Skip to content

Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 in the actions-deps group - #770

Merged
ptr727-codegen[bot] merged 1 commit into
mainfrom
dependabot/github_actions/main/actions-deps-fa3bf1173d
Aug 16, 2026
Merged

Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 in the actions-deps group#770
ptr727-codegen[bot] merged 1 commit into
mainfrom
dependabot/github_actions/main/actions-deps-fa3bf1173d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions-deps group with 1 update: astral-sh/setup-uv.

Updates astral-sh/setup-uv from 8.1.0 to 10.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 in the actions-deps group
9849fba 
Bumps the actions-deps group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `astral-sh/setup-uv` from 8.1.0 to 10.0.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...ae62891)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 16, 2026
@ptr727-codegen
ptr727-codegen Bot enabled auto-merge August 16, 2026 21:08
@ptr727-codegen
ptr727-codegen Bot merged commit 5b8e39b into main Aug 16, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/main/actions-deps-fa3bf1173d branch August 16, 2026 21:09
@ptr727 ptr727 mentioned this pull request Aug 16, 2026
Merged
ptr727 added a commit that referenced this pull request Aug 16, 2026
@ptr727
Promote develop to main With the Release Task Scope Fix (#774)
0b07a59 
Promote `develop` to `main`, carrying two changes:

- #772 Move the Release Task's Job Scopes to the Caller:
`build-release-task.yml` declares no job-level `permissions:` on
`build-nuget` or `github-release`, since a called job's block is
validated against the caller's grant before its `if:` and failed the
hub's own release at startup (run 31972504539 on `82fecef`). The caller
grants what its enabled paths write with.
- #771 Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 (Dependabot,
auto-merged to `develop` by the App through the hub-hosted merge-bot
task, run 31972622149, the same bump #770 merged to `main` through it,
run 31972611554, so both live proofs of the stage-0 tracker are in).

The release dispatched after this merge is the live proof of the scope
fix: the hub's `publish` job grants `contents: write` and `actions:
write`, every target is disabled, and `github-release` must run and
create the tag.
@ptr727 ptr727 mentioned this pull request Aug 16, 2026
Merged
ptr727 added a commit that referenced this pull request Aug 16, 2026
@ptr727
Record 2.0.352 in the Reusable-Workflow Rollout and Add Its Catalog S…
76f15b3 
…nippets (#775)

Release `2.0.352` (`main` `0b07a59d7c65d07d8df275a96deaf2e06cbefd51`) is
the
first tag carrying every hub-hosted reusable workflow task, produced by
[the publish-release
run](https://github.com/ptr727/ProjectTemplate/actions/runs/31974067182)
after promotion #774. In that run `build-release-task.yml` ran with
every
target disabled and its `github-release` job succeeded while all five
build
jobs skipped, proving the `github-release` skip fix (#762) and the
caller-granted scopes (#772). The earlier release attempt on `82fecef`

([run](https://github.com/ptr727/ProjectTemplate/actions/runs/31972504539))
ended in `startup_failure` because `build-nuget`/`github-release`
declared
job-level permissions; #772 fixed it.

## docs/reusable-workflows.md "Rollout"

- Ticks the two stage-0 merge-bot proof items: Dependabot PR #771 merged
to
  `develop` with `--squash` through `merge-bot-task.yml`

([run](https://github.com/ptr727/ProjectTemplate/actions/runs/31972622149)),
  and Dependabot PR #770 merged to `main` with `--merge`

([run](https://github.com/ptr727/ProjectTemplate/actions/runs/31972611554)).
- Ticks "Promoted and released" in stages 2, 3, 4, and 5 with `2.0.352`
on
  `0b07a59d` and #774, and stage 4 also notes the first attempt's
  `startup_failure` and its #772 fix.
- Leaves every adoption and pilot checkbox untouched.
- Does **not** tick either stage's "Catalog snippets ... pinned to that
release" item, since neither stage's full set of snippets is complete
this
  time: stage 2's release-with-smoke shape still calls its own repo's
`build-release-task.yml` by `./` path rather than the hub's, and stage
5's
  `deploy-site.yml`, `publish-docker-readme-task.yml`, and
  `check-upstream-version-task.yml` each stay open for reasons the doc
  itself already states (no manifest-wide snippet by design, or a job
  embedded in a larger stub rather than a standalone caller). Both items
  gain an inline note identifying which of their snippets this PR adds.

## New catalog snippets

Three of the five/six candidate files, each pinned
`0b07a59d7c65d07d8df275a96deaf2e06cbefd51 # 2.0.352` and byte-identical
to
its doc stub block apart from the pin (and, where the doc's own comment
wrapping does not survive an actual YAML file's comment-wrap rule, a
reworded comment kept in sync on both sides):

- `catalog/snippets/workflows/test-pull-request.yml` (the no-build gate
  shape from "Adopting the Gates")
- `catalog/snippets/workflows/publish-release.yml` (the release-repo
shape
  from "Adopting the Release Chain")
- `catalog/snippets/workflows/run-periodic-codegen-pull-request.yml`
(the
  codegen stub, which the doc already says keeps today's per-repo shape)

Skipped, with the doc updated to say why:

- `test-pull-request-smoke.yml` - the doc's smoke stub still calls the
caller's own `./.github/workflows/build-release-task.yml` by local path,
  never the hub's `build-release-task.yml` directly, so it does not meet
  the "calls the hub task" condition.
- `deploy-site.yml` - the doc's own "Deploy-site" paragraph states it
  "has no manifest-wide catalog snippet either," the same reason
`get-version-task.yml`/`publish-plan-task.yml` have none: each site's
own
  shape varies too much around the shared `deploy` job.
- `check-upstream-version.yml` - the doc gives only the
`check-upstream-version:`
job body, not a complete top-level trigger/concurrency shape, and unlike
the codegen stub there is no doc statement that a uniform shape exists
to
  copy.

`catalog/snippets/workflows/README.md` gained rows for the three new
snippets and an updated intro paragraph explaining the partial rollout.

## TODO.md

Added one **Settled** line under "Host the type-specific tasks" naming
`2.0.352` as the release that makes stages 2-5 adoptable and the run
that
proved the release chain, and noting #769 as the one open follow-up from
the promotion review.

## reports/workflow-reuse.md

Regenerated with `python3 spec/workflow_reuse.py --report` against the
live
fleet at hub `63d244b` (this branch's base). The numbers move against
the
last committed report only because the live fleet moved since then, not
because of anything in this PR.

## Gates run locally

`spec/validate.py`, `python3 -m unittest discover -s scripts/tests` (686
tests), `spec/audit.py --selftest`, `spec/workflow_reuse.py --selftest`,
`scripts/repo_gate.py` (sha-pin resolved against GitHub),
`scripts/build_dist.py --check`,
`scripts/prose_lint.py` (all nine checks), `ruff check`/`ruff format
--check`,
`mypy`, and the Docker `actionlint`, `markdownlint-cli2`, and
`editorconfig-checker` linters (only `.ruff_cache` noise there).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants