* feat: Add `mirror` and `mirror-token` inputs for custom Python distribution sources
Users who need custom CPython builds (internal mirrors, GHES-hosted forks,
special build configurations, compliance builds, air-gapped runners) could not
previously point setup-python at anything other than actions/python-versions.
Adds two new inputs:
- `mirror`: base URL hosting versions-manifest.json and the Python
distributions it references. Defaults to the existing
https://raw.githubusercontent.com/actions/python-versions/main.
- `mirror-token`: optional token used to authenticate requests to the mirror.
If `mirror` is a raw.githubusercontent.com/{owner}/{repo}/{branch} URL, the
manifest is fetched via the GitHub REST API (authenticated rate limit applies);
otherwise the action falls back to a direct GET of {mirror}/versions-manifest.json.
Token interaction
-----------------
`token` is never forwarded to arbitrary hosts. Auth resolution is per-URL:
1. if mirror-token is set, use mirror-token
2. else if token is set AND the target host is github.com,
*.github.com, or *.githubusercontent.com, use token
3. else send no auth
Cases:
Default (no inputs set)
mirror = default raw.githubusercontent.com URL, mirror-token empty,
token = github.token.
→ manifest API call and tarball downloads use `token`.
Identical to prior behavior.
Custom raw.githubusercontent.com mirror (e.g. personal fork)
mirror-token empty, token = github.token.
→ manifest API call and tarball downloads use `token`
(target hosts are GitHub-owned).
Custom non-GitHub mirror, no mirror-token
mirror-token empty, token = github.token.
→ manifest fetched via direct URL (no auth attached),
tarball downloads use no auth.
`token` is NOT forwarded to the custom host — this is the
leak-prevention case.
Custom non-GitHub mirror with mirror-token
mirror-token set, token may be set.
→ manifest fetch and tarball downloads use `mirror-token`.
Custom GitHub mirror with both tokens set
mirror-token wins. Used for both the manifest API call and
tarball downloads.
* fix: address mirror review feedback
- scope mirror-token to the mirror host and send it verbatim
- route non-repo mirrors straight to the URL fetch instead of throwing
- authenticate the manifest fetch
- warn on slash branches, and on mirror with PyPy/GraalPy
- memoize mirror validation
- exercise the direct-URL path in the E2E job
Addresses https://github.com/actions/setup-python/pull/1302#issuecomment-5202618946
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: correct mirror warnings, auth scoping, and integration coverage
- only warn about PyPy/GraalPy mirror when a custom mirror is set; the
action.yml default made the warning fire on every run
- accept the refs/heads/{branch} raw URL form so it routes via the REST
API instead of tripping the slash-branch warning
- scope mirror-token to the full mirror origin (scheme+host+port) so it
can't leak to a same-host http download_url
- make an invalid mirror fatal on the auth path, matching getManifestUrl
- fix warning/docs that wrongly claimed the raw fallback is anonymous
- force a manifest fetch in the mirror integration job (check-latest) so
it actually contacts the mirror instead of using the preinstalled cache
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Enhance reading from .python-version
* Fix typos
* Fix lint
* Add built files
* Don't use EOL versions in `utils.test.ts`
* Fix Prettier
* Don't use unreleased versions in `utils.test.ts`
* Update versions in `utils.test.ts` again
* Support free threaded Python versions like '3.13t'
Python wheels, pyenv, and a number of other tools use 't' in the Python
version number to identify free threaded builds. For example, '3.13t',
'3.14.0a1', '3.14t-dev'.
This PR supports that syntax in `actions/setup-python`, strips the "t",
and adds "-freethreading" to the architecture to select the correct
Python version.
See #771
* Add free threading to advanced usage documentation
* Fix desugaring of `3.13.1t` and add test case.
* Add freethreaded input and fix handling of prerelease versions
* Fix lint
* Add 't' suffix to python-version output
* Use distinct cache key for free threaded Python
* Remove support for syntax like '3.14.0a1'
* Clarify use of 't' suffix
* Improve error message when trying to use free threaded Python versions before 3.13
* Add support for graalpy
* add graalpy test workflow
* format, lint and build
* symlink graalpy binaries names
* fix macos names for graalpy
* Don't attempt to update pip for graalpy
* Remove test schedule
* Extract common getBinaryDirectory function for PyPy and GraalPy
* Clean up and format
* Pass GitHub token to GraalPy queries
* Utilize pagination when querying GraalPy GitHub releases
* Build
* Fix lint errors
* Deal with possible multiple artifacts for a single releases
* Skip few GraalPy tests on windows - we don't have a windows release yet
* Fix GraalPy test on Mac OS
* Build
* Skip one more GraalPy test on windows
---------
Co-authored-by: Michael Simacek <michael.simacek@oracle.com>
This allows to specify version like `3.11` or `pypy3.10` in workflows before those versions are released.
This lessen the burden for users of `setup-python` by not having to modify their workflow twice: once when a pre-release is available (e.g. `3.11-dev`) and once when the first stable release is published (e.g. `3.11`)
Shared libraries for the Mac python builds are not configured with the
relocatable flag, thus must always be configured with the hosted path.
Relates #459
This option allows to specify if the action shall update environment variables (default) or not.
This allows to use the setup-python action in a composite action without side effect (except downloading/installing python if version is missing).
* add support for python-version-file
* Update action.yml
* update to v4, remove python-version default
* python-version overrides python-version-file, like setup-node
* checks '.python-version' by default if nothing else specified
* update tests, update to checkout@v3
* update build
* appease the linter
* remove old test for default python version
* revert readme changes
* update build
This versioning scheme is consistent with other
tools in the python ecosystem so it feels more natural
and allows better interaction with other tools.
fixes#346
Ludovic HenryandClaude Opus 4.8
gowridurgadandgowridurgad
Priya Gupta
aparnajyothi-yandHaritha
Kryštof Korb
Sam Gross
Jeff Widman
Tim FelgentreffandMichael Simacek
Dario Curreri
Dmitry Shibanov
Ivan
Matthieu Darbois
Leon Wright
Dmitry Shibanov
IvanZosimov
Marko Zivic
Sergey Dolin
Kurt von Laven
Andrew DiLosa
Shubham TiwariandBrian Cristante