From 70fe04b2b7434b6b184522ba211938611db1c7b6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 18:16:04 +0000 Subject: [PATCH 1/2] ci: bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions group Bumps the actions group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 9.0.0 to 10.0.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/v9.0.0...20cfd1bf945f4377ade1205e4dbc17946fc9a30d) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 98fb3338..dfe9ac43 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -122,7 +122,7 @@ jobs: - name: Install uv for immutable lock check if: needs.scope.outputs.code_changed == 'true' - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: version: "0.12.5" enable-cache: false From 92336dcc1d6edd64555c78a05be350fbf619bc85 Mon Sep 17 00:00:00 2001 From: Richard Abrich Date: Wed, 2 Sep 2026 11:22:53 -0400 Subject: [PATCH 2/2] ci: move the setup-uv pin contract and public artifact inventory to v10.0.1 The lint job contract test pins the setup-uv action SHA, and the wheel gate pins the reviewed hash of ci.yml. Both follow the action bump. Co-Authored-By: Claude Fable 5.1 --- public-artifacts.json | 2 +- tests/test_ci_workflow_contract.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/public-artifacts.json b/public-artifacts.json index 15d104b5..1b3f9597 100644 --- a/public-artifacts.json +++ b/public-artifacts.json @@ -93,7 +93,7 @@ }, { "path": ".github/workflows/ci.yml", - "sha256": "f2b9a6cb8fced9af463bf3cd50cedaeafcb928baaeb4fc0bc757a3864298a20f" + "sha256": "705e4a6a5e3d6169cdc5f5c43b5beae4d158a956010b1d8c2c86c8489dc0e169" }, { "path": ".github/workflows/citrix-workspace-standin.yml", diff --git a/tests/test_ci_workflow_contract.py b/tests/test_ci_workflow_contract.py index 8408a1f7..b62ba4fe 100644 --- a/tests/test_ci_workflow_contract.py +++ b/tests/test_ci_workflow_contract.py @@ -23,7 +23,7 @@ def test_lint_job_rejects_a_stale_dependency_lock() -> None: lint_job = workflow[lint_start:compatibility_start] assert ( - "uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9" in lint_job + "uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d" in lint_job ) assert 'version: "0.12.5"' in lint_job assert "run: uv lock --locked" in lint_job