import { legacyRestEndpointMethods } from "@octokit/plugin-rest-endpoint-methods";
-import { fetch as customFetch } from "./fetch";
-
-export type { RestEndpointMethodTypes } from "@octokit/plugin-rest-endpoint-methods";
-
-const DEFAULTS = {
-  baseUrl: "https://api.github.com",
-  userAgent: "setup-uv",
-};
-
-const OctokitWithPlugins = Core.plugin(paginateRest, legacyRestEndpointMethods);
-
-export const Octokit = OctokitWithPlugins.defaults(function buildDefaults(
-  options: OctokitOptions,
-): OctokitOptions {
-  return {
-    ...DEFAULTS,
-    ...options,
-    request: {
-      fetch: customFetch,
-      ...options.request,
-    },
-  };
-});
-
-export type Octokit = InstanceType<typeof OctokitWithPlugins> & {
-  paginate: PaginateInterface;
-};