Use Astral mirror for version manifests with GitHub fallback (#1119)

Amp-Thread-ID:
https://ampcode.com/threads/T-01a1822a-68da-7125-9e7d-16e038ab0840

Closes: #1118

Co-authored-by: Amp <amp@ampcode.com>

__tests__/download/download-version.test.ts

@@ -242,7 +242,7 @@ describe("download-version", () => {
           "token",
         ),
       ).rejects.toThrow(
-        "Could not find artifact for version 0.9.26, arch x86_64, platform unknown-linux-gnu in https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson .",
+        "Could not find artifact for version 0.9.26, arch x86_64, platform unknown-linux-gnu in https://releases.astral.sh/github/versions/main/v1/uv.ndjson .",
       );
 
       expect(mockDownloadTool).not.toHaveBeenCalled();

__tests__/download/manifest.test.ts

@@ -96,6 +96,78 @@ describe("manifest", () => {
       expect(versions).toHaveLength(2);
       expect(versions[0]?.version).toBe("0.9.26");
       expect(versions[1]?.version).toBe("0.9.25");
+      expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
+        "https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
+      ]);
+    });
+
+    it("falls back to GitHub after mirror network retries are exhausted", async () => {
+      jest.useFakeTimers();
+      mockFetch
+        .mockRejectedValueOnce(new Error("mirror unavailable"))
+        .mockRejectedValueOnce(new Error("mirror unavailable"))
+        .mockRejectedValueOnce(new Error("mirror unavailable"))
+        .mockResolvedValueOnce(
+          createMockResponse(true, 200, "OK", sampleManifestResponse),
+        );
+
+      const result = fetchManifest();
+      await jest.runAllTimersAsync();
+
+      await expect(result).resolves.toEqual([
+        expect.objectContaining({ version: "0.9.26" }),
+        expect.objectContaining({ version: "0.9.25" }),
+      ]);
+      expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
+        "https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
+        "https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
+        "https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
+        "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson",
+      ]);
+
+      await expect(getLatestVersion()).resolves.toBe("0.9.26");
+      expect(mockFetch).toHaveBeenCalledTimes(4);
+    });
+
+    it.each([404, 429, 503])(
+      "falls back to a streaming GitHub manifest on mirror HTTP %s",
+      async (status) => {
+        mockFetch
+          .mockResolvedValueOnce(createMockResponse(false, status, "Error", ""))
+          .mockResolvedValueOnce(
+            createStreamingMockResponse([`${sampleManifestResponse}\n`]),
+          );
+
+        await expect(getLatestVersion()).resolves.toBe("0.9.26");
+        await expect(
+          getArtifact("0.9.26", "aarch64", "apple-darwin"),
+        ).resolves.toEqual({
+          archiveFormat: "tar.gz",
+          checksum:
+            "fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f",
+          downloadUrl:
+            "https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz",
+        });
+        expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
+          "https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
+          "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson",
+        ]);
+      },
+    );
+
+    it("does not fall back from a custom manifest", async () => {
+      mockFetch.mockResolvedValue(
+        createMockResponse(false, 503, "Service Unavailable", ""),
+      );
+
+      await expect(
+        fetchManifest("https://example.com/custom.ndjson"),
+      ).rejects.toThrow(
+        "Failed to fetch manifest data: 503 Service Unavailable",
+      );
+      expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
+        "https://example.com/custom.ndjson",
+      ]);
     });
 
     it("retries network failures", async () => {
@@ -123,7 +195,7 @@ describe("manifest", () => {
       await jest.runAllTimersAsync();
 
       await result;
-      expect(mockFetch).toHaveBeenCalledTimes(MANIFEST_FETCH_ATTEMPTS);
+      expect(mockFetch).toHaveBeenCalledTimes(MANIFEST_FETCH_ATTEMPTS * 2);
     });
 
     it("throws on a failed fetch", async () => {

dist/setup/index.cjs

@@ -94499,7 +94499,8 @@ function _getGlobal(key, defaultValue) {
 var TOOL_CACHE_NAME = "uv";
 var STATE_UV_PATH = "uv-path";
 var STATE_UV_VERSION = "uv-version";
-var VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
+var VERSIONS_MANIFEST_URL = "https://releases.astral.sh/github/versions/main/v1/uv.ndjson";
+var GITHUB_VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
 var GITHUB_RELEASES_PREFIX = "https://github.com/astral-sh/uv/releases/download/";
 var ASTRAL_MIRROR_PREFIX = "https://releases.astral.sh/github/uv/releases/download/";
 
@@ -94509,6 +94510,24 @@ var fs10 = __toESM(require("node:fs"), 1);
 
 // src/download/checksum/known-checksums.json
 var known_checksums_default = {
+  "aarch64-apple-darwin-0.13.6": "60fbd5c8a1ed681845eea28d9d622fcde03c51e91a43465b64a1e17db1ed3472",
+  "aarch64-pc-windows-msvc-0.13.6": "c2426c0c8e28b53d8c440e47a18d96ad4db51e159866c0e81435b196d7f0081c",
+  "aarch64-unknown-linux-gnu-0.13.6": "229e194255c7958d86d56e8790d969a6f74736592133f0dfd0076f754c642c1d",
+  "aarch64-unknown-linux-musl-0.13.6": "819692e404d23e5aae6bc44c0e260f1f5492fd1910ab4693b2c650f926dbe800",
+  "arm-unknown-linux-musleabihf-0.13.6": "57ac0f7c04deb42c5d686b4eeeef555c442db6ffea16fe4cbd7adb0384403794",
+  "armv7-unknown-linux-gnueabihf-0.13.6": "d00cd4949c4524c934afcfee1aedfa9d337cf4e43be4d6b692ad8d74d0a65562",
+  "armv7-unknown-linux-musleabihf-0.13.6": "b215398c886e8cc2cfa282fe346c02025957f8633b75a3d4fd848e0adda4eddd",
+  "i686-pc-windows-msvc-0.13.6": "32ceb64db231cbedfd499f7654c72e4c0b564f2846f9e76c0a4a7b2d03d7e67c",
+  "i686-unknown-linux-gnu-0.13.6": "665ea831c38d342900950e606beb2ccc37b7ba0fcefc37b814eb4b076305f2b6",
+  "i686-unknown-linux-musl-0.13.6": "de3a015c4b0fce63c178ae4fa95c94c873adfd92fa1e258c6a2a94e529812629",
+  "powerpc64le-unknown-linux-gnu-0.13.6": "3b2847185ec2946fcc928500efef7e3e74c255d3be6f2cb435081a84885d8c6c",
+  "riscv64gc-unknown-linux-gnu-0.13.6": "517052603ed46483b59d8875c9c61a577946b8f493c73e4339e45e7b119171d0",
+  "riscv64gc-unknown-linux-musl-0.13.6": "659a95dc6aee3ecf86742a08d8ca6c6261422121cbd41decc0042f5a71af6305",
+  "s390x-unknown-linux-gnu-0.13.6": "fb56d731308aa5c7718059d71afcb14d9a933a974997cee3d4eb5d06fc462a4b",
+  "x86_64-apple-darwin-0.13.6": "63ba17fdda55ad1a230d4b37fc6017ffa10c23688c83818bd3bfdf914c652a02",
+  "x86_64-pc-windows-msvc-0.13.6": "a2a8820d5eea32f08ef467ef3b7f66883a9b076d5737a2fc2fbb5f458d1bb50f",
+  "x86_64-unknown-linux-gnu-0.13.6": "f29c3e94ffabd7e6f3ba521dba169a9b7ec12100bf3257087f0f24f6123f3645",
+  "x86_64-unknown-linux-musl-0.13.6": "5d61f26b6c7213779eda90edc6971ea6b0b796bfb8d49a574c8ad69b59838548",
   "aarch64-apple-darwin-0.13.5": "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73",
   "aarch64-pc-windows-msvc-0.13.5": "09f47edf90726084a70f9426f6e3ca4f46e9bf7cbf23b1716ec64d60b055fae3",
   "aarch64-unknown-linux-gnu-0.13.5": "4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403",
@@ -100287,6 +100306,19 @@ async function getArtifact(version3, arch3, platform2, manifestUrl = VERSIONS_MA
   };
 }
 async function fetchManifestResponse(manifestUrl) {
+  try {
+    return await fetchManifestResponseFromUrl(manifestUrl);
+  } catch (error2) {
+    if (manifestUrl !== VERSIONS_MANIFEST_URL) {
+      throw error2;
+    }
+    info2(
+      `Failed to fetch manifest from Astral mirror, falling back to GitHub: ${error2.message}`
+    );
+    return await fetchManifestResponseFromUrl(GITHUB_VERSIONS_MANIFEST_URL);
+  }
+}
+async function fetchManifestResponseFromUrl(manifestUrl) {
   let response;
   for (let attempt = 1; attempt <= MANIFEST_FETCH_ATTEMPTS; attempt++) {
     info2(`Fetching manifest data from ${manifestUrl} ...`);

dist/update-known-checksums/index.cjs

@@ -47182,6 +47182,24 @@ var semver = __toESM(require_semver(), 1);
 
 // src/download/checksum/known-checksums.json
 var known_checksums_default = {
+  "aarch64-apple-darwin-0.13.6": "60fbd5c8a1ed681845eea28d9d622fcde03c51e91a43465b64a1e17db1ed3472",
+  "aarch64-pc-windows-msvc-0.13.6": "c2426c0c8e28b53d8c440e47a18d96ad4db51e159866c0e81435b196d7f0081c",
+  "aarch64-unknown-linux-gnu-0.13.6": "229e194255c7958d86d56e8790d969a6f74736592133f0dfd0076f754c642c1d",
+  "aarch64-unknown-linux-musl-0.13.6": "819692e404d23e5aae6bc44c0e260f1f5492fd1910ab4693b2c650f926dbe800",
+  "arm-unknown-linux-musleabihf-0.13.6": "57ac0f7c04deb42c5d686b4eeeef555c442db6ffea16fe4cbd7adb0384403794",
+  "armv7-unknown-linux-gnueabihf-0.13.6": "d00cd4949c4524c934afcfee1aedfa9d337cf4e43be4d6b692ad8d74d0a65562",
+  "armv7-unknown-linux-musleabihf-0.13.6": "b215398c886e8cc2cfa282fe346c02025957f8633b75a3d4fd848e0adda4eddd",
+  "i686-pc-windows-msvc-0.13.6": "32ceb64db231cbedfd499f7654c72e4c0b564f2846f9e76c0a4a7b2d03d7e67c",
+  "i686-unknown-linux-gnu-0.13.6": "665ea831c38d342900950e606beb2ccc37b7ba0fcefc37b814eb4b076305f2b6",
+  "i686-unknown-linux-musl-0.13.6": "de3a015c4b0fce63c178ae4fa95c94c873adfd92fa1e258c6a2a94e529812629",
+  "powerpc64le-unknown-linux-gnu-0.13.6": "3b2847185ec2946fcc928500efef7e3e74c255d3be6f2cb435081a84885d8c6c",
+  "riscv64gc-unknown-linux-gnu-0.13.6": "517052603ed46483b59d8875c9c61a577946b8f493c73e4339e45e7b119171d0",
+  "riscv64gc-unknown-linux-musl-0.13.6": "659a95dc6aee3ecf86742a08d8ca6c6261422121cbd41decc0042f5a71af6305",
+  "s390x-unknown-linux-gnu-0.13.6": "fb56d731308aa5c7718059d71afcb14d9a933a974997cee3d4eb5d06fc462a4b",
+  "x86_64-apple-darwin-0.13.6": "63ba17fdda55ad1a230d4b37fc6017ffa10c23688c83818bd3bfdf914c652a02",
+  "x86_64-pc-windows-msvc-0.13.6": "a2a8820d5eea32f08ef467ef3b7f66883a9b076d5737a2fc2fbb5f458d1bb50f",
+  "x86_64-unknown-linux-gnu-0.13.6": "f29c3e94ffabd7e6f3ba521dba169a9b7ec12100bf3257087f0f24f6123f3645",
+  "x86_64-unknown-linux-musl-0.13.6": "5d61f26b6c7213779eda90edc6971ea6b0b796bfb8d49a574c8ad69b59838548",
   "aarch64-apple-darwin-0.13.5": "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73",
   "aarch64-pc-windows-msvc-0.13.5": "09f47edf90726084a70f9426f6e3ca4f46e9bf7cbf23b1716ec64d60b055fae3",
   "aarch64-unknown-linux-gnu-0.13.5": "4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403",
@@ -52836,7 +52854,8 @@ var import_node_readline = require("node:readline");
 var import_node_stream = require("node:stream");
 
 // src/utils/constants.ts
-var VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
+var VERSIONS_MANIFEST_URL = "https://releases.astral.sh/github/versions/main/v1/uv.ndjson";
+var GITHUB_VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
 
 // src/utils/fetch.ts
 var import_undici2 = __toESM(require_undici2(), 1);
@@ -52908,6 +52927,19 @@ async function getLatestVersion(manifestUrl = VERSIONS_MANIFEST_URL) {
   return latestVersion;
 }
 async function fetchManifestResponse(manifestUrl) {
+  try {
+    return await fetchManifestResponseFromUrl(manifestUrl);
+  } catch (error2) {
+    if (manifestUrl !== VERSIONS_MANIFEST_URL) {
+      throw error2;
+    }
+    info2(
+      `Failed to fetch manifest from Astral mirror, falling back to GitHub: ${error2.message}`
+    );
+    return await fetchManifestResponseFromUrl(GITHUB_VERSIONS_MANIFEST_URL);
+  }
+}
+async function fetchManifestResponseFromUrl(manifestUrl) {
   let response;
   for (let attempt = 1; attempt <= MANIFEST_FETCH_ATTEMPTS; attempt++) {
     info2(`Fetching manifest data from ${manifestUrl} ...`);

docs/customization.md

@@ -20,10 +20,12 @@ You can specify a checksum to override those values. The sha256 hashes can also
 ## Manifest file
 
 By default, setup-uv reads version metadata from
-[`astral-sh/versions`](https://github.com/astral-sh/versions).
+the [Astral mirror](https://releases.astral.sh/github/versions/main/v1/uv.ndjson).
+If the mirror request fails, it falls back to [`astral-sh/versions`](https://github.com/astral-sh/versions).
 
 The `manifest-file` input lets you override that source with your own URL, for example to test
-custom uv builds or alternate download locations.
+custom uv builds or alternate download locations. Custom manifest URLs do not fall back to the
+default sources.
 
 ### Format
 

docs/environment-and-tools.md

@@ -50,12 +50,13 @@ You can customize the venv location with `venv-path`, for example to place it in
 
 ## GitHub authentication token
 
-By default, this action resolves available uv versions from
+By default, this action fetches version metadata and uv archives from the Astral mirror.
-[`astral-sh/versions`](https://github.com/astral-sh/versions), then downloads uv artifacts from
+If a manifest request fails, it falls back to `raw.githubusercontent.com`. If an archive download
-GitHub Releases.
+fails, it falls back to GitHub Releases.
 
-You can provide a token via `github-token` to authenticate those downloads. By default, the
+You can provide a token via `github-token` to authenticate GitHub Releases downloads. The token
-`GITHUB_TOKEN` secret is used, which is automatically provided by GitHub Actions.
+is not sent to the Astral mirror or used for manifest requests. By default, the `GITHUB_TOKEN`
+secret is used, which is automatically provided by GitHub Actions.
 
 If the default
 [permissions for the GitHub token](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)

src/download/checksum/known-checksums.json

@@ -1,4 +1,22 @@
 {
+  "aarch64-apple-darwin-0.13.6": "60fbd5c8a1ed681845eea28d9d622fcde03c51e91a43465b64a1e17db1ed3472",
+  "aarch64-pc-windows-msvc-0.13.6": "c2426c0c8e28b53d8c440e47a18d96ad4db51e159866c0e81435b196d7f0081c",
+  "aarch64-unknown-linux-gnu-0.13.6": "229e194255c7958d86d56e8790d969a6f74736592133f0dfd0076f754c642c1d",
+  "aarch64-unknown-linux-musl-0.13.6": "819692e404d23e5aae6bc44c0e260f1f5492fd1910ab4693b2c650f926dbe800",
+  "arm-unknown-linux-musleabihf-0.13.6": "57ac0f7c04deb42c5d686b4eeeef555c442db6ffea16fe4cbd7adb0384403794",
+  "armv7-unknown-linux-gnueabihf-0.13.6": "d00cd4949c4524c934afcfee1aedfa9d337cf4e43be4d6b692ad8d74d0a65562",
+  "armv7-unknown-linux-musleabihf-0.13.6": "b215398c886e8cc2cfa282fe346c02025957f8633b75a3d4fd848e0adda4eddd",
+  "i686-pc-windows-msvc-0.13.6": "32ceb64db231cbedfd499f7654c72e4c0b564f2846f9e76c0a4a7b2d03d7e67c",
+  "i686-unknown-linux-gnu-0.13.6": "665ea831c38d342900950e606beb2ccc37b7ba0fcefc37b814eb4b076305f2b6",
+  "i686-unknown-linux-musl-0.13.6": "de3a015c4b0fce63c178ae4fa95c94c873adfd92fa1e258c6a2a94e529812629",
+  "powerpc64le-unknown-linux-gnu-0.13.6": "3b2847185ec2946fcc928500efef7e3e74c255d3be6f2cb435081a84885d8c6c",
+  "riscv64gc-unknown-linux-gnu-0.13.6": "517052603ed46483b59d8875c9c61a577946b8f493c73e4339e45e7b119171d0",
+  "riscv64gc-unknown-linux-musl-0.13.6": "659a95dc6aee3ecf86742a08d8ca6c6261422121cbd41decc0042f5a71af6305",
+  "s390x-unknown-linux-gnu-0.13.6": "fb56d731308aa5c7718059d71afcb14d9a933a974997cee3d4eb5d06fc462a4b",
+  "x86_64-apple-darwin-0.13.6": "63ba17fdda55ad1a230d4b37fc6017ffa10c23688c83818bd3bfdf914c652a02",
+  "x86_64-pc-windows-msvc-0.13.6": "a2a8820d5eea32f08ef467ef3b7f66883a9b076d5737a2fc2fbb5f458d1bb50f",
+  "x86_64-unknown-linux-gnu-0.13.6": "f29c3e94ffabd7e6f3ba521dba169a9b7ec12100bf3257087f0f24f6123f3645",
+  "x86_64-unknown-linux-musl-0.13.6": "5d61f26b6c7213779eda90edc6971ea6b0b796bfb8d49a574c8ad69b59838548",
   "aarch64-apple-darwin-0.13.5": "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73",
   "aarch64-pc-windows-msvc-0.13.5": "09f47edf90726084a70f9426f6e3ca4f46e9bf7cbf23b1716ec64d60b055fae3",
   "aarch64-unknown-linux-gnu-0.13.5": "4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403",

src/download/manifest.ts

@@ -1,7 +1,10 @@
 import { createInterface } from "node:readline";
 import { Readable } from "node:stream";
 import * as core from "@actions/core";
-import { VERSIONS_MANIFEST_URL } from "../utils/constants";
+import {
+  GITHUB_VERSIONS_MANIFEST_URL,
+  VERSIONS_MANIFEST_URL,
+} from "../utils/constants";
 import { fetch } from "../utils/fetch";
 import * as log from "../utils/logging";
 import { selectDefaultVariant } from "./variant-selection";
@@ -167,6 +170,20 @@ export function clearManifestCache(manifestUrl?: string): void {
 }
 
 async function fetchManifestResponse(manifestUrl: string) {
+  try {
+    return await fetchManifestResponseFromUrl(manifestUrl);
+  } catch (error) {
+    if (manifestUrl !== VERSIONS_MANIFEST_URL) {
+      throw error;
+    }
+    log.info(
+      `Failed to fetch manifest from Astral mirror, falling back to GitHub: ${(error as Error).message}`,
+    );
+    return await fetchManifestResponseFromUrl(GITHUB_VERSIONS_MANIFEST_URL);
+  }
+}
+
+async function fetchManifestResponseFromUrl(manifestUrl: string) {
   let response: Awaited<ReturnType<typeof fetch>> | undefined;
   for (let attempt = 1; attempt <= MANIFEST_FETCH_ATTEMPTS; attempt++) {
     log.info(`Fetching manifest data from ${manifestUrl} ...`);

src/utils/constants.ts

@@ -2,6 +2,8 @@ export const TOOL_CACHE_NAME = "uv";
 export const STATE_UV_PATH = "uv-path";
 export const STATE_UV_VERSION = "uv-version";
 export const VERSIONS_MANIFEST_URL =
+  "https://releases.astral.sh/github/versions/main/v1/uv.ndjson";
+export const GITHUB_VERSIONS_MANIFEST_URL =
   "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
 
 /** GitHub Releases URL prefix for uv artifacts. */