Repository navigation
chore(deps): update astral-sh/setup-uv action to v10 - #57
renovate[bot] wants to merge 1 commit into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #57 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 1 1
Lines 4 4
=========================================
Hits 4 4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
6b1f105 to
5579194
Compare
njzjz-bot
left a comment
njzjz-bot
left a comment
There was a problem hiding this comment.
Reviewed the complete two-file workflow change, repository context, existing discussion, and CI for this head. The setup-uv v10 cache-behavior change does not introduce a regression in these workflows because caching is explicitly enabled, and the relevant test/build workflows, pre-commit check, and coverage report are green. No high-confidence blocking issue found.
Agent: ChatGPT
Model: GPT-5.6 Sol
GitHub account: njzjz-bot
Reviewed head: 5579194
Trigger: scheduled review-request monitoring
5579194 to
1227368
Compare
njzjz-bot
left a comment
njzjz-bot
left a comment
There was a problem hiding this comment.
Reviewed the complete two-workflow update from astral-sh/setup-uv@v8.3.2 to @v10.1.0. Both workflows explicitly set enable-cache: true, so the v10 change to automatic cache behavior on sensitive events does not silently disable the configured cache. The exact-head package test and release workflows pass, as does pre-commit.ci. I found no high-confidence functional, compatibility, or security blocker.
Agent: ChatGPT
Model: GPT-5.6 Sol
GitHub account: njzjz-bot
Reviewed head: 1227368
Trigger: scheduled review-request monitoring
1227368 to
14e8d13
Compare
14e8d13 to
b1b3386
Compare
b1b3386 to
28be10f
Compare
2 participants
This PR contains the following updates:
v8.3.2→v10.3.0Release Notes
astral-sh/setup-uv
v10.3.0: 🌈 Add Python architecture selectionCompare Source
Changes
This release adds the
python-archinput to select a Python architecture independently of the Python version. Withuv0.13.0 or later, setpython-arch: x86_64to use x64 Python on Windows ARM64 runners.It also includes embedded checksums for
uvreleases through 0.13.0.🚀 Enhancements
python-archsupport @zanieb (#1079)🧰 Maintenance
⬆️ Dependency updates
v10.2.0: 🌈 Disable automatic cache saves for merge queuesCompare Source
Changes
This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v10.1.0: 🌈 New outputpython-runtime-idand respect NO_PROXYCompare Source
Changes
This release adds more bheind the scene security improvements and also 2 small improvements.
NO_PROXY
This action now respects
no_proxy/NO_PROXYenvironment variables which were previously ignored.New output
python-runtime-idThe new output
python-runtime-idcan be used to know which python version exactly was installed if you useactivate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v10.0.1: 🌈 Tolerate transient manifest timeoutsCompare Source
Changes
Thank you @arguile- for making this action more resilient.
🐛 Bug fixes
🧰 Maintenance
📚 Documentation
v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL featuresCompare Source
Changes
Another breaking release, directly after v9.0.0 but we think the added security justifies that.
Extra security by default
If you use the default
enable-cache: autothis will now DISABLE THE CACHE to protect against cache poisoning for the following events:pull_request_targetworkflow_runreleaseYou can read the full reasoning in #984
version: latest-knownThis will now install the latest version with a checksum that is known by this action. The known
uvchecksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.Read python version from
.tool-versionsWill now also set the python version if it is defined in
.tool-versions. You can read the details in the docs🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v9.0.0: 🌈 Changeprune-cachedefault tofalseCompare Source
Changes
This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967
Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.
🚨 Breaking changes
prune-cachedefault tofalse@charliermarsh (#967)🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.