mirror of
https://github.com/astral-sh/setup-uv.git
synced 2026-09-21 08:43:57 +00:00
c18668ad3cf93ea998bef934396af7bb5c839dc7
2
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
    
|
cd13f92170 |
Verify downloads with astral-sh/versions checksums (#1033)
test / test-default-version (ubuntu-latest) (push) Failing after 4s
test / test-uv-no-modify-path (push) Failing after 4s
test / test-specific-version (map[expected-version:0.1.0 resolution-strategy:lowest version-input:>=0.1.0,<0.2]) (push) Failing after 3s
test / test-specific-version (map[expected-version:0.1.45 resolution-strategy:highest version-input:>=0.1,<0.2]) (push) Failing after 3s
test / test-specific-version (map[expected-version:0.3.0 version-input:0.3.0]) (push) Failing after 4s
test / test-specific-version (map[expected-version:0.3.2 version-input:0.3.2]) (push) Failing after 4s
test / test-uvx (push) Failing after 1s
test / test-latest-version (>=0.8) (push) Failing after 2s
test / test-specific-version (map[expected-version:0.3.5 version-input:0.3]) (push) Failing after 22s
test / test-version-file-version (map[expected-version:0.6.17 version-file:__tests__/fixtures/uv-in-requirements-txt-project/requirements.txt]) (push) Failing after 16s
test / test-from-working-directory-version (map[expected-version:0.5.15 working-directory:__tests__/fixtures/uv-toml-project]) (push) Failing after 17s
test / test-tool-versions-python-version (push) Failing after 16s
test / test-setup-cache-dependency-glob (push) Failing after 17s
test / test-restore-cache-requirements-txt (push) Skipped
test / test-restore-cache-dependency-glob (push) Skipped
test / test-restore-cache-save-cache-false (push) Skipped
test / test-no-python-version (push) Failing after 24s
test / test-custom-manifest-file (push) Failing after 25s
test / test-activate-environment-custom-path (ubuntu-latest) (push) Failing after 1s
test / test-checksum (map[checksum:4d9279ad5ca596b1e2d703901d508430eb07564dc4d8837de9e2fca9c90f8ecd os:ubuntu-latest]) (push) Failing after 18s
test / test-musl (push) Failing after 13s
test / test-specific-version (map[expected-version:0.4.25 resolution-strategy:lowest version-input:>=0.4.25,<0.5]) (push) Failing after 6s
test / test-with-explicit-token (push) Failing after 17s
test / test-malformed-pyproject-file-fallback (push) Failing after 17s
test / test-relative-path (push) Failing after 3s
test / test-setup-cache (true, ubuntu-latest) (push) Failing after 12s
test / test-cache-key-os-version (ubuntu-22.04, ubuntu-22.04) (push) Failing after 20s
test / test-tool-install (ubuntu-latest) (push) Failing after 2s
test / test-specific-version (map[expected-version:0.3.5 version-input:0.3.x]) (push) Failing after 9s
test / test-latest-version (latest) (push) Failing after 2s
test / test-activate-environment (ubuntu-latest) (push) Failing after 1s
test / test-activate-environment-no-project (push) Failing after 1s
test / test-specific-version (map[expected-version:0.4.25 resolution-strategy:lowest version-input:>=0.4.25]) (push) Failing after 12s
test / test-version-file-version (map[expected-version:0.5.15 version-file:__tests__/fixtures/.tool-versions]) (push) Failing after 16s
test / test-from-working-directory-version (map[expected-version:0.5.14 working-directory:__tests__/fixtures/pyproject-toml-project]) (push) Failing after 17s
test / test-specific-version (map[expected-version:0.4.30 version-input:>=0.4.25,<0.5]) (push) Failing after 20s
test / test-version-file-version (map[expected-version:0.8.3 version-file:__tests__/fixtures/uv-in-requirements-hash-txt-project/requirements.txt]) (push) Failing after 16s
test / test-python-version (ubuntu-latest) (push) Failing after 17s
test / test-debian-unstable (push) Failing after 15s
test / test-setup-cache (auto, ubuntu-latest) (push) Failing after 6s
test / test-setup-cache (false, ubuntu-latest) (push) Failing after 6s
test / test-cache-local (map[expected-cache-dir:/home/runner/work/_temp/setup-uv-cache os:ubuntu-latest]) (push) Failing after 5s
test / test-cache-local-cache-disabled (push) Failing after 4s
test / test-cache-local-cache-disabled-but-explicit-path (push) Failing after 4s
test / test-download-from-astral-mirror-false (push) Failing after 4s
test / test-absolute-path (push) Failing after 3s
test / test-setup-cache-requirements-txt (push) Failing after 17s
test / test-setup-cache-restore-cache-false (push) Failing after 18s
test / test-restore-cache-restore-cache-false (push) Skipped
test / test-cache-dir-from-file (push) Failing after 22s
test / test-cache-python-missing-managed-install-dir (push) Failing after 22s
test / test-restore-python-installs (push) Skipped
test / test-cache-prune-force (push) Failing after 22s
test / validate-typings (push) Successful in 44s
test / test-python-install-dir (map[expected-python-dir:/home/runner/work/_temp/uv-python-dir os:ubuntu-latest]) (push) Failing after 5s
test / test-setup-cache-save-cache-false (push) Failing after 17s
test / test-cache-python-installs (push) Failing after 21s
CodeQL / Analyze (TypeScript) (push) Failing after 1m40s
test / test-workflow-run (push) Failing after 35s
test / lint (push) Failing after 1m21s
test / test-default-version (macos-14) (push) Canceled after 0s
test / test-default-version (macos-latest) (push) Canceled after 0s
test / test-default-version (windows-latest) (push) Canceled after 0s
test / test-checksum (map[checksum:a70cbfbf3bb5c08b2f84963b4f12c94e08fbb2468ba418a3bfe1066fbe9e7218 os:macos-latest]) (push) Canceled after 0s
test / test-tool-install (macos-14) (push) Canceled after 0s
test / test-tool-install (macos-latest) (push) Canceled after 0s
test / test-tool-install (windows-latest) (push) Canceled after 0s
test / test-python-version (macos-latest) (push) Canceled after 0s
test / test-python-version (windows-latest) (push) Canceled after 0s
test / test-activate-environment (macos-latest) (push) Canceled after 0s
test / test-activate-environment (windows-latest) (push) Canceled after 0s
test / test-activate-environment-custom-path (macos-latest) (push) Canceled after 0s
test / test-activate-environment-custom-path (windows-latest) (push) Canceled after 0s
test / test-cache-key-os-version (macos-14, macos-14) (push) Canceled after 0s
test / test-cache-key-os-version (macos-15, macos-15) (push) Canceled after 0s
test / test-cache-key-os-version (windows-2025, windows-2025) (push) Canceled after 0s
test / test-setup-cache (true, windows-latest) (push) Canceled after 0s
test / test-cache-key-os-version (ubuntu-24.04, ubuntu-24.04) (push) Canceled after 0s
test / test-cache-key-os-version (windows-2022, windows-2022) (push) Canceled after 0s
test / test-setup-cache (auto, windows-latest) (push) Canceled after 0s
test / test-setup-cache (false, windows-latest) (push) Canceled after 0s
test / test-restore-cache (auto, ubuntu-latest) (push) Canceled after 0s
test / test-restore-cache (auto, windows-latest) (push) Canceled after 0s
test / test-restore-cache (false, ubuntu-latest) (push) Canceled after 0s
test / test-restore-cache (false, windows-latest) (push) Canceled after 0s
test / test-restore-cache (true, ubuntu-latest) (push) Canceled after 0s
test / test-restore-cache (true, windows-latest) (push) Canceled after 0s
test / test-cache-local (map[expected-cache-dir:D:\a\_temp\setup-uv-cache os:windows-latest]) (push) Canceled after 0s
test / test-python-install-dir (map[expected-python-dir:D:\a\_temp\uv-python-dir os:windows-latest]) (push) Canceled after 0s
test / all-tests-passed (push) Canceled after 0s
Release Drafter / ✏️ Draft release (push) Canceled after 0s
`setup-uv` currently ignores the `sha256` supplied by the default `astral-sh/versions` manifest when a selected artifact is newer than its bundled checksum table, allowing that download to proceed without validation. Use the manifest checksum as a fallback after explicit and bundled checksums, and reject manifest entries that do not provide one. This preserves the stronger pinned hashes for known releases while verifying newer releases without requiring an action update. Part of #1032. --------- Co-authored-by: Zanie Blue <contact@zanie.dev> Co-authored-by: William Woodruff <william@yossarian.net> Co-authored-by: Kevin Stillhammer <kevin.stillhammer@gmail.com> |
||
|
19b4d1e990 |
Harden npm install defaults (#1026)
test / test-uvx (push) Failing after 4s
test / test-uv-no-modify-path (push) Failing after 12s
test / test-latest-version (>=0.8) (push) Failing after 4s
test / test-specific-version (map[expected-version:0.3.5 version-input:0.3]) (push) Failing after 42s
test / test-specific-version (map[expected-version:0.4.25 resolution-strategy:lowest version-input:>=0.4.25,<0.5]) (push) Failing after 30s
test / test-with-explicit-token (push) Failing after 13s
test / test-activate-environment (ubuntu-latest) (push) Failing after 4s
test / test-cache-key-os-version (ubuntu-22.04, ubuntu-22.04) (push) Failing after 4s
test / test-setup-cache (auto, ubuntu-latest) (push) Failing after 7s
test / test-default-version (ubuntu-latest) (push) Failing after 17s
test / test-setup-cache-save-cache-false (push) Failing after 25s
test / test-python-install-dir (map[expected-python-dir:/home/runner/work/_temp/uv-python-dir os:ubuntu-latest]) (push) Failing after 5s
test / validate-typings (push) Successful in 31s
test / test-specific-version (map[expected-version:0.1.0 resolution-strategy:lowest version-input:>=0.1.0,<0.2]) (push) Failing after 10s
test / test-specific-version (map[expected-version:0.1.45 resolution-strategy:highest version-input:>=0.1,<0.2]) (push) Failing after 14s
test / test-specific-version (map[expected-version:0.3.0 version-input:0.3.0]) (push) Failing after 25s
test / test-specific-version (map[expected-version:0.3.2 version-input:0.3.2]) (push) Failing after 42s
test / test-specific-version (map[expected-version:0.3.5 version-input:0.3.x]) (push) Failing after 42s
test / test-latest-version (latest) (push) Failing after 4s
test / test-specific-version (map[expected-version:0.4.25 resolution-strategy:lowest version-input:>=0.4.25]) (push) Failing after 14s
test / test-specific-version (map[expected-version:0.4.30 version-input:>=0.4.25,<0.5]) (push) Failing after 17s
test / test-from-working-directory-version (map[expected-version:0.5.14 working-directory:__tests__/fixtures/pyproject-toml-project]) (push) Failing after 18s
test / test-from-working-directory-version (map[expected-version:0.5.15 working-directory:__tests__/fixtures/uv-toml-project]) (push) Failing after 17s
test / test-version-file-version (map[expected-version:0.8.3 version-file:__tests__/fixtures/uv-in-requirements-hash-txt-project/requirements.txt]) (push) Failing after 21s
test / test-version-file-version (map[expected-version:0.6.17 version-file:__tests__/fixtures/uv-in-requirements-txt-project/requirements.txt]) (push) Failing after 23s
test / test-checksum (map[checksum:4d9279ad5ca596b1e2d703901d508430eb07564dc4d8837de9e2fca9c90f8ecd os:ubuntu-latest]) (push) Failing after 17s
test / test-tool-versions-python-version (push) Failing after 20s
test / test-malformed-pyproject-file-fallback (push) Failing after 19s
test / test-python-version (ubuntu-latest) (push) Failing after 7s
test / test-activate-environment-no-project (push) Failing after 4s
test / test-tool-install (ubuntu-latest) (push) Failing after 4s
test / test-version-file-version (map[expected-version:0.5.15 version-file:__tests__/fixtures/.tool-versions]) (push) Failing after 24s
test / test-activate-environment-custom-path (ubuntu-latest) (push) Failing after 4s
test / test-cache-local-cache-disabled (push) Failing after 4s
test / test-cache-local-cache-disabled-but-explicit-path (push) Failing after 4s
test / test-custom-manifest-file (push) Failing after 11s
test / test-restore-cache-save-cache-false (push) Skipped
test / test-setup-cache-restore-cache-false (push) Failing after 24s
test / test-restore-cache-restore-cache-false (push) Skipped
CodeQL / Analyze (TypeScript) (push) Failing after 2m22s
test / test-cache-python-installs (push) Failing after 16s
test / test-cache-local (map[expected-cache-dir:/home/runner/work/_temp/setup-uv-cache os:ubuntu-latest]) (push) Failing after 4s
test / test-download-from-astral-mirror-false (push) Failing after 5s
test / test-setup-cache (false, ubuntu-latest) (push) Failing after 23s
test / test-debian-unstable (push) Failing after 26s
test / test-setup-cache-dependency-glob (push) Failing after 24s
test / test-relative-path (push) Failing after 4s
test / test-absolute-path (push) Failing after 5s
test / test-no-python-version (push) Failing after 15s
test / test-setup-cache (true, ubuntu-latest) (push) Failing after 23s
test / test-musl (push) Failing after 25s
test / lint (push) Failing after 2m9s
test / test-setup-cache-requirements-txt (push) Failing after 24s
test / test-restore-cache-requirements-txt (push) Skipped
test / test-restore-cache-dependency-glob (push) Skipped
test / test-cache-prune-force (push) Failing after 7s
test / test-cache-dir-from-file (push) Failing after 16s
test / test-cache-python-missing-managed-install-dir (push) Failing after 16s
test / test-restore-python-installs (push) Skipped
test / test-workflow-run (push) Failing after 21s
Release Drafter / ✏️ Draft release (push) Canceled after 0s
test / test-default-version (macos-14) (push) Canceled after 0s
test / test-default-version (macos-latest) (push) Canceled after 0s
test / test-default-version (windows-latest) (push) Canceled after 0s
test / test-checksum (map[checksum:a70cbfbf3bb5c08b2f84963b4f12c94e08fbb2468ba418a3bfe1066fbe9e7218 os:macos-latest]) (push) Canceled after 0s
test / test-tool-install (macos-14) (push) Canceled after 0s
test / test-tool-install (macos-latest) (push) Canceled after 0s
test / test-tool-install (windows-latest) (push) Canceled after 0s
test / test-python-version (macos-latest) (push) Canceled after 0s
test / test-python-version (windows-latest) (push) Canceled after 0s
test / test-cache-key-os-version (macos-15, macos-15) (push) Canceled after 0s
test / test-cache-key-os-version (ubuntu-24.04, ubuntu-24.04) (push) Canceled after 0s
test / test-cache-key-os-version (windows-2022, windows-2022) (push) Canceled after 0s
test / test-cache-key-os-version (windows-2025, windows-2025) (push) Canceled after 0s
test / test-setup-cache (auto, windows-latest) (push) Canceled after 0s
test / test-setup-cache (false, windows-latest) (push) Canceled after 0s
test / test-setup-cache (true, windows-latest) (push) Canceled after 0s
test / test-cache-local (map[expected-cache-dir:D:\a\_temp\setup-uv-cache os:windows-latest]) (push) Canceled after 0s
test / test-python-install-dir (map[expected-python-dir:D:\a\_temp\uv-python-dir os:windows-latest]) (push) Canceled after 0s
test / test-restore-cache (auto, ubuntu-latest) (push) Canceled after 0s
test / test-restore-cache (auto, windows-latest) (push) Canceled after 0s
test / test-restore-cache (false, ubuntu-latest) (push) Canceled after 0s
test / test-restore-cache (false, windows-latest) (push) Canceled after 0s
test / test-activate-environment (macos-latest) (push) Canceled after 0s
test / test-activate-environment (windows-latest) (push) Canceled after 0s
test / test-activate-environment-custom-path (macos-latest) (push) Canceled after 0s
test / test-activate-environment-custom-path (windows-latest) (push) Canceled after 0s
test / test-cache-key-os-version (macos-14, macos-14) (push) Canceled after 0s
test / test-restore-cache (true, ubuntu-latest) (push) Canceled after 0s
test / test-restore-cache (true, windows-latest) (push) Canceled after 0s
test / all-tests-passed (push) Canceled after 0s
CI already disables npm lifecycle scripts, but ordinary installs from the repository still run them. Set `ignore-scripts = true` in `.npmrc` so developer and maintenance installs use the same default. Keep the existing seven-day `min-release-age` policy for new resolutions. Require `npm>=11.10.0` through `engines.npm` and `engine-strict`, while retaining `devEngines` for newer clients; older installers can otherwise ignore `devEngines` and the age setting. Pin the build and checksum workflows to Node.js `24.19.0` so their bundled `npm` supports the policy. Explicit project commands such as `npm run package` remain available. Related: astral-sh/ruff-action#401 applies the matching `npm` defaults, and astral-sh/ruff-action#411 adds the same legacy-aware version floor. astral-sh/ruff#27837 applies the install-script default to Ruff's JavaScript projects. astral-sh/setup-uv#1027 separately adds registry-signature and provenance verification. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com> |