chore(deps): update github-actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	major	v5 → v6
actions/checkout	action	major	v6 → v7
astral-sh/setup-uv	action	major	v8.1.0 → v10.0.0

---

Release Notes

actions/cache (actions/cache)

v6.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in #​1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

• Update packages, migrate to ESM by @​Samirat in #​1760

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

astral-sh/setup-uv (astral-sh/setup-uv)

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in #​984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @​eifinger (#​992)

🐛 Bug fixes

• Reject paths in .tool-versions @​eifinger (#​1007)

🚀 Enhancements

• Read Python version from .tool-versions @​eifinger (#​996)
• Add latest-known version selector @​eifinger (#​993)

🧰 Maintenance

• Require pull requests for Dependabot rollups @​eifinger (#​1005)
• ci: pin Alpine container image @​eifinger (#​995)
• chore: update known checksums for 0.12.3 @​github-actions[bot] (#​991)
• chore: update known checksums for 0.12.2 @​github-actions[bot] (#​985)
• chore: update known checksums for 0.12.1 @​github-actions[bot] (#​982)
• chore: update known checksums for 0.12.0 @​github-actions[bot] (#​981)
• chore: update known checksums for 0.11.31/0.11.32 @​github-actions[bot] (#​972)

📚 Documentation

• docs: update version references to v9.0.0 @​github-actions[bot] (#​971)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1013)
• chore(deps): roll up Dependabot updates @​eifinger (#​1004)
• chore(deps): roll up Dependabot updates @​eifinger (#​994)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @​dependabot[bot] (#​976)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @​dependabot[bot] (#​980)

v9.0.0

Compare Source

v8.3.2

Compare Source

v8.3.1

Compare Source

v8.3.0

Compare Source

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Compare Source

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

• fix: report unexpected cache save failures @​eifinger (#​896)
• fix: report unexpected setup failures @​eifinger (#​895)
• fix: add timeout to fetch to prevent silent hangs @​eifinger-bot (#​883)
• Limit GitHub tokens to github.com download URLs @​zsol (#​878)
• increase libuv-workaround timeout to 100ms @​eifinger (#​880)

🚀 Enhancements

• Add quiet input to suppress info-level log output @​eifinger (#​898)
• feat: add download-from-astral-mirror input @​eifinger (#​897)

🧰 Maintenance

• docs: update dependabot rollup biome guidance @​eifinger (#​902)
• chore: update known checksums for 0.11.18 @​github-actions[bot] (#​899)
• chore: update known checksums for 0.11.17 @​github-actions[bot] (#​892)
• chore: update known checksums for 0.11.16 @​github-actions[bot] (#​889)
• chore: update known checksums for 0.11.15 @​github-actions[bot] (#​885)
• chore: update known checksums for 0.11.14 @​github-actions[bot] (#​879)
• chore: update known checksums for 0.11.13 @​github-actions[bot] (#​877)
• chore: update known checksums for 0.11.12 @​github-actions[bot] (#​876)
• chore: update known checksums for 0.11.11 @​github-actions[bot] (#​873)
• chore: update known checksums for 0.11.9/0.11.10 @​github-actions[bot] (#​871)
• chore: update known checksums for 0.11.8 @​github-actions[bot] (#​867)
• Bump setup-uv references to v8.1.0 SHA in docs @​eifinger (#​862)
• Add update-docs.yml workflow @​eifinger (#​861)

⬆️ Dependency updates

• chore(deps): roll up dependabot updates @​eifinger (#​903)
• chore(deps): roll up dependabot updates @​eifinger (#​901)
• chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 @​dependabot[bot] (#​900)
• chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 @​dependabot[bot] (#​842)
• chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 @​dependabot[bot] (#​893)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 @​dependabot[bot] (#​891)
• chore(deps): bump release-drafter/release-drafter from 7.2.0 to 7.3.0 @​dependabot[bot] (#​884)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 @​dependabot[bot] (#​888)
• chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 @​dependabot[bot] (#​881)
• chore(deps): bump github/codeql-action from 4.32.2 to 4.35.3 @​dependabot[bot] (#​875)
• chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 @​dependabot[bot] (#​866)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 @​dependabot[bot] (#​864)
• chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 @​dependabot[bot] (#​863)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.