[github-actions]

Automated update of the SHA-pinned actions under project_name/.github/workflows/, which Dependabot cannot reach. Each pin is moved to the latest release and its # vX.Y.Z comment is rewritten to match.

Review the diff as you would a Dependabot PR: check the release notes below for anything behavioural, especially on major bumps.

Release notes

astral-sh/setup-uv v10.0.1 → v10.1.0

Compare v10.0.1...v10.1.0

v10.1.0

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686 for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @mj0nez (#1037)
• Use JSON + a typed wrapper instead of TS codegen @woodruffw (#1025)

🚀 Enhancements

• Expose a Python "identity" output @woodruffw (#1036)
• Verify downloads with astral-sh/versions checksums @zaniebot (#1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @github-actions[bot] (#1041)
• chore: update known checksums for 0.12.10/0.12.11 @github-actions[bot] (#1038)
• chore: update known checksums for 0.12.9 @github-actions[bot] (#1035)
• chore: update known checksums for 0.12.7/0.12.8 @github-actions[bot] (#1031)
• chore: update known checksums for 0.12.6 @github-actions[bot] (#1030)
• chore: update known checksums for 0.12.5 @github-actions[bot] (#1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @woodruffw (#1024)
• Pin one-shot tools @woodruffw (#1022)
• ci: remove obsolete direct push attempts @eifinger (#1019)

📚 Documentation

• docs: update version references to v10.0.1 @github-actions[bot] (#1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @eifinger (#1043)
• Harden npm install defaults @zaniebot (#1026)
• Add dependency cooldowns @woodruffw (#1021)

codecov/codecov-action v7.0.0 → v7.1.1

Compare v7.0.0...v7.1.1

v7.1.1

What's Changed

• chore(release): 7.1.1 by @thomasrockhu-codecov in https://redirect.github.com/codecov/codecov-action/pull/1973

Full Changelog: https://redirect.github.com/codecov/codecov-action/compare/v7.1.0...v7.1.1

v7.1.0

What's Changed

• chore(release): 7.1.0 by @thomasrockhu-codecov in https://redirect.github.com/codecov/codecov-action/pull/1971

Full Changelog: https://redirect.github.com/codecov/codecov-action/compare/v7.0.0...v7.1.0

re-actors/alls-green v1.2.2 → v1.3.0

Compare v1.2.2...v1.3.0

v1.3.0

Sometimes these releases take time. Cherish it.

🛡️ What's Unmessed

[!caution]

There was a small command injection risk in prior versions. I consider it very low because of the specifics of the action use case. But still, do upgrade, okay?

@illera88💰 fixed this template injection bug in #37 by passing inputs via env vars.

See GHSA-gj76-h2ch-5m76 for more detail that was first reported by @Corbynx010💰 while I was at EuroPython.

✨ What's Improved

I did a bunch of internal refactoring including hints of what @max-sixty💰 reported in #23. And took a small patch of @krokofant💰 in. This involved a bunch of preparatory infra work with testing infra.

One notable improvement is that now thanks to @tomasr8💰's and @hugovk💰's UX suggestions in #31, the gate status output is colored in the console and should be easier to scan in the log output per line. They entries now have leading ✓/❌ acceptance marks and the actual incoming job outcomes are labeled with 🟢/🔴/⬜/⚫.

🐛 What's Fixed

The job-statuses summary could print "Some of the allowed to be skipped jobs did not succeed" based on the wrong condition — it's now tied to allowed-skips as intended, not allowed-failures.

💪 New Contributors

• @Corbynx010💰 lurked in GHSA-gj76-h2ch-5m76 before everyone else 😉
• @illera88 made their first contribution in #37 and GHSA-gj76-h2ch-5m76
• @krokofant and @max-sixty first contributed in #23
• @tomasr8 and @hugovk in #31

🪞 Full Diff: https://redirect.github.com/re-actors/alls-green/compare/v1.2.2...v1.3.0

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook