557 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Kevin StillhammerandGitHub	4f6036f71c	Require pull requests for Dependabot rollups (#1005) ... ## Summary - require the Dependabot rollup skill to commit and push validated changes - always create a pull request with the `dependencies` label - report the created PR and label confirmation ## Testing - `git diff --check` Refs: pi-session 019ff0f1-1aee-7691-8a2c-7c708812f7b0	2026-08-11 15:18:43 +02:00
Kevin StillhammerandGitHub	8d6402c9b7	chore(deps): roll up Dependabot updates (#1004) ... ## Summary Roll up the remaining dependency changes from Dependabot PRs #997, #998, #999, #1000, #1001, #1002, and #1003: - update `github/codeql-action` to 4.37.6 - update `zizmorcore/zizmor-action` to 0.6.2 - update `undici` to 8.10.0 - update `smol-toml` to 1.7.1 - update `@biomejs/biome` and its schema to 2.5.6 - regenerate the published bundles PRs #905 and #907 were excluded because their requested Jest and pep440 versions are already present on `main`. ## Validation - `npm run all` - `actionlint .github/workflows/codeql-analysis.yml .github/workflows/test.yml` - `uvx zizmor .github/workflows/codeql-analysis.yml .github/workflows/test.yml` - `git diff --check` Refs: pi-session 019ff0c9-8e00-72d3-99ad-d4383a4c57d4	2026-08-11 15:08:35 +02:00
Kevin StillhammerandGitHub	46f427bd47	Read Python version from .tool-versions (#996) ... ## Summary - read the Python version from an explicitly selected `.tool-versions` file - preserve `python-version` and existing `UV_PYTHON` precedence - add parser, input, and workflow coverage and update documentation and bundled action artifacts ## Validation - `npm run all` - `actionlint .github/workflows/test.yml` - `uvx zizmor .github/workflows/test.yml` Closes #983 Refs: pi-session 019ff01a-544c-79f3-8f73-a00132af39f5	2026-08-11 14:26:03 +02:00
Kevin StillhammerandGitHub	8ed89c5114	ci: pin Alpine container image (#995) ... ## Summary - pin the Alpine test container to the current multi-platform digest for Alpine 3.24.1 - resolve zizmor's `unpinned-images` finding ## Validation - `actionlint .github/workflows/test.yml` - `uvx zizmor .github/workflows/test.yml` - `docker buildx imagetools inspect alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` Refs: pi-session 019ff01a-544c-79f3-8f73-a00132af39f5	2026-08-11 11:47:08 +02:00
Kevin StillhammerandGitHub	8473c7fea4	chore(deps): roll up Dependabot updates (#994) ... ## Summary Roll up the remaining net changes from the open Dependabot updates: - release-drafter/release-drafter 7.7.0 (#990) - github/codeql-action 4.37.4 (#987, #988, #989) - zizmorcore/zizmor-action 0.6.1 (#986) - @actions/cache 6.2.0 (#975) - @biomejs/biome 2.5.4 (#974) - undici 8.7.0 (#973) The Jest 30.4.2 (#905) and @renovatebot/pep440 5.0.0 (#907) updates are already present on main and require no additional changes. This also updates the Biome schema, applies the formatter changes from Biome 2.5.4, and regenerates the published bundles. ## Testing - `npm run all` - `actionlint` - `git diff --check` Refs: pi-session 019ff01b-f917-73c1-950e-2966956f263c	2026-08-11 11:27:16 +02:00
Kevin StillhammerandGitHub	18d451d679	Add latest-known version selector (#993) ... ## Summary - add `latest-known` as an explicit version selector - resolve it locally to the newest version in the bundled checksum table - preserve existing default and `latest` behavior - document custom-manifest checksum semantics and update published bundles ## Testing - `npm ci --ignore-scripts` - `npm run all` (99 tests passed) Closes #919 Refs: pi-session 019fed0e-6019-7504-911b-bd9955cbbd49	2026-08-11 11:15:59 +02:00
Kevin StillhammerandGitHub	f45168497b	Disable automatic caching for sensitive events (#992) ... ## Summary - disable `enable-cache: auto` for `pull_request_target`, `workflow_run`, and `release` events - disable automatic caching for tag pushes while leaving branch pushes unchanged - preserve explicit `enable-cache: true` as an override - run a `workflow_run` integration fixture with `act` in pull request CI and verify caching is disabled - document the behavior and update the published bundles ## Testing - `npm run all` - `actionlint .github/workflows/test.yml __tests__/workflows/workflow-run.yml` - `uvx zizmor __tests__/workflows/workflow-run.yml` Closes #984 Refs: pi-session 019fec42-9b26-714e-a359-830ac4401ecd	2026-08-10 18:12:08 +02:00
3 people	b68407c192	chore: update known checksums for 0.12.3 (#991) ... chore: update known checksums for 0.12.3 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-08-09 10:26:32 +02:00
3 people	696e4e1bf2	chore: update known checksums for 0.12.2 (#985) ... chore: update known checksums for 0.12.2 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-08-06 15:23:16 +02:00
dependabot[bot]andGitHub	7cd5f7fd2e	chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#976) ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-05 09:55:57 -04:00
dependabot[bot]andGitHub	d64009a7c5	chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#980) ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-05 09:55:41 -04:00
3 people	7e7e21ddc3	chore: update known checksums for 0.12.1 (#982) ... chore: update known checksums for 0.12.1 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-08-01 10:26:59 +02:00
3 people	094aa226ed	chore: update known checksums for 0.12.0 (#981) ... chore: update known checksums for 0.12.0 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-29 09:17:43 +02:00
3 people	d269b9917d	chore: update known checksums for 0.11.31/0.11.32 (#972) ... chore: update known checksums for 0.11.32 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-24 08:30:02 +02:00
3 people	c6081965dd	docs: update version references to v9.0.0 (#971) ... Update `uses: astral-sh/setup-uv@...` references in documentation to `c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0`. Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-21 18:03:39 +02:00
Kevin StillhammerandGitHub	c771a70e62	chore(deps): roll up Dependabot updates (#970) ... ## Summary Roll up the remaining dependency changes from Dependabot PRs: - #966: update `actions/setup-node` from 6.4.0 to 7.0.0 - #965: update `js-yaml` from 4.1.1 to 5.2.1 - #964: update `@types/node` from 26.0.1 to 26.1.1 - #963: update `esbuild` from 0.28.0 to 0.28.1 PRs #907 and #905 require no net changes because `@renovatebot/pep440` 5.0.0 and Jest 30.4.2 are already on `main`. ## Validation - `npm run all` Refs: pi-session 019f854e-4714-73ad-8de2-e79900f41b4d v9.0.0	2026-07-21 17:36:40 +02:00
3 people	2f537ca87c	chore: update known checksums for 0.11.30 (#968) ... chore: update known checksums for 0.11.30 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-21 17:30:36 +02:00
Kevin StillhammerandGitHub	2269552d54	Speed up version client by partial response reads (#807)	2026-07-21 17:26:32 +02:00
Charlie MarshandGitHub	47a7f4fb2e	Change prune-cache default to false (#967) ... ## Summary This changes the default for `prune-cache` from `true` to `false`, motivated by [#745](https://github.com/astral-sh/setup-uv/issues/745). Users that want the existing behavior can continue to set `prune-cache: true` explicitly. Some history: I originally added [`uv cache prune --ci`](https://github.com/astral-sh/uv/pull/5391) after looking at a workload where the uv cache was ~2.2 GB, almost entirely due to the enormous pre-built `torch` and `nvidia_cudnn_cu12` wheels ([original analysis](https://github.com/actions/setup-python/issues/822#issuecomment-2248728264)). Persisting and restoring thousands of extracted files through the GitHub Actions cache could be slower than downloading the wheels again. In contrast, wheels built from source can be very expensive to recreate. The intent was to remove pre-built wheels while retaining locally-built wheels. `setup-uv` subsequently made pruning configurable, but defaulted `prune-cache` to `true`; it also later enabled caching by default on GitHub-hosted runners. As a result, the default configuration repeatedly downloads pre-built wheels from PyPI even on a cache hit. That tradeoff has become more important as uv adoption has grown: [the PyPI analysis in #745](https://github.com/astral-sh/setup-uv/issues/745#issuecomment-3867334064) estimates that uv accounts for roughly half of reported CI downloads from PyPI, and roughly 65-75% for `boto3`. I ran the comparison across a few different workloads: | Workload | PR | Packages | Cache: keep / prune / prune-ci | Warm restore+sync: keep / prune / prune-ci | Downloads: prune / prune-ci | |---|---:|---:|---:|---:|---:| | Tiny | [#1](https://github.com/astral-sh/setup-uv-benchmarks/pull/1) | 19 | 6 / 6 / 2 MB | 0.3-0.4 / 0.3 / 0.4-0.5 s | 0 / 2 | | Web | [#2](https://github.com/astral-sh/setup-uv-benchmarks/pull/2) | 65 | 43 / 43 / 7 MB | 0.6-1.0 / 0.5-0.6 / 1.5-1.7 s | 0 / 6 | | Scientific | [#3](https://github.com/astral-sh/setup-uv-benchmarks/pull/3) | 118 | 586 / 586 / 8 MB | 8.2-16.0 / 7.0-8.2 / 8.9-12.1 s | 0 / 19 | | PySpark | [#4](https://github.com/astral-sh/setup-uv-benchmarks/pull/4) | 19 | 1820 / 1820 / 436 MB | 9.9-21.1 / 10.5-11.0 / 5.0-7.0 s | 0 / 4 | | CPU PyTorch | [#5](https://github.com/astral-sh/setup-uv-benchmarks/pull/5) | 14 | 182 / 182 / 1 MB | 3.0-6.0 / 3.6-4.0 / 5.7-6.4 s | 0 / 6 | | CPU-PyTorch ML | [#6](https://github.com/astral-sh/setup-uv-benchmarks/pull/6) | 137 | 346 / 346 / 10 MB | 7.4-18.0 / 8.8-8.9 / 9.7-11.9 s | 0 / 20 | | CUDA PyTorch | [#7](https://github.com/astral-sh/setup-uv-benchmarks/pull/7) | 201 | 2316 / 2315 / 16 MB | 30.2-67.9 / 31.0-63.6 / 33.3-36.7 s | 0 / 40 | The CUDA workload intentionally reproduces the original `torch==2.1.1` example. Keeping wheels again produces a ~2.3 GB Actions cache. Across nine warm runs, restoring that cache ranged from slightly faster than re-downloading to roughly twice as slow; pruning consistently re-downloaded 40 distributions in ~33-37 seconds ([original runs](https://github.com/astral-sh/setup-uv-benchmarks/actions/runs/29750292738), [additional runs](https://github.com/astral-sh/setup-uv-benchmarks/actions/runs/29761705492)). I also tried running `uv cache prune --force` without `--ci` across every workload, to see if it provided a useful middle ground. It did not meaningfully reduce any of the caches: plain prune took 11-21 ms and left the extracted cache and file count unchanged, including PySpark. On these fresh caches, there are no dangling entries to remove; without `--ci`, the pre-built wheels and unpacked source/build artifacts are retained. The per-workload runs are linked in the table above. So the original motivation still holds for very large CUDA or source-heavy workloads, but it is not representative of the common case. For smaller workloads, keeping pre-built wheels is generally faster and avoids repeated PyPI traffic. This changes the default accordingly, while retaining `prune-cache: true` as an opt-in for workloads where the smaller cache is worthwhile. Closes https://github.com/astral-sh/setup-uv/issues/745.	2026-07-20 20:25:19 +02:00
Kevin StillhammerandGitHub	71966eff34	chore(deps): roll up Dependabot updates (#962) ... ## Summary - update all CodeQL actions from 4.36.2 to 4.37.0 - update `smol-toml` from 1.6.1 to 1.7.0 - update `@types/node` from 25.5.0 to 26.0.1 - update `@vercel/ncc` from 0.44.0 to 0.44.1 - regenerate bundled action artifacts Supersedes #950, #951, #952, #957, #958, and #959. The updates from #905 and #907 are already present on `main`. Refs: pi-session 019f796d-a374-7a76-a8e4-1699b89ec8e6	2026-07-19 10:28:45 +02:00
Chenxin ZhongandGitHub	f12b1f0a84	fix: fall back to distribution ID when os-release has no version field (#961) ... ## Summary `getLinuxOSNameVersion()` throws `Failed to determine Linux distribution. Could not read /etc/os-release or /usr/lib/os-release` on distributions whose os-release is readable but contains **no version field at all** — no `VERSION_ID`, no `VERSION_CODENAME`, no `BUILD_ID`. The error message is misleading in that case, and the action fails even though the distribution is perfectly identifiable. Void Linux is such a distribution. Its os-release is: ```sh $ cat /etc/os-release NAME="Void" ID="void" PRETTY_NAME="Void Linux" HOME_URL="https://voidlinux.org/" DOCUMENTATION_URL="https://docs.voidlinux.org/" LOGO="void-logo" ANSI_COLOR="0;38;2;71;128;97" DISTRIB_ID="void" ``` Unlike Arch (fixed by #912 via `BUILD_ID`) and debian:unstable (fixed via `VERSION_CODENAME`, #773), Void ships only `ID`, so both existing fallbacks miss it. This breaks any workflow using `container: ghcr.io/void-linux/void-glibc-full` with caching enabled — e.g. SageMath's CI started failing after bumping to v8: https://github.com/sagemath/sage/actions/runs/29456228986/job/87489892141 (worked around downstream in https://github.com/sagemath/sage/pull/42547 by injecting a fake `BUILD_ID` into the container's os-release). This PR adds a last-resort fallback: if `ID` is present but no version field is, return the plain `ID` (`void`), following the same reasoning as #912 — a stable cache key for a rolling release is better than crashing. Distributions with a version field are unaffected, and files without even an `ID` still raise the existing error.	2026-07-19 10:04:14 +02:00
3 people	ecd24dd710	chore: update known checksums for 0.11.29 (#960) ... chore: update known checksums for 0.11.29 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-16 10:58:57 +02:00
3 people	6a19136684	docs: update version references to v8.3.2 (#949) ... Update `uses: astral-sh/setup-uv@...` references in documentation to `11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2`. Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-08 13:14:13 +02:00
Kevin StillhammerandGitHub	11f9893b08	chore: roll up Dependabot updates (#948) ... ## Summary - roll up remaining open Dependabot updates for zizmor-action, @actions/cache, @biomejs/biome, and @vercel/ncc - update Biome schema and migrate recommended rules to the new preset field - regenerate dist bundles ## Validation - npm run check - npm run all Refs: pi-session 019f4055-b39c-778f-9d9f-092115939c33 v8.3.2	2026-07-08 11:05:26 +02:00
3 people	f798556032	docs: update version references to v8.3.1 (#946) ... Update `uses: astral-sh/setup-uv@...` references in documentation to `f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1`. Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-08 11:01:39 +02:00
3 people	e80544d808	chore: update known checksums for 0.11.28 (#947) ... chore: update known checksums for 0.11.28 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-08 08:04:53 +02:00
Kevin StillhammerandGitHub	f98e069381	Change update-docs PR labels from 'update-docs' to 'documentation' (#945) v8.3.1	2026-07-07 10:10:29 +02:00
3 people	cd462639a9	chore: update known checksums for 0.11.27 (#944) ... chore: update known checksums for 0.11.27 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-07 10:07:28 +02:00
3 people	11245c7e12	docs: update version references to v8.3.0 (#939) ... Update `uses: astral-sh/setup-uv@...` references in documentation to `d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0`. Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-05 11:20:13 +02:00
Kevin StillhammerandGitHub	d31148d669	Strip environment markers from detected uv dependency pins (#938) ... ## Summary - strip PEP 508 environment markers before extracting uv versions from dependency entries - cover dependency-group pins with and without whitespace before the marker - cover requirements-style pins with markers Fixes #920 ## Validation - npm ci --ignore-scripts - npm run all Refs: pi-session 019f316a-4108-7975-892f-ee5bf8abc7c3 v8.3.0	2026-07-05 10:47:17 +02:00
Kevin StillhammerandGitHub	17c398959b	Fix cache keys for Python version ranges (#937) ... ## Summary - URL-encode the Python version component before adding it to the cache key - URL-encode the user-provided cache suffix for the same reason - Add cache key tests for Python ranges, comma-containing suffixes, and unchanged simple inputs Fixes #914 Refs: pi-session 019f3164-85e7-7817-bffd-501d89b3a1fd ## Tests - npm run all	2026-07-05 10:46:44 +02:00
Kevin StillhammerandGitHub	3cc3c11fdf	chore(deps): roll up Dependabot updates (#936) ... ## Summary - Roll up open Dependabot npm and GitHub Actions updates - Update Biome schema to 2.4.16 - Regenerate bundled dist artifacts ## Validation - npm run all Refs: pi-session 019f3160-c4af-7606-b4be-648e0abff131	2026-07-05 10:34:07 +02:00
3 people	9225f843d7	chore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (#924) ... Bumps [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) from 7.3.1 to 7.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/release-drafter/release-drafter/releases">release-drafter/release-drafter's releases</a>.</em></p> <blockquote> <h2>v7.4.0</h2> <h1>What's Changed</h1> <h2>New</h2> <ul> <li>feat: unify category config around change classification (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1558">#1558</a>) <a href="https://github.com/cchanche"><code>@​cchanche</code></a></li> </ul> <h2>Maintenance</h2> <ul> <li>chore: update generated GraphQL types (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1629">#1629</a>) @<a href="https://github.com/apps/github-actions">github-actions[bot]</a></li> </ul> <h2>Documentation</h2> <ul> <li>docs: document github enterprise server support (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1627">#1627</a>) <a href="https://github.com/cchanche"><code>@​cchanche</code></a></li> </ul> <h2>Dependency Updates</h2> <ul> <li>build(deps-dev): bump vite from 8.0.13 to 8.0.16 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1634">#1634</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li> <li>build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1633">#1633</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li> <li>build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1632">#1632</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/release-drafter/release-drafter/compare/v7.3.1...v7.4.0">https://github.com/release-drafter/release-drafter/compare/v7.3.1...v7.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/release-drafter/release-drafter/commit/ed4bc48ec97379be2258e7b7ac2624a3e26ab809"><code>ed4bc48</code></a> chore: release v7.4.0</li> <li><a href="https://github.com/release-drafter/release-drafter/commit/0cc23b4878edb4924aae8c9ce2b39766cef66033"><code>0cc23b4</code></a> chore: update generated GraphQL types (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1629">#1629</a>)</li> <li><a href="https://github.com/release-drafter/release-drafter/commit/091a8c83088ce6d694d28ad1024aff1235127ee5"><code>091a8c8</code></a> build(deps-dev): bump vite from 8.0.13 to 8.0.16 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1634">#1634</a>)</li> <li><a href="https://github.com/release-drafter/release-drafter/commit/5e296d69e2244af2f2ddf8a50c4ae8313f5c210b"><code>5e296d6</code></a> build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1633">#1633</a>)</li> <li><a href="https://github.com/release-drafter/release-drafter/commit/86a47c9c8e6620a64feb3a362f3ffd9f6f808f6a"><code>86a47c9</code></a> build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1632">#1632</a>)</li> <li><a href="https://github.com/release-drafter/release-drafter/commit/bf75d71215edb5f1fff8c68bcfafc338f5e61056"><code>bf75d71</code></a> docs: document github enterprise server support (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1627">#1627</a>)</li> <li><a href="https://github.com/release-drafter/release-drafter/commit/cff71867e24849ec3c235e40896fe71a8a0895bf"><code>cff7186</code></a> feat: unify category config around change classification (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1558">#1558</a>)</li> <li>See full diff in <a href="https://github.com/release-drafter/release-drafter/compare/693d20e7c1ce1a81d3a41962f85914253b518449...ed4bc48ec97379be2258e7b7ac2624a3e26ab809">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-02 17:53:48 +02:00
3 people	fc16fa3bbf	chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 (#926) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-02 17:53:07 +02:00
Kevin StillhammerandGitHub	a1a7345c8e	ci: call docs update workflow from release (#933) ... - replace the docs update tag-push trigger with manual and reusable workflow entrypoints - call the docs update reusable workflow after publishing a release - keep manual docs updates available by selecting the latest semver tag Refs: pi-session 019f2352-565c-7f60-b96b-f2546fb1690f	2026-07-02 17:48:02 +02:00
Kevin TurciosandGitHub	a5e9cbfd5f	docs: update version references to v8.2.0 (#932) ... ## Summary - update README and docs `uses: astral-sh/setup-uv@...` examples to the v8.2.0 commit SHA - replace stale `v8.1.0` comments with `v8.2.0` Fixes #931 ## Validation - npm ci --ignore-scripts - npm run all	2026-07-02 16:55:59 +02:00
3 people	c5680ec91f	chore: update known checksums for 0.11.26 (#930) ... chore: update known checksums for 0.11.26 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-07-01 07:53:57 +02:00
Zsolt DollensteinandGitHub	c86fe4ef1f	Add a threat model for setup-uv (#923) ... This adds a threat model for `setup-uv` so security scanners can use it as a baseline in terms of what's in-, and out of scope. The TM covers credential recipients, executable and cache boundaries, and release authority. It treats checkout-selected interpreters, paths, virtual environments, symlinks, and helpers as delegated project authority unless they override an explicit workflow choice or cross an independent cache, runner, remote, or publication boundary.	2026-06-27 21:01:45 +02:00
3 people	224c887d48	chore: update known checksums for 0.11.25 (#929) ... chore: update known checksums for 0.11.25 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-06-27 09:33:56 +02:00
3 people	b173788282	chore: update known checksums for 0.11.24 (#925) ... chore: update known checksums for 0.11.24 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-06-24 09:18:23 +02:00
3 people	e53da17296	chore: update known checksums for 0.11.23 (#922) ... chore: update known checksums for 0.11.23 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-06-23 08:54:47 +02:00
3 people	a9b33f0240	chore: update known checksums for 0.11.22 (#921) ... chore: update known checksums for 0.11.22 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-06-19 08:02:13 +02:00
somazandGitHub	3faa3174e6	feat: support uv.lock as a version-file source (#918) ... Adds `uv.lock` as a supported `version-file` source. When `uv` is locked as a dependency in `uv.lock`, the action now installs the exact pinned version, closing the gap reported in #682. This is useful for deterministic CI: the same uv version is used until the lockfile is updated, which avoids "CI worked yesterday, fails today" drift and reduces supply-chain exposure from auto-installing the latest release. The implementation mirrors the existing `version-file` parsers — a new `uv.lock` entry in the parser registry reads the `[[package]]` whose `name = "uv"` and returns its locked `version`. Scoped to explicit `version-file: uv.lock`; workspace auto-detection is left as a possible follow-up to avoid precedence ambiguity with `uv.toml` / `pyproject.toml`. Validation (local, Node 23; dist build is esbuild-deterministic): - `npm run all` → build clean, biome clean, package clean, jest 77/77 - New tests: 3 unit (`uv-lock-file.test.ts`) + 1 integration — exact pin resolves through the full pipeline (`uv.lock` → `0.8.17`) - dist rebuilt + committed (single bundle, no spurious churn) related: #682	2026-06-19 07:08:57 +02:00
3 people	ca5ddd015e	chore: update known checksums for 0.11.21 (#917) ... chore: update known checksums for 0.11.21 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-06-12 07:54:16 +02:00
3 people	e2f6a928de	chore: update known checksums for 0.11.20 (#915) ... chore: update known checksums for 0.11.20 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-06-11 08:28:31 +02:00
Hans GaiserandGitHub	ed73b5df24	fix: use BUILD_ID as backup for determining os version (#912) ... On Arch Linux based runners, the setup fails with because `/etc/os-release` does not contain `VERSION_ID` or `VERSION_CODENAME`. It does contain a `BUILD_ID` which is set to `rolling`: ```sh $ cat /etc/os-release NAME="Arch Linux" PRETTY_NAME="Arch Linux" ID=arch BUILD_ID=rolling ANSI_COLOR="38;2;23;147;209" HOME_URL="https://archlinux.org/" DOCUMENTATION_URL="https://wiki.archlinux.org/" SUPPORT_URL="https://bbs.archlinux.org/" BUG_REPORT_URL="https://gitlab.archlinux.org/groups/archlinux/-/issues" PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/" LOGO=archlinux-logo ``` This PR makes `getLinuxOSNameVersion` return `arch-rolling`. There is no update from arch that would change the returned value, so the same cache will always be used. Is this an issue? I'm not sure. At least it's better than crashing because `os-release` does not contain the expected values :).	2026-06-09 13:12:37 +02:00
3 people	21d5da3bc3	chore: update known checksums for 0.11.19 (#909) ... chore: update known checksums for 0.11.19 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-06-04 07:53:58 +02:00
Kevin StillhammerandGitHub	fac544c07d	chore(deps): roll up dependabot updates (#903) ... Rolls up the current open Dependabot npm updates: - #848 esbuild from 0.27.5 to 0.28.0 - #847 undici from 8.0.0 to 8.3.0 - #846 ts-jest from 29.4.9 to 29.4.11 - #841 @biomejs/biome from 2.4.10 to 2.4.15, including the matching biome.json schema URL update Validation: - npm run all v8.2.0	2026-06-03 10:21:55 +02:00
Kevin StillhammerandGitHub	7390f777b0	docs: update dependabot rollup biome guidance (#902) ... Updates the dependabot-pr-rollup skill to document that @biomejs/biome dependency updates must also update the matching schema URL version in biome.json.	2026-06-03 09:50:08 +02:00
Kevin StillhammerandGitHub	363c64a728	chore(deps): roll up dependabot updates (#901) ... Rolls up the current open Dependabot npm updates: - #848 esbuild from 0.27.4 to 0.27.5 - #847 undici from 7.24.2 to 8.0.0 - #846 ts-jest from 29.4.6 to 29.4.9 - #841 @biomejs/biome from 2.4.7 to 2.4.10, including the matching biome.json schema URL update - #834 smol-toml from 1.6.0 to 1.6.1 Validation: - npm run all	2026-06-03 09:49:40 +02:00