Bump typescript from 6.0.3 to 7.0.2

Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/compare/v6.0.3...v7.0.2) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-22 18:50:30 +08:00 · 2026-08-25 05:59:26 +00:00
41 changed files with 11104 additions and 12030 deletions
@@ -61,32 +61,6 @@ jobs:
      - name: Run simple code
        run: python -c 'import math; print(math.factorial(5))'

-  setup-versions-via-mirror-input:
-    name: 'Setup via explicit mirror input: ${{ matrix.os }}'
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      # The refs/heads/ form serves the same manifest as the default mirror and
-      # exercises the refs/heads/{branch} -> {branch} parsing on the API path.
-      # check-latest forces a manifest fetch even though 3.12 is preinstalled,
-      # so the job actually contacts the mirror instead of short-circuiting on
-      # the tool cache.
-      - name: setup-python with explicit mirror
-        uses: ./
-        with:
-          python-version: 3.12
-          check-latest: true
-          mirror: https://raw.githubusercontent.com/actions/python-versions/refs/heads/main
-
-      - name: Run simple code
-        run: python -c 'import sys; print(sys.version)'
-
  setup-versions-from-file:
    name: Setup ${{ matrix.python }} ${{ matrix.os }} version file
    runs-on: ${{ matrix.os }}
@@ -10,7 +10,7 @@ allowed:
  - cc0-1.0
  - unlicense
  - 0bsd
-  - BlueOak-1.0.0
+  - blueoak-1.0.0

 reviewed:
  npm:
@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 6.3.0
+version: 6.2.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache
@@ -0,0 +1,20 @@
+---
+name: "@actions/glob"
+version: 0.6.1
+type: npm
+summary: Actions glob lib
+homepage: https://github.com/actions/toolkit/tree/main/packages/glob
+license: mit
+licenses:
+- sources: LICENSE.md
+  text: |-
+    The MIT License (MIT)
+
+    Copyright 2019 GitHub
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+notices: []
@@ -1,6 +1,6 @@
 ---
 name: "@azure/abort-controller"
-version: 2.2.0
+version: 2.1.2
 type: npm
 summary: Microsoft Azure SDK for JavaScript - Aborter
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/abort-controller/README.md
@@ -8,9 +8,9 @@ license: mit
 licenses:
 - sources: LICENSE
  text: |
-    Copyright (c) Microsoft Corporation.
+    The MIT License (MIT)

-    MIT License
+    Copyright (c) 2020 Microsoft

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
@@ -22,7 +22,7 @@ licenses:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.

-    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
@@ -1,10 +1,10 @@
 ---
 name: "@azure/core-auth"
-version: 1.11.0
+version: 1.10.1
 type: npm
 summary: Provides low-level interfaces and helper methods for authentication in Azure
  SDK
-homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-auth/README.md
+homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-auth/README.md
 license: mit
 licenses:
 - sources: LICENSE
@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-client"
-version: 1.11.1
+version: 1.10.2
 type: npm
 summary: Core library for interfacing with AutoRest generated code
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-client/
@@ -1,9 +1,9 @@
 ---
 name: "@azure/core-http-compat"
-version: 2.5.0
+version: 2.4.0
 type: npm
 summary: Core HTTP Compatibility Library to bridge the gap between Core V1 & V2 packages.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-http-compat/
+homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-compat/
 license: mit
 licenses:
 - sources: LICENSE
@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-paging"
-version: 1.7.0
+version: 1.6.2
 type: npm
 summary: Core types for paging async iterable iterators
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-paging/README.md
@@ -8,9 +8,9 @@ license: mit
 licenses:
 - sources: LICENSE
  text: |
-    Copyright (c) Microsoft Corporation.
+    The MIT License (MIT)

-    MIT License
+    Copyright (c) 2020 Microsoft

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
@@ -22,7 +22,7 @@ licenses:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.

-    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
@@ -1,32 +0,0 @@
---
-name: "@azure/core-rest-pipeline"
-version: 1.23.0
-type: npm
-summary: Isomorphic client library for making HTTP requests in node.js and browser.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-rest-pipeline/
-license: mit
-licenses:
- sources: LICENSE
-  text: |
-    Copyright (c) Microsoft Corporation.
-
-    MIT License
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-notices: []
@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-rest-pipeline"
-version: 1.25.0
+version: 1.24.0
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-rest-pipeline/README.md
@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-tracing"
-version: 1.4.0
+version: 1.3.1
 type: npm
 summary: Provides low-level interfaces and helper methods for tracing in Azure SDK
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-tracing/README.md
@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-util"
-version: 1.14.0
+version: 1.13.1
 type: npm
 summary: Core library for shared utility methods
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-util/
@@ -1,9 +1,9 @@
 ---
 name: "@azure/core-xml"
-version: 1.6.0
+version: 1.5.1
 type: npm
 summary: Core library for interacting with XML payloads
-homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-xml/README.md
+homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-xml/
 license: mit
 licenses:
 - sources: LICENSE
@@ -1,6 +1,6 @@
 ---
 name: "@azure/logger"
-version: 1.4.0
+version: 1.3.0
 type: npm
 summary: Microsoft Azure SDK for JavaScript - Logger
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/logger/README.md
@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-blob"
-version: 12.31.0
+version: 12.32.0
 type: npm
 summary: Microsoft Azure Storage SDK for JavaScript - Blob
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob/README.md
 license: mit
 licenses:
 - sources: LICENSE
@@ -1,6 +1,6 @@
 ---
 name: "@azure/storage-common"
-version: 12.5.0
+version: 12.4.0
 type: npm
 summary: Azure Storage Common Client Library for JavaScript
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-common/README.md
@@ -1,6 +1,6 @@
 ---
 name: "@nodable/entities"
-version: 3.1.0
+version: 3.0.0
 type: npm
 summary: Entity parser for XML, HTML, External entites with security and NCR control
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.9
+version: 0.3.6
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
 homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/ts-http-runtime/README.md
@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 5.0.12
+version: 5.0.9
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage:
@@ -1,9 +1,9 @@
 ---
 name: fast-xml-builder
-version: 1.3.1
+version: 1.2.0
 type: npm
 summary: Build XML from JSON without C/C++ based libraries
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE
@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.11.2
+version: 5.10.1
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:
@@ -1,6 +1,6 @@
 ---
 name: is-unsafe
-version: 2.0.2
+version: 2.0.0
 type: npm
 summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
  HTML, XML, SVG, SQL, SHELL, and REGEX contexts
@@ -4,7 +4,7 @@ version: 10.2.5
 type: npm
 summary: a glob matcher in javascript
 homepage:
-license: BlueOak-1.0.0
+license: blueoak-1.0.0
 licenses:
 - sources: LICENSE.md
  text: |
@@ -0,0 +1,26 @@
+---
+name: minimatch
+version: 3.1.5
+type: npm
+summary: a glob matcher in javascript
+homepage:
+license: isc
+licenses:
+- sources: LICENSE
+  text: |
+    The ISC License
+
+    Copyright (c) Isaac Z. Schlueter and Contributors
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose with or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+notices: []
@@ -1,9 +1,9 @@
 ---
 name: strnum
-version: 2.5.1
+version: 2.4.1
 type: npm
 summary: Parse String to Number based on configuration
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE
@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.29.0
+version: 6.28.0
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org
@@ -0,0 +1,12 @@
+---
+name: xml-naming
+version: 0.1.0
+type: npm
+summary: Validates XML name productions — Name, NCName, QName, NMToken, NMTokens —
+  for XML 1.0 and 1.1
+homepage:
+license: mit
+licenses:
+- sources: README.md
+  text: MIT
+notices: []
@@ -5,9 +5,9 @@ description = ""
 authors = ["Your Name <you@example.com>"]

 [tool.poetry.dependencies]
-python = ">=3.9,<3.15"
+python = ">=3.9,<3.14"
 flake8 = "^4.0.1"
-pyinstaller = "6.16.0"
+pyinstaller = "6.10.0"
 setuptools = ">=78.1.1" 
 packaging = ">=22.0,<26"

@@ -1,590 +0,0 @@
-import {jest, describe, it, expect, beforeEach} from '@jest/globals';
-
-// Inputs are read lazily by install-python.ts, so each test can set them
-// before invoking the function under test.
-const inputs: Record<string, string> = {};
-
-// Mock @actions/http-client
-jest.unstable_mockModule('@actions/http-client', () => ({
-  HttpClient: jest.fn().mockImplementation(() => ({
-    getJson: jest.fn()
-  })),
-  HttpClientError: class HttpClientError extends Error {},
-  HttpCodes: {
-    OK: 200,
-    NotFound: 404,
-    InternalServerError: 500
-  }
-}));
-
-// Mock @actions/cache (needed transitively by utils.ts)
-jest.unstable_mockModule('@actions/cache', () => ({
-  saveCache: jest.fn(),
-  restoreCache: jest.fn(),
-  isFeatureAvailable: jest.fn()
-}));
-
-// Mock @actions/tool-cache
-jest.unstable_mockModule('@actions/tool-cache', () => ({
-  getManifestFromRepo: jest.fn(),
-  downloadTool: jest.fn(),
-  extractTar: jest.fn(),
-  extractZip: jest.fn(),
-  HTTPError: class HTTPError extends Error {}
-}));
-
-// Mock @actions/core (needed by install-python.ts)
-jest.unstable_mockModule('@actions/core', () => ({
-  info: jest.fn(),
-  warning: jest.fn(),
-  debug: jest.fn(),
-  error: jest.fn(),
-  notice: jest.fn(),
-  setFailed: jest.fn(),
-  setOutput: jest.fn(),
-  getInput: jest.fn(),
-  getBooleanInput: jest.fn(),
-  getMultilineInput: jest.fn(),
-  addPath: jest.fn(),
-  exportVariable: jest.fn(),
-  saveState: jest.fn(),
-  getState: jest.fn(),
-  setSecret: jest.fn(),
-  isDebug: jest.fn(() => false),
-  startGroup: jest.fn(),
-  endGroup: jest.fn(),
-  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
-  toPlatformPath: jest.fn((p: string) => p),
-  toWin32Path: jest.fn((p: string) => p),
-  toPosixPath: jest.fn((p: string) => p)
-}));
-
-// Mock @actions/exec (needed by install-python.ts)
-jest.unstable_mockModule('@actions/exec', () => ({
-  exec: jest.fn(),
-  getExecOutput: jest.fn()
-}));
-
-// Import real utils BEFORE mock registration to get real function references
-const realUtils = await import('../src/utils.js');
-
-// Pin the platform so the download/extract assertions below behave the same
-// on every runner OS.
-jest.unstable_mockModule('../src/utils.js', () => ({
-  ...realUtils,
-  IS_WINDOWS: false,
-  IS_LINUX: false
-}));
-
-// Dynamic imports after mocking
-const core = await import('@actions/core');
-const httpm = await import('@actions/http-client');
-const tc = await import('@actions/tool-cache');
-const {
-  getManifestUrl,
-  getManifest,
-  getManifestFromRepo,
-  getManifestFromURL,
-  resolveRepoCoords,
-  isMirrorCustomized,
-  installCpythonFromRelease
-} = await import('../src/install-python.js');
-
-const DEFAULT_MIRROR =
-  'https://raw.githubusercontent.com/actions/python-versions/main';
-
-const mockManifest = [
-  {
-    version: '1.0.0',
-    stable: true,
-    files: [
-      {
-        filename: 'tool-v1.0.0-linux-x64.tar.gz',
-        platform: 'linux',
-        arch: 'x64',
-        download_url: 'https://example.com/tool-v1.0.0-linux-x64.tar.gz'
-      }
-    ]
-  }
-];
-
-function setInputs(values: Record<string, string>) {
-  Object.assign(inputs, values);
-}
-
-beforeEach(() => {
-  jest.resetAllMocks();
-  for (const key of Object.keys(inputs)) {
-    delete inputs[key];
-  }
-  (core.getInput as jest.Mock<any>).mockImplementation(
-    (name: string) => inputs[name] ?? ''
-  );
-});
-
-describe('getManifestUrl', () => {
-  it('defaults to the actions/python-versions manifest', () => {
-    expect(getManifestUrl()).toBe(`${DEFAULT_MIRROR}/versions-manifest.json`);
-  });
-
-  it('appends versions-manifest.json to a custom mirror', () => {
-    setInputs({mirror: 'https://mirror.example/py'});
-    expect(getManifestUrl()).toBe(
-      'https://mirror.example/py/versions-manifest.json'
-    );
-  });
-
-  it('strips trailing slashes from the mirror', () => {
-    setInputs({mirror: 'https://mirror.example/py///'});
-    expect(getManifestUrl()).toBe(
-      'https://mirror.example/py/versions-manifest.json'
-    );
-  });
-
-  it('throws on a mirror that is not a valid URL', () => {
-    setInputs({mirror: 'not a url'});
-    expect(() => getManifestUrl()).toThrow(/Invalid 'mirror' URL/);
-  });
-
-  it('keeps throwing the same error when called repeatedly', () => {
-    setInputs({mirror: 'not a url'});
-    expect(() => getManifestUrl()).toThrow(/Invalid 'mirror' URL/);
-    // Memoized, so the second call must not silently succeed or change shape —
-    // find-python.ts calls this while building the "version not found" message.
-    expect(() => getManifestUrl()).toThrow(/Invalid 'mirror' URL/);
-  });
-
-  it('treats an invalid mirror as fatal on the auth path too', async () => {
-    // getManifestUrl() throws on a bad mirror; the auth resolution must agree
-    // rather than swallow the error and quietly skip the mirror-token branch.
-    setInputs({'mirror-token': 'MTOK', mirror: 'not a url'});
-    (tc.downloadTool as jest.Mock<any>).mockResolvedValue('/tmp/py.tgz');
-    (tc.extractTar as jest.Mock<any>).mockResolvedValue('/tmp/extracted');
-
-    const release = {
-      version: '3.12.0',
-      stable: true,
-      files: [
-        {
-          filename: 'python-3.12.0-linux-x64.tar.gz',
-          platform: 'linux',
-          arch: 'x64',
-          download_url: 'https://cdn.example/py.tar.gz'
-        }
-      ]
-    } as any;
-
-    await expect(installCpythonFromRelease(release)).rejects.toThrow(
-      /Invalid 'mirror' URL/
-    );
-  });
-});
-
-describe('isMirrorCustomized', () => {
-  it('is false when the mirror input is empty', () => {
-    expect(isMirrorCustomized()).toBe(false);
-  });
-
-  it('is false when the mirror input equals the default', () => {
-    // action.yml gives `mirror` this exact default, so getInput() returns it on
-    // every run where the user did not set one. The PyPy/GraalPy warning must
-    // not fire in that case.
-    setInputs({mirror: DEFAULT_MIRROR});
-    expect(isMirrorCustomized()).toBe(false);
-  });
-
-  it('is false when the mirror input is the default with trailing slashes', () => {
-    setInputs({mirror: `${DEFAULT_MIRROR}///`});
-    expect(isMirrorCustomized()).toBe(false);
-  });
-
-  it('is true when the mirror input is a custom URL', () => {
-    setInputs({mirror: 'https://mirror.example/py'});
-    expect(isMirrorCustomized()).toBe(true);
-  });
-});
-
-describe('resolveRepoCoords', () => {
-  it('warns and returns null for a raw.githubusercontent.com mirror with a slash in the branch', () => {
-    setInputs({
-      mirror: 'https://raw.githubusercontent.com/foo/bar/feature/riscv'
-    });
-
-    expect(resolveRepoCoords()).toBeNull();
-    expect(core.warning).toHaveBeenCalledWith(
-      expect.stringMatching(/Branch names containing '\/' are not supported/)
-    );
-  });
-
-  it('parses the refs/heads/{branch} form to the bare branch without warning', () => {
-    setInputs({
-      mirror:
-        'https://raw.githubusercontent.com/actions/python-versions/refs/heads/main'
-    });
-
-    expect(resolveRepoCoords()).toEqual({
-      owner: 'actions',
-      repo: 'python-versions',
-      branch: 'main'
-    });
-    // refs/heads/main is a valid single branch, so it must route through the
-    // API path and never hit the slash-branch warning.
-    expect(core.warning).not.toHaveBeenCalled();
-  });
-
-  it('does not warn for a non-GitHub mirror', () => {
-    setInputs({mirror: 'https://mirror.example/py'});
-
-    expect(resolveRepoCoords()).toBeNull();
-    expect(core.warning).not.toHaveBeenCalled();
-  });
-});
-
-describe('getManifestFromRepo mirror resolution', () => {
-  it('resolves the default mirror to actions/python-versions@main with token', async () => {
-    setInputs({token: 'TKN'});
-    (tc.getManifestFromRepo as jest.Mock<any>).mockResolvedValue(mockManifest);
-
-    await getManifestFromRepo();
-
-    expect(tc.getManifestFromRepo).toHaveBeenCalledWith(
-      'actions',
-      'python-versions',
-      'token TKN',
-      'main'
-    );
-  });
-
-  it('extracts owner/repo/branch from a custom raw.githubusercontent.com mirror', async () => {
-    setInputs({
-      token: 'TKN',
-      mirror: 'https://raw.githubusercontent.com/foo/bar/dev'
-    });
-    (tc.getManifestFromRepo as jest.Mock<any>).mockResolvedValue(mockManifest);
-
-    await getManifestFromRepo();
-
-    expect(tc.getManifestFromRepo).toHaveBeenCalledWith(
-      'foo',
-      'bar',
-      'token TKN',
-      'dev'
-    );
-  });
-
-  it('strips a trailing slash before extracting the branch', async () => {
-    setInputs({
-      token: 'TKN',
-      mirror: 'https://raw.githubusercontent.com/foo/bar/main/'
-    });
-    (tc.getManifestFromRepo as jest.Mock<any>).mockResolvedValue(mockManifest);
-
-    await getManifestFromRepo();
-
-    expect(tc.getManifestFromRepo).toHaveBeenCalledWith(
-      'foo',
-      'bar',
-      'token TKN',
-      'main'
-    );
-  });
-
-  it('resolves the refs/heads/{branch} form to the bare branch for the API', async () => {
-    setInputs({
-      token: 'TKN',
-      mirror: 'https://raw.githubusercontent.com/foo/bar/refs/heads/main'
-    });
-    (tc.getManifestFromRepo as jest.Mock<any>).mockResolvedValue(mockManifest);
-
-    await getManifestFromRepo();
-
-    // The GitHub tree API takes a bare branch, so the refs/heads/ prefix must
-    // be stripped rather than passed through as part of the branch name.
-    expect(tc.getManifestFromRepo).toHaveBeenCalledWith(
-      'foo',
-      'bar',
-      'token TKN',
-      'main'
-    );
-  });
-
-  it('returns null for a non-GitHub mirror so the caller uses the raw URL', () => {
-    setInputs({mirror: 'https://mirror.example/py'});
-    expect(resolveRepoCoords()).toBeNull();
-    expect(tc.getManifestFromRepo).not.toHaveBeenCalled();
-  });
-
-  it('prefers mirror-token over token for the GitHub API call', async () => {
-    setInputs({
-      token: 'TKN',
-      'mirror-token': 'MTOK',
-      mirror: 'https://raw.githubusercontent.com/foo/bar/main'
-    });
-    (tc.getManifestFromRepo as jest.Mock<any>).mockResolvedValue(mockManifest);
-
-    await getManifestFromRepo();
-
-    // The API requires the `token ` prefix, and naming a repo mirror is explicit intent to
-    // read that repo, so mirror-token is prefixed here even though downloads send it verbatim.
-    expect(tc.getManifestFromRepo).toHaveBeenCalledWith(
-      'foo',
-      'bar',
-      'token MTOK',
-      'main'
-    );
-  });
-
-  it('sends no auth when neither token nor mirror-token is set', async () => {
-    (tc.getManifestFromRepo as jest.Mock<any>).mockResolvedValue(mockManifest);
-
-    await getManifestFromRepo();
-
-    expect(tc.getManifestFromRepo).toHaveBeenCalledWith(
-      'actions',
-      'python-versions',
-      undefined,
-      'main'
-    );
-  });
-});
-
-describe('getManifestFromURL mirror resolution', () => {
-  it('fetches {mirror}/versions-manifest.json without auth when no mirror-token is set', async () => {
-    setInputs({token: 'TKN', mirror: 'https://mirror.example/py'});
-    const getJson = jest.fn(async () => ({result: mockManifest}));
-    (httpm.HttpClient as jest.Mock<any>).mockImplementation(() => ({getJson}));
-
-    await getManifestFromURL();
-
-    // `token` must not reach a non-GitHub mirror.
-    expect(getJson).toHaveBeenCalledWith(
-      'https://mirror.example/py/versions-manifest.json',
-      undefined
-    );
-  });
-
-  it('sends mirror-token verbatim on the manifest fetch', async () => {
-    setInputs({
-      token: 'TKN',
-      'mirror-token': 'Bearer MTOK',
-      mirror: 'https://mirror.example/py'
-    });
-    const getJson = jest.fn(async () => ({result: mockManifest}));
-    (httpm.HttpClient as jest.Mock<any>).mockImplementation(() => ({getJson}));
-
-    await getManifestFromURL();
-
-    expect(getJson).toHaveBeenCalledWith(
-      'https://mirror.example/py/versions-manifest.json',
-      {authorization: 'Bearer MTOK'}
-    );
-  });
-
-  it('sends token as a prefixed header for a GitHub-hosted raw manifest', async () => {
-    // A slash-branch URL genuinely falls to the direct-URL path (it does not
-    // match the {owner}/{repo}/{branch} shape). raw.githubusercontent.com is a
-    // GitHub host, so the token is still attached here — contradicting any
-    // claim that the fallback fetch is anonymous.
-    setInputs({
-      token: 'TKN',
-      mirror: 'https://raw.githubusercontent.com/foo/bar/feature/riscv'
-    });
-    const getJson = jest.fn(async () => ({result: mockManifest}));
-    (httpm.HttpClient as jest.Mock<any>).mockImplementation(() => ({getJson}));
-
-    await getManifestFromURL();
-
-    expect(getJson).toHaveBeenCalledWith(
-      'https://raw.githubusercontent.com/foo/bar/feature/riscv/versions-manifest.json',
-      {authorization: 'token TKN'}
-    );
-  });
-});
-
-describe('getManifest source routing', () => {
-  it('skips the GitHub API entirely for a non-GitHub mirror', async () => {
-    setInputs({mirror: 'https://mirror.example/py'});
-    const getJson = jest.fn(async () => ({result: mockManifest}));
-    (httpm.HttpClient as jest.Mock<any>).mockImplementation(() => ({getJson}));
-
-    await expect(getManifest()).resolves.toEqual(mockManifest);
-
-    // Routing straight to the URL fetch avoids 3 retries with backoff on a
-    // call that could never succeed.
-    expect(tc.getManifestFromRepo).not.toHaveBeenCalled();
-    expect(getJson).toHaveBeenCalledTimes(1);
-  });
-
-  it('uses the GitHub API for a repo mirror without touching the raw URL', async () => {
-    setInputs({token: 'TKN'});
-    (tc.getManifestFromRepo as jest.Mock<any>).mockResolvedValue(mockManifest);
-    const getJson = jest.fn(async () => ({result: mockManifest}));
-    (httpm.HttpClient as jest.Mock<any>).mockImplementation(() => ({getJson}));
-
-    await expect(getManifest()).resolves.toEqual(mockManifest);
-
-    expect(tc.getManifestFromRepo).toHaveBeenCalledTimes(1);
-    expect(getJson).not.toHaveBeenCalled();
-  });
-});
-
-describe('installCpythonFromRelease auth gating', () => {
-  const makeRelease = (downloadUrl: string) =>
-    ({
-      version: '3.12.0',
-      stable: true,
-      release_url: '',
-      files: [
-        {
-          filename: 'python-3.12.0-linux-x64.tar.gz',
-          platform: 'linux',
-          platform_version: '',
-          arch: 'x64',
-          download_url: downloadUrl
-        }
-      ]
-    }) as any;
-
-  // Returns the auth argument tc.downloadTool was called with.
-  async function downloadAuthFor(downloadUrl: string) {
-    (tc.downloadTool as jest.Mock<any>).mockResolvedValue('/tmp/py.tgz');
-    (tc.extractTar as jest.Mock<any>).mockResolvedValue('/tmp/extracted');
-
-    await installCpythonFromRelease(makeRelease(downloadUrl));
-
-    const call = (tc.downloadTool as jest.Mock<any>).mock.calls[0];
-    expect(call[0]).toBe(downloadUrl);
-    return call[2];
-  }
-
-  it('forwards token to github.com download URLs', async () => {
-    setInputs({token: 'TKN'});
-    await expect(
-      downloadAuthFor(
-        'https://github.com/actions/python-versions/releases/download/3.12.0-x/python-3.12.0-linux-x64.tar.gz'
-      )
-    ).resolves.toBe('token TKN');
-  });
-
-  it('forwards token to api.github.com download URLs', async () => {
-    setInputs({token: 'TKN'});
-    await expect(
-      downloadAuthFor('https://api.github.com/repos/x/y/tarball/main')
-    ).resolves.toBe('token TKN');
-  });
-
-  it('forwards token to *.githubusercontent.com download URLs', async () => {
-    setInputs({token: 'TKN'});
-    await expect(
-      downloadAuthFor('https://objects.githubusercontent.com/x/python.tar.gz')
-    ).resolves.toBe('token TKN');
-  });
-
-  it('does NOT forward token to a non-GitHub download URL', async () => {
-    setInputs({token: 'TKN', mirror: 'https://cdn.example'});
-    await expect(
-      downloadAuthFor('https://cdn.example/py.tar.gz')
-    ).resolves.toBeUndefined();
-  });
-
-  it('does NOT forward token to a lookalike host', async () => {
-    setInputs({token: 'TKN', mirror: 'https://evil-github.com'});
-    await expect(
-      downloadAuthFor('https://evil-github.com/py.tar.gz')
-    ).resolves.toBeUndefined();
-  });
-
-  it('forwards mirror-token verbatim to the mirror host', async () => {
-    setInputs({
-      token: 'TKN',
-      'mirror-token': 'Bearer MTOK',
-      mirror: 'https://cdn.example'
-    });
-    await expect(
-      downloadAuthFor('https://cdn.example/py.tar.gz')
-    ).resolves.toBe('Bearer MTOK');
-  });
-
-  it('withholds mirror-token from a same-host download URL on a different scheme', async () => {
-    setInputs({
-      'mirror-token': 'Bearer MTOK',
-      mirror: 'https://cdn.example'
-    });
-    // The mirror is https, but the manifest points a download_url at http on
-    // the same host. Matching on origin (scheme + host + port) rather than host
-    // alone keeps the token from going out in cleartext.
-    await expect(
-      downloadAuthFor('http://cdn.example/py.tar.gz')
-    ).resolves.toBeUndefined();
-  });
-
-  it('withholds mirror-token from a same-host download URL on a different port', async () => {
-    setInputs({
-      'mirror-token': 'Bearer MTOK',
-      mirror: 'https://cdn.example'
-    });
-    // Different port is a different origin, so the nominated credential must
-    // not follow.
-    await expect(
-      downloadAuthFor('https://cdn.example:8443/py.tar.gz')
-    ).resolves.toBeUndefined();
-  });
-
-  it('sends mirror-token to a same-origin download URL on an explicit port', async () => {
-    setInputs({
-      'mirror-token': 'Bearer MTOK',
-      mirror: 'https://cdn.example:8443'
-    });
-    await expect(
-      downloadAuthFor('https://cdn.example:8443/py.tar.gz')
-    ).resolves.toBe('Bearer MTOK');
-  });
-
-  it('withholds mirror-token from an incidental GitHub host and uses token there', async () => {
-    setInputs({
-      token: 'TKN',
-      'mirror-token': 'MTOK',
-      mirror: 'https://cdn.example'
-    });
-    // A manifest hosted on the private mirror may still point release assets at
-    // GitHub; the private credential must not follow them there.
-    await expect(
-      downloadAuthFor('https://objects.githubusercontent.com/x/python.tar.gz')
-    ).resolves.toBe('token TKN');
-  });
-
-  it('withholds mirror-token from a GitHub host when no token is set', async () => {
-    setInputs({'mirror-token': 'MTOK', mirror: 'https://cdn.example'});
-    await expect(
-      downloadAuthFor('https://objects.githubusercontent.com/x/python.tar.gz')
-    ).resolves.toBeUndefined();
-  });
-
-  it('withholds mirror-token from a third host that is neither the mirror nor GitHub', async () => {
-    setInputs({
-      token: 'TKN',
-      'mirror-token': 'MTOK',
-      mirror: 'https://cdn.example'
-    });
-    await expect(
-      downloadAuthFor('https://other.example/py.tar.gz')
-    ).resolves.toBeUndefined();
-  });
-
-  it('uses mirror-token for a GitHub mirror host when it is the nominated host', async () => {
-    setInputs({
-      token: 'TKN',
-      'mirror-token': 'token MTOK',
-      mirror: 'https://raw.githubusercontent.com/foo/bar/main'
-    });
-    await expect(
-      downloadAuthFor('https://raw.githubusercontent.com/foo/bar/py.tar.gz')
-    ).resolves.toBe('token MTOK');
-  });
-
-  it('sends no auth when no tokens are configured', async () => {
-    await expect(
-      downloadAuthFor('https://github.com/o/r/releases/download/v/py.tar.gz')
-    ).resolves.toBeUndefined();
-  });
-});
@@ -16,14 +16,8 @@ inputs:
    description: "Set this option if you want the action to check for the latest available version that satisfies the version spec."
    default: false
  token:
-    description: "The token used to authenticate when fetching Python distributions from https://github.com/actions/python-versions. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting. This token is only sent to GitHub-owned hosts, never to a custom 'mirror'."
+    description: "The token used to authenticate when fetching Python distributions from https://github.com/actions/python-versions. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting."
    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
-  mirror:
-    description: "Base URL for downloading Python distributions (only applies to CPython; PyPy and GraalPy are unaffected). Defaults to https://raw.githubusercontent.com/actions/python-versions/main. See docs/advanced-usage.md for details."
-    default: "https://raw.githubusercontent.com/actions/python-versions/main"
-  mirror-token:
-    description: "Token used to authenticate requests to the host named in 'mirror'. Sent verbatim as the Authorization header, so include a scheme if your mirror needs one (e.g. 'Bearer <token>')."
-    required: false
  cache-dependency-path:
    description: "Used to specify the path to dependency files. Supports wildcards or a list of file names for caching multiple dependencies."
  update-environment:
@@ -524,46 +524,6 @@ Such a requirement on side-effect could be because you don't want your composite

 >**Note:** Python versions used in this action are generated in the [python-versions](https://github.com/actions/python-versions) repository. For macOS and Ubuntu images, python versions are built from the source code. For Windows, the python-versions repository uses installation executable. For more information please refer to the [python-versions](https://github.com/actions/python-versions) repository.

-#### Using a custom mirror
-
-The `mirror` input lets you point `setup-python` at a different location for CPython distributions — a personal fork of `actions/python-versions`, an internal mirror, or any server that hosts a `versions-manifest.json` at its root plus the tarballs referenced by that manifest. Default: `https://raw.githubusercontent.com/actions/python-versions/main`.
-
-The manifest is resolved as follows:
-
- If `mirror` matches `https://raw.githubusercontent.com/{owner}/{repo}/{branch}`, the manifest is fetched via the GitHub REST API (giving you the 5000/hr authenticated rate limit when a token is present).
- Otherwise, the action fetches `{mirror}/versions-manifest.json` via a direct HTTP GET.
-
-Authentication is decided by the host of each request, so neither credential reaches a server you did not nominate:
-
- Requests to the host named in `mirror` use `mirror-token`, sent **verbatim** as the `Authorization` header. Include a scheme if your mirror expects one — `Bearer <token>`, `Basic <base64>`, or `token <token>` for a GitHub host. This covers both the manifest fetch and the tarball downloads.
- Requests to `github.com`, `*.github.com`, or `*.githubusercontent.com` use `token`, sent as `token <token>`. A manifest that points its `download_url` at a GitHub host therefore keeps working without `mirror-token` being leaked to it.
- Any other host is requested anonymously.
- One exception: when `mirror` is a GitHub repo URL, the manifest is fetched from `api.github.com`, and `mirror-token` is preferred there (with the `token ` prefix the API requires) because naming a repo mirror is an explicit instruction to read that repo.
-
-Point at a personal fork of `actions/python-versions` (uses the default `token`, fetched via the GitHub API):
-
-```yaml
- uses: actions/setup-python@v6
-  with:
-    python-version: '3.12'
-    mirror: https://raw.githubusercontent.com/my-org/python-versions/main
-```
-
-Point at an internal mirror with its own credential:
-
-```yaml
- uses: actions/setup-python@v6
-  with:
-    python-version: '3.12'
-    mirror: https://python-mirror.internal.example
-    mirror-token: ${{ secrets.PYTHON_MIRROR_TOKEN }}
-```
-
-Caveats:
-
- `mirror` and `mirror-token` apply to **CPython only**. PyPy resolves from `downloads.python.org` and GraalPy from the GitHub releases API; both ignore these inputs, and the action warns if you set `mirror` alongside a `pypy-*` or `graalpy-*` version.
- Branch names containing `/` cannot be used with a `raw.githubusercontent.com` mirror, because `.../{owner}/{repo}/feature/riscv` is indistinguishable from a repo path. Such a mirror still works and is still authenticated with your `token` (raw.githubusercontent.com is a GitHub host), but the manifest is fetched directly from the raw URL rather than through the GitHub REST API; the action warns when this happens. Use a branch without a slash to get the REST API path. The `refs/heads/{branch}` form (for example `.../actions/python-versions/refs/heads/main`) is recognized and routes through the REST API.
-
 ### PyPy

 `setup-python` is able to configure **PyPy** from two sources:
@@ -1,6 +1,6 @@
 {
  "name": "setup-python",
-  "version": "7.1.0",
+  "version": "7.0.0",
  "type": "module",
  "private": true,
  "description": "Setup python action",
@@ -32,7 +32,7 @@
  "author": "GitHub",
  "license": "MIT",
  "dependencies": {
-    "@actions/cache": "^6.3.0",
+    "@actions/cache": "^6.2.0",
    "@actions/core": "^3.0.1",
    "@actions/exec": "^3.0.0",
    "@actions/glob": "^0.7.0",
@@ -46,18 +46,18 @@
    "@eslint/js": "^10.0.1",
    "@jest/globals": "^30.4.1",
    "@types/node": "^24.10.1",
-    "@types/semver": "^7.8.0",
-    "@typescript-eslint/eslint-plugin": "^8.71.1",
-    "@typescript-eslint/parser": "^8.70.0",
-    "@vercel/ncc": "^0.45.0",
+    "@types/semver": "^7.7.0",
+    "@typescript-eslint/eslint-plugin": "^8.62.0",
+    "@typescript-eslint/parser": "^8.62.0",
+    "@vercel/ncc": "^0.44.0",
    "eslint": "^10.5.0",
    "eslint-config-prettier": "^10.0.0",
-    "eslint-plugin-jest": "^29.16.6",
+    "eslint-plugin-jest": "^29.15.2",
    "eslint-plugin-n": "^18.1.0",
    "globals": "^17.7.0",
    "jest": "^30.4.2",
-    "prettier": "^3.9.9",
-    "ts-jest": "^29.4.14",
-    "typescript": "^6.0.3"
+    "prettier": "^3.8.4",
+    "ts-jest": "^29.4.11",
+    "typescript": "^7.0.2"
  }
 }
@@ -137,7 +137,7 @@ export async function useCpythonVersion(
      );
    }
    msg.push(
-      `The list of all available versions can be found here: ${installer.getManifestUrl()}`
+      `The list of all available versions can be found here: ${installer.MANIFEST_URL}`
    );
    throw new Error(msg.join(os.EOL));
  }
@@ -9,135 +9,12 @@ import * as semver from 'semver';
 import {IS_WINDOWS, IS_LINUX, getDownloadFileName} from './utils.js';
 import {IToolRelease} from '@actions/tool-cache';

-const DEFAULT_REPO_OWNER = 'actions';
-const DEFAULT_REPO_NAME = 'python-versions';
-const DEFAULT_REPO_BRANCH = 'main';
-const DEFAULT_MIRROR = `https://raw.githubusercontent.com/${DEFAULT_REPO_OWNER}/${DEFAULT_REPO_NAME}/${DEFAULT_REPO_BRANCH}`;
-
-// Matches https://raw.githubusercontent.com/{owner}/{repo}/{branch} and the
-// equivalent https://raw.githubusercontent.com/{owner}/{repo}/refs/heads/{branch}
-// form, capturing the bare branch in both. The GitHub tree API wants the bare
-// branch, so the optional refs/heads/ prefix is consumed, not captured.
-const REPO_COORDS_RE =
-  /^https:\/\/raw\.githubusercontent\.com\/([^/]+)\/([^/]+)\/(?:refs\/heads\/)?([^/]+)\/?$/;
-
-function getToken(): string {
-  return core.getInput('token');
-}
-
-function getMirrorToken(): string {
-  return core.getInput('mirror-token');
-}
-
-// Memoized per raw input value so the mirror is validated once per run rather
-// than on every call. `getManifestUrl()` is also used to build the "version not
-// found" message in find-python.ts, where re-validating would replace the real
-// cause with an invalid-mirror error.
-const mirrorCache = new Map<string, {url: string} | {error: Error}>();
-
-function getMirror(): string {
-  const input = core.getInput('mirror') || DEFAULT_MIRROR;
-  let resolved = mirrorCache.get(input);
-
-  if (!resolved) {
-    const url = input.trim().replace(/\/+$/, '');
-    try {
-      new URL(url);
-      resolved = {url};
-    } catch {
-      resolved = {error: new Error(`Invalid 'mirror' URL: "${url}"`)};
-    }
-    mirrorCache.set(input, resolved);
-  }
-
-  if ('error' in resolved) throw resolved.error;
-  return resolved.url;
-}
-
-export function getManifestUrl(): string {
-  return `${getMirror()}/versions-manifest.json`;
-}
-
-// Whether the user set `mirror` to something other than the built-in default.
-// action.yml gives `mirror` a default, so core.getInput('mirror') is never
-// empty; callers that want "did the user opt into a custom mirror" must compare
-// against DEFAULT_MIRROR rather than test for a falsy input. Normalizes the
-// same way getMirror() does but never throws, so a warning path can call it
-// even when the mirror is malformed.
-export function isMirrorCustomized(): boolean {
-  const input = core.getInput('mirror');
-  if (!input) return false;
-  return input.trim().replace(/\/+$/, '') !== DEFAULT_MIRROR;
-}
-
-// Origin (scheme + host + port) of the mirror, so `mirror-token` is matched
-// against the exact origin the user nominated. Comparing origin rather than
-// host alone means a manifest served over https that points a download_url at
-// http://same-host/... does NOT get the token — the scheme must match too.
-// Deliberately not wrapped in try/catch: an invalid mirror throws here just as
-// it does in getManifestUrl(), so both agree a bad mirror is fatal.
-function getMirrorOrigin(): string {
-  return new URL(getMirror()).origin;
-}
-
-function isGitHubHost(host: string): boolean {
-  return (
-    host === 'github.com' ||
-    host.endsWith('.github.com') ||
-    host.endsWith('.githubusercontent.com')
-  );
-}
-
-// Warned at most once per distinct mirror; resolveRepoCoords() is called from
-// several paths within a single run.
-const warnedMirrors = new Set<string>();
-
-export function resolveRepoCoords(): {
-  owner: string;
-  repo: string;
-  branch: string;
-} | null {
-  const mirror = getMirror();
-  const m = REPO_COORDS_RE.exec(mirror);
-  if (m) return {owner: m[1], repo: m[2], branch: m[3]};
-
-  // A raw.githubusercontent.com URL that doesn't parse is a branch name
-  // containing a slash (e.g. .../{owner}/{repo}/feature/riscv), which is
-  // indistinguishable from a deeper path. getMirror() succeeded above, so the
-  // URL is well-formed and this parse cannot throw.
-  const isRawGitHub = new URL(mirror).host === 'raw.githubusercontent.com';
-  if (!warnedMirrors.has(mirror) && isRawGitHub) {
-    warnedMirrors.add(mirror);
-    core.warning(
-      `Could not parse owner/repo/branch out of mirror "${mirror}", so the manifest will be fetched directly from the raw URL instead of through the GitHub REST API. ` +
-        `The request is still authenticated with your token, because raw.githubusercontent.com is a GitHub host. ` +
-        `Branch names containing '/' are not supported for the REST API path; use a branch without a slash if you want the manifest fetched through the API.`
-    );
-  }
-
-  return null;
-}
-
-// Mirror origin with `mirror-token` set gets the token verbatim, so internal
-// mirrors can choose their own scheme (Bearer, Basic, ...). GitHub hosts get
-// `token ${token}`. Anything else is anonymous — neither credential is sent to
-// a host the user didn't nominate.
-function authForUrl(url: string): string | undefined {
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return undefined;
-  }
-
-  const mirrorToken = getMirrorToken();
-  if (mirrorToken && parsed.origin === getMirrorOrigin()) return mirrorToken;
-
-  const token = getToken();
-  if (token && isGitHubHost(parsed.host)) return `token ${token}`;
-
-  return undefined;
-}
+const TOKEN = core.getInput('token');
+const AUTH = !TOKEN ? undefined : `token ${TOKEN}`;
+const MANIFEST_REPO_OWNER = 'actions';
+const MANIFEST_REPO_NAME = 'python-versions';
+const MANIFEST_REPO_BRANCH = 'main';
+export const MANIFEST_URL = `https://raw.githubusercontent.com/${MANIFEST_REPO_OWNER}/${MANIFEST_REPO_NAME}/${MANIFEST_REPO_BRANCH}/versions-manifest.json`;

 interface LinuxOsRelease {
  id: string;
@@ -275,7 +152,9 @@ function sleep(ms: number): Promise<void> {
 // HTTP 403/429 from http-client (`statusCode`) or tool-cache (`httpStatusCode`).
 function isRateLimitError(err: unknown): boolean {
  const e = err as
-    {httpStatusCode?: number; statusCode?: number} | null | undefined;
+    | {httpStatusCode?: number; statusCode?: number}
+    | null
+    | undefined;
  const status = e?.httpStatusCode ?? e?.statusCode;
  return status === 403 || status === 429;
 }
@@ -326,24 +205,15 @@ async function fetchValidManifest(
 }

 export async function getManifest(): Promise<tc.IToolRelease[]> {
-  // Only GitHub repo mirrors can be fetched via the API. Checking up front
-  // avoids burning MANIFEST_FETCH_MAX_ATTEMPTS with backoff on a throw that
-  // could never succeed.
-  if (resolveRepoCoords()) {
-    try {
-      return await fetchValidManifest('the GitHub API', getManifestFromRepo);
-    } catch (err) {
-      core.debug('Fetching the manifest via the API failed.');
-      if (err instanceof Error) {
-        core.debug(err.message);
-      } else {
-        core.debug('An unexpected error occurred while fetching the manifest.');
-      }
+  try {
+    return await fetchValidManifest('the GitHub API', getManifestFromRepo);
+  } catch (err) {
+    core.debug('Fetching the manifest via the API failed.');
+    if (err instanceof Error) {
+      core.debug(err.message);
+    } else {
+      core.debug('An unexpected error occurred while fetching the manifest.');
    }
-  } else {
-    core.debug(
-      `Mirror "${getMirror()}" is not a GitHub repo URL; fetching the manifest by URL.`
-    );
  }

  try {
@@ -359,41 +229,24 @@ export async function getManifest(): Promise<tc.IToolRelease[]> {
 }

 export function getManifestFromRepo(): Promise<tc.IToolRelease[]> {
-  const coords = resolveRepoCoords();
-  if (!coords) {
-    throw new Error(
-      `Mirror "${getMirror()}" is not a GitHub repo URL; falling back to raw URL fetch.`
-    );
-  }
  core.debug(
-    `Getting manifest from ${coords.owner}/${coords.repo}@${coords.branch}`
+    `Getting manifest from ${MANIFEST_REPO_OWNER}/${MANIFEST_REPO_NAME}@${MANIFEST_REPO_BRANCH}`
+  );
+  return tc.getManifestFromRepo(
+    MANIFEST_REPO_OWNER,
+    MANIFEST_REPO_NAME,
+    AUTH,
+    MANIFEST_REPO_BRANCH
  );
-  // This only runs for GitHub repo mirrors, where `mirror-token` is the user's
-  // explicit intent for that repo. The target is always api.github.com, which
-  // requires the `token ` prefix, so the host rule in authForUrl() doesn't
-  // apply here.
-  const token = getToken();
-  const mirrorToken = getMirrorToken();
-  const auth = mirrorToken
-    ? `token ${mirrorToken}`
-    : token
-      ? `token ${token}`
-      : undefined;
-  return tc.getManifestFromRepo(coords.owner, coords.repo, auth, coords.branch);
 }

 export async function getManifestFromURL(): Promise<tc.IToolRelease[]> {
  core.debug('Falling back to fetching the manifest using raw URL.');

-  const manifestUrl = getManifestUrl();
  const http: httpm.HttpClient = new httpm.HttpClient('tool-cache');
-  const auth = authForUrl(manifestUrl);
-  const response = await http.getJson<tc.IToolRelease[]>(
-    manifestUrl,
-    auth ? {authorization: auth} : undefined
-  );
+  const response = await http.getJson<tc.IToolRelease[]>(MANIFEST_URL);
  if (!response.result) {
-    throw new Error(`Unable to get manifest from ${manifestUrl}`);
+    throw new Error(`Unable to get manifest from ${MANIFEST_URL}`);
  }
  return response.result;
 }
@@ -438,11 +291,7 @@ export async function installCpythonFromRelease(release: tc.IToolRelease) {
  let pythonPath = '';
  try {
    const fileName = getDownloadFileName(downloadUrl);
-    pythonPath = await tc.downloadTool(
-      downloadUrl,
-      fileName,
-      authForUrl(downloadUrl)
-    );
+    pythonPath = await tc.downloadTool(downloadUrl, fileName, AUTH);
    core.info('Extract downloaded archive');
    let pythonExtractedFolder;
    if (IS_WINDOWS) {
@@ -2,7 +2,6 @@ import * as core from '@actions/core';
 import * as finder from './find-python.js';
 import * as finderPyPy from './find-pypy.js';
 import * as finderGraalPy from './find-graalpy.js';
-import {isMirrorCustomized} from './install-python.js';
 import * as path from 'path';
 import * as os from 'os';
 import {fileURLToPath} from 'url';
@@ -24,21 +23,6 @@ function isGraalPyVersion(versionSpec: string) {
  return versionSpec.startsWith('graalpy');
 }

-// `mirror` only redirects CPython distributions. PyPy and GraalPy resolve from
-// downloads.python.org and the GitHub releases API respectively, so warn rather
-// than let the input look like it applied. Only warns when the user actually
-// set a custom mirror: action.yml gives `mirror` a default, so a plain
-// getInput() check would fire on every pypy-*/graalpy-* run.
-function warnIfMirrorUnsupported(versionSpec: string) {
-  if (!isMirrorCustomized()) {
-    return;
-  }
-  const implementation = isPyPyVersion(versionSpec) ? 'PyPy' : 'GraalPy';
-  core.warning(
-    `The 'mirror' input only applies to CPython distributions and is ignored for ${implementation} ('${versionSpec}'), which is downloaded from its own upstream source.`
-  );
-}
-
 async function cacheDependencies(cache: string, pythonVersion: string) {
  const cacheDependencyPath =
    core.getInput('cache-dependency-path') || undefined;
@@ -118,7 +102,6 @@ async function run() {
      core.startGroup('Installed versions');
      for (const version of versions) {
        if (isPyPyVersion(version)) {
-          warnIfMirrorUnsupported(version);
          const installed = await finderPyPy.findPyPyVersion(
            version,
            arch,
@@ -131,7 +114,6 @@ async function run() {
            `Successfully set up PyPy ${installed.resolvedPyPyVersion} with Python (${installed.resolvedPythonVersion})`
          );
        } else if (isGraalPyVersion(version)) {
-          warnIfMirrorUnsupported(version);
          const installed = await finderGraalPy.findGraalPyVersion(
            version,
            arch,