ci(deps): bump astral-sh/setup-uv from 8.1.0 to 9.0.0

[dependabot]

Bumps astral-sh/setup-uv from 8.1.0 to 9.0.0.

Release notes

Sourced from astral-sh/setup-uv's releases.

v9.0.0 🌈 Change prune-cache default to false

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

• Change prune-cache default to false @​charliermarsh (#967)

🐛 Bug fixes

• fix: fall back to distribution ID when os-release has no version field @​cxzhong (#961)

🚀 Enhancements

• Speed up version client by partial response reads @​eifinger (#807)

🧰 Maintenance

• chore: update known checksums for 0.11.30 @github-actions[bot] (#968)
• chore: update known checksums for 0.11.29 @github-actions[bot] (#960)

📚 Documentation

• docs: update version references to v8.3.2 @github-actions[bot] (#949)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#970)
• chore(deps): roll up Dependabot updates @​eifinger (#962)

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details. In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

... (truncated)

Commits

• c771a70 chore(deps): roll up Dependabot updates (#970)
• 2f537ca chore: update known checksums for 0.11.30 (#968)
• 2269552 Speed up version client by partial response reads (#807)
• 47a7f4f Change prune-cache default to false (#967)
• 71966ef chore(deps): roll up Dependabot updates (#962)
• f12b1f0 fix: fall back to distribution ID when os-release has no version field (#961)
• ecd24dd chore: update known checksums for 0.11.29 (#960)
• 6a19136 docs: update version references to v8.3.2 (#949)
• 11f9893 chore: roll up Dependabot updates (#948)
• f798556 docs: update version references to v8.3.1 (#946)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[helebest]

Automated Dependabot review — Step 1 (code review) ✅

Scope: astral-sh/setup-uv 8.1.0 → 9.0.0, SHA-pinned to c771a70e… (# v9.0.0), applied consistently across all 5 Install uv steps in .github/workflows/release.yml and .github/workflows/reusable-ci.yml.

Consistency — PR description matches the diff; version comment correctly updated to # v9.0.0; the pinned SHA matches the upstream v9.0.0 tag.
Correctness / effectiveness — the workflows call the action with only enable-cache: true; no removed/renamed inputs are used, so the interface is unchanged.
Security — SHA-pinned (immutable ref). Reviewed the v9.0.0 release notes: the sole breaking change is prune-cache default flipping true → false (issue #967), which affects only GitHub Actions cache size/cost, not build correctness. Other changes are a Linux distro-detection bugfix and a version-resolution speedup. No security advisories.
Test coverage — workflow-file-only change with no application code; the effective regression test is CI itself exercising setup-uv@v9 across the matrix (Steps 2/3 below).

Note: with pruning now off, cache entries for this repo may grow over time. Optional follow-up if cache costs matter: set prune-cache: true explicitly. Not blocking.

Proceeding to watch CI to green before merging.

---

Generated by Claude Code

[helebest]

Dependabot PR review — Step 1 (code review) ✅

Change: astral-sh/setup-uv 8.1.0 → 9.0.0 (pinned SHA 08807647… → c771a70…), applied to the Install uv step in .github/workflows/release.yml (×1) and .github/workflows/reusable-ci.yml (×4). Description matches the diff.

• Consistency: ✅ all 5 occurrences bumped to the same SHA/version; inline # v9.0.0 comments updated correctly.
• Correctness / breaking change: v9.0.0's only breaking change is switching the prune-cache default from true → false (astral-sh/setup-uv#967) to reduce load on PyPI. All jobs here use enable-cache: true and none set prune-cache, so the effect is larger Actions caches (possible marginal cache-storage cost), not a functional/behavioral change to builds. No action inputs used here were removed or renamed.
• Security: major-version bump of a pinned-SHA CI action; changelog shows routine checksum/version-resolution updates, no advisories. Pin is intact.
• Effectiveness: achieves the intended uv toolchain-action update.
• Test coverage: CI-config-only change; exercised by the CI run on this PR itself (no unit tests apply).

No blocking issues. Proceeding to Step 2/3 — babysitting CI. All checks are green except lint-type-test (3.12) and (3.13), still in progress. Will merge (squash) once they finish green.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — Steps 2–4 ✅ merged

Step 2/3 — regression & CI: this is a workflow-file-only change, so the effective regression test is CI exercising setup-uv@v9 end-to-end. All 9 checks passed green:

• ci / lint-type-test (3.12) ✅ · ci / lint-type-test (3.13) ✅
• ci / Postgres contract tests ✅ · ci / Server e2e (serve-and-run) ✅
• ci / Wheel install smoke test ✅ · ci / Dockerfile DIKW_VERSION guard ✅
• Analyze Python (CodeQL) ✅ · CodeQL ✅ · codecov/patch ✅

mergeable_state was clean at merge time.

Step 4 — merge: squash-merged to main as 5eded7d.

Review + verification + merge complete. This is an automated action.

---

Generated by Claude Code

[helebest]

Steps 2–4 — CI verification & merge ✅

All 9 checks completed green: lint-type-test (3.12) & (3.13), Postgres contract tests, Server e2e (serve-and-run), Wheel install smoke test, Dockerfile DIKW_VERSION guard, Analyze Python, CodeQL, codecov/patch.

No regressions from the setup-uv 8.1.0 → 9.0.0 bump. The PR was squash-merged into main (by @helebest) once CI passed. Closing out the review — no further action needed. ✅

---

Generated by Claude Code