Update GitHub Actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/setup-uv	action	major	v9.0.0 → v10.0.1
dawidd6/action-download-artifact	action	major	v21 → v23
j178/prek-action	action	major	v2 → v3.0.0

---

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#​1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @​github-actions[bot] (#​1017)

📚 Documentation

• docs: update version references to v10.0.0 @​github-actions[bot] (#​1014)

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in #​984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @​eifinger (#​992)

🐛 Bug fixes

• Reject paths in .tool-versions @​eifinger (#​1007)

🚀 Enhancements

• Read Python version from .tool-versions @​eifinger (#​996)
• Add latest-known version selector @​eifinger (#​993)

🧰 Maintenance

• Require pull requests for Dependabot rollups @​eifinger (#​1005)
• ci: pin Alpine container image @​eifinger (#​995)
• chore: update known checksums for 0.12.3 @​github-actions[bot] (#​991)
• chore: update known checksums for 0.12.2 @​github-actions[bot] (#​985)
• chore: update known checksums for 0.12.1 @​github-actions[bot] (#​982)
• chore: update known checksums for 0.12.0 @​github-actions[bot] (#​981)
• chore: update known checksums for 0.11.31/0.11.32 @​github-actions[bot] (#​972)

📚 Documentation

• docs: update version references to v9.0.0 @​github-actions[bot] (#​971)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1013)
• chore(deps): roll up Dependabot updates @​eifinger (#​1004)
• chore(deps): roll up Dependabot updates @​eifinger (#​994)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @​dependabot[bot] (#​976)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @​dependabot[bot] (#​980)

dawidd6/action-download-artifact (dawidd6/action-download-artifact)

v23

Compare Source

Info

This release is rather big. Not gonna lie to you, I've used LLMs to get there. I can't vouch for all the changes but CI confirms there should be no regressions. Please report any issues you encounter with this release. You can always revert to previous working one.

What's Changed

• joint fixes and improvements by @​dawidd6 in #​417
• build(deps): update brace-expansion by @​dawidd6 in #​418
• Harden upload workflow token scope with explicit GITHUB_TOKEN permissions by @​dawidd6 with @​Copilot in #​419
• fix: stream GHES artifact downloads by @​dawidd6 in #​420
• chore: simplify action implementation by @​dawidd6 in #​421
• chore: remove redundant action code by @​dawidd6 in #​422
• chore: simplify artifact filtering by @​dawidd6 in #​423

Full Changelog: dawidd6/action-download-artifact@v22...v23

v22

Compare Source

What's Changed

• build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by @​dependabot[bot] in #​406
• build(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​407
• build(deps): bump undici from 6.24.0 to 6.27.0 by @​dependabot[bot] in #​408
• build(deps): bump filesize from 11.0.17 to 11.0.18 by @​dependabot[bot] in #​409
• build(deps): bump filesize from 11.0.18 to 11.0.19 by @​dependabot[bot] in #​410
• build(deps): bump adm-zip from 0.5.17 to 0.5.18 by @​dependabot[bot] in #​411
• build(deps): bump filesize from 11.0.19 to 11.0.22 by @​dependabot[bot] in #​412
• build(deps): bump adm-zip from 0.5.18 to 0.6.0 by @​dependabot[bot] in #​414
• build(deps): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in #​415
• node_modules: update by @​dawidd6 in #​416
• Continue downloading after expired artifacts in non-fatal modes by @​oiahoon in #​413

New Contributors

• @​oiahoon made their first contribution in #​413

Full Changelog: dawidd6/action-download-artifact@v21...v22

j178/prek-action (j178/prek-action)

v3.0.0

Compare Source

prek-action releases are now immutable

Starting with v3, prek-action will no longer publish moving major or minor tags. References such as j178/prek-action@v3 and j178/prek-action@v3.0 will not be available.

Moving tags can be retargeted after users adopt them, creating unnecessary supply-chain risk. Use an exact release tag or, for stronger protection, pin the action to a full commit SHA.

[!TIP]
Use an exact release tag:

- uses: j178/prek-action@v3.0.0

Or, even better, pin the full commit SHA:

- uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0

What's Changed

• Fix cache key hashing by @​akx in #​153
• Drop floating version tag support by @​j178 in #​170
• Update known versions for prek 0.4.11 by @​j178 in #​169

Full Changelog: j178/prek-action@v2...v3.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.23%. Comparing base (cb623e0) to head (b686e1a).

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.