chore(deps): update github actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6.0.2 → v7.0.1
actions/setup-go	action	major	v6.4.0 → v7.0.0
astral-sh/setup-uv	action	major	v8.1.0 → v10.1.0

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-go (actions/setup-go)

v7.0.0

Compare Source

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​771

New Contributors

• @​philip-gai made their first contribution in #​771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

Compare Source

astral-sh/setup-uv (astral-sh/setup-uv)

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#​1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#​1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#​1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#​1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @​github-actions[bot] (#​1041)
• chore: update known checksums for 0.12.10/0.12.11 @​github-actions[bot] (#​1038)
• chore: update known checksums for 0.12.9 @​github-actions[bot] (#​1035)
• chore: update known checksums for 0.12.7/0.12.8 @​github-actions[bot] (#​1031)
• chore: update known checksums for 0.12.6 @​github-actions[bot] (#​1030)
• chore: update known checksums for 0.12.5 @​github-actions[bot] (#​1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @​woodruffw (#​1024)
• Pin one-shot tools @​woodruffw (#​1022)
• ci: remove obsolete direct push attempts @​eifinger (#​1019)

📚 Documentation

• docs: update version references to v10.0.1 @​github-actions[bot] (#​1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @​eifinger (#​1043)
• Harden npm install defaults @​zaniebot (#​1026)
• Add dependency cooldowns @​woodruffw (#​1021)

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#​1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @​github-actions[bot] (#​1017)

📚 Documentation

• docs: update version references to v10.0.0 @​github-actions[bot] (#​1014)

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in #​984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @​eifinger (#​992)

🐛 Bug fixes

• Reject paths in .tool-versions @​eifinger (#​1007)

🚀 Enhancements

• Read Python version from .tool-versions @​eifinger (#​996)
• Add latest-known version selector @​eifinger (#​993)

🧰 Maintenance

• Require pull requests for Dependabot rollups @​eifinger (#​1005)
• ci: pin Alpine container image @​eifinger (#​995)
• chore: update known checksums for 0.12.3 @​github-actions[bot] (#​991)
• chore: update known checksums for 0.12.2 @​github-actions[bot] (#​985)
• chore: update known checksums for 0.12.1 @​github-actions[bot] (#​982)
• chore: update known checksums for 0.12.0 @​github-actions[bot] (#​981)
• chore: update known checksums for 0.11.31/0.11.32 @​github-actions[bot] (#​972)

📚 Documentation

• docs: update version references to v9.0.0 @​github-actions[bot] (#​971)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1013)
• chore(deps): roll up Dependabot updates @​eifinger (#​1004)
• chore(deps): roll up Dependabot updates @​eifinger (#​994)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @​dependabot[bot] (#​976)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @​dependabot[bot] (#​980)

v9.0.0

Compare Source

v8.3.2

Compare Source

v8.3.1

Compare Source

v8.3.0

Compare Source

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Compare Source

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

• fix: report unexpected cache save failures @​eifinger (#​896)
• fix: report unexpected setup failures @​eifinger (#​895)
• fix: add timeout to fetch to prevent silent hangs @​eifinger-bot (#​883)
• Limit GitHub tokens to github.com download URLs @​zsol (#​878)
• increase libuv-workaround timeout to 100ms @​eifinger (#​880)

🚀 Enhancements

• Add quiet input to suppress info-level log output @​eifinger (#​898)
• feat: add download-from-astral-mirror input @​eifinger (#​897)

🧰 Maintenance

• docs: update dependabot rollup biome guidance @​eifinger (#​902)
• chore: update known checksums for 0.11.18 @​github-actions[bot] (#​899)
• chore: update known checksums for 0.11.17 @​github-actions[bot] (#​892)
• chore: update known checksums for 0.11.16 @​github-actions[bot] (#​889)
• chore: update known checksums for 0.11.15 @​github-actions[bot] (#​885)
• chore: update known checksums for 0.11.14 @​github-actions[bot] (#​879)
• chore: update known checksums for 0.11.13 @​github-actions[bot] (#​877)
• chore: update known checksums for 0.11.12 @​github-actions[bot] (#​876)
• chore: update known checksums for 0.11.11 @​github-actions[bot] (#​873)
• chore: update known checksums for 0.11.9/0.11.10 @​github-actions[bot] (#​871)
• chore: update known checksums for 0.11.8 @​github-actions[bot] (#​867)
• Bump setup-uv references to v8.1.0 SHA in docs @​eifinger (#​862)
• Add update-docs.yml workflow @​eifinger (#​861)

⬆️ Dependency updates

• chore(deps): roll up dependabot updates @​eifinger (#​903)
• chore(deps): roll up dependabot updates @​eifinger (#​901)
• chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 @​dependabot[bot] (#​900)
• chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 @​dependabot[bot] (#​842)
• chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 @​dependabot[bot] (#​893)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 @​dependabot[bot] (#​891)
• chore(deps): bump release-drafter/release-drafter from 7.2.0 to 7.3.0 @​dependabot[bot] (#​884)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 @​dependabot[bot] (#​888)
• chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 @​dependabot[bot] (#​881)
• chore(deps): bump github/codeql-action from 4.32.2 to 4.35.3 @​dependabot[bot] (#​875)
• chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 @​dependabot[bot] (#​866)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 @​dependabot[bot] (#​864)
• chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 @​dependabot[bot] (#​863)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.