Skip to content

deps(actions): bump astral-sh/setup-uv from 6 to 7 #1599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

deps(actions): bump astral-sh/setup-uv from 6 to 7 #1599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,13 +29,13 @@ jobs:
- name: Set up uv
id: setup-uv-primary
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
- name: Retry uv setup after transient download failure
if: steps.setup-uv-primary.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -84,13 +84,13 @@ jobs:
- name: Set up uv
id: setup-uv-primary
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
- name: Retry uv setup after transient download failure
if: steps.setup-uv-primary.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -141,7 +141,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -180,7 +180,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ matrix.python-version }}
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -210,7 +210,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: ${{ matrix.python-version }}
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -253,7 +253,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -309,13 +309,13 @@ jobs:
- name: Set up uv
id: setup-uv-primary
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
- name: Retry uv setup after transient download failure
if: steps.setup-uv-primary.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand All @@ -337,13 +337,13 @@ jobs:
- name: Set up uv
id: setup-uv-primary
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
- name: Retry uv setup after transient download failure
if: steps.setup-uv-primary.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -391,13 +391,13 @@ jobs:
- name: Set up uv
id: setup-uv-primary
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
- name: Retry uv setup after transient download failure
if: steps.setup-uv-primary.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependabot-uv-lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
python-version: "3.12"

- name: Set up uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/desktop-core-alpha-feed.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,7 @@ jobs:
python-version: "3.12"
- name: Set up uv
if: steps.release.outputs.available == 'true'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/harness-smoke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
enable-cache: true
- name: Prepare Guard environment
Expand Down Expand Up @@ -58,7 +58,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
enable-cache: true
- name: Prepare Guard environment
Expand Down Expand Up @@ -87,7 +87,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
enable-cache: true
- name: Prepare Guard environment
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/mdm-artifacts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v6
- uses: astral-sh/setup-uv@v7

@kilo-code-bot kilo-code-bot Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SUGGESTION: Inconsistent pinning — this file uses the floating tag @v7 while every other workflow pins astral-sh/setup-uv to a full commit SHA (37802adc94f370d6bfd71619e3f0bf239e1f3b78).

Floating major-version tags are mutable and weaken supply-chain integrity guarantees. For consistency and reproducibility, pin to the same full commit SHA used elsewhere.

Suggested change
- uses: astral-sh/setup-uv@v7
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

- run: uv sync --frozen --extra dev --python ${{ matrix.python }}
- run: uv run --no-sync pytest tests/test_guard_mdm_*.py --tb=short
- run: uv run --no-sync basedpyright --level error
Expand All @@ -40,7 +40,7 @@ jobs:
HOL_GUARD_BUILD_ID: ${{ inputs.build_id }}
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v6
- uses: astral-sh/setup-uv@v7
- run: uv sync --frozen --extra mdm-build --python 3.12
- shell: bash
run: echo "HOL_GUARD_VERSION=$(uv run python -c 'from codex_plugin_scanner.version import __version__; print(__version__)')" >> "$GITHUB_ENV"
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -435,7 +435,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
enable-cache: true
Expand Down Expand Up @@ -653,7 +653,7 @@ jobs:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
with:
ref: ${{ needs.build.outputs.source_sha }}
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
Expand Down Expand Up @@ -754,7 +754,7 @@ jobs:
with:
fetch-depth: 0
ref: ${{ needs.build.outputs.source_sha }}
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
Expand Down Expand Up @@ -871,7 +871,7 @@ jobs:
with:
fetch-depth: 0
ref: ${{ needs.build.outputs.source_sha }}
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
Expand Down Expand Up @@ -961,7 +961,7 @@ jobs:
with:
fetch-depth: 0
ref: ${{ needs.build.outputs.source_sha }}
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
Expand Down Expand Up @@ -1312,7 +1312,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
- name: Sync locked release tooling
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/security-gates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
with:
version: "0.9.26"
- name: Install policy dependencies
Expand All @@ -41,7 +41,7 @@ jobs:
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
with:
python-version: "3.12"
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
- name: Run Semgrep
run: uvx --from semgrep semgrep --config p/owasp-top-ten --error src/codex_plugin_scanner/guard

Expand Down
Loading