[PsiACE]

Purpose

Pin the public composite Action's setup-uv v10.2.0 dependency to its full commit SHA so downstream workflows can comply with SHA-pinning policies. Supports agentclientprotocol/python-sdk#179.

Validation

• uv run ty check and uv run pre-commit run --all-files passed.
• Verified the SHA resolves from v10.2.0 and setup-uv is a Node action with no nested Action references.

AI assistance

Prepared and checked with Codex.

[github-actions]

No blocking findings.

The new pin matches the release it claims: refs/tags/v10.2.0 in astral-sh/setup-uv resolves to commit c18668ad3cf93ea998bef934396af7bb5c839dc7, and that commit's action.yml is a Node action (using: node24) with no nested uses: references. It is also the only dependency reference left in the composite action, so nothing inside action.yml keeps a floating ref. Caller behavior is unchanged, and the # v10.2.0 comment keeps Dependabot able to update the pin.

Non-blocking: released tags (0.3.0, 0.3.1) still ship the floating astral-sh/setup-uv@v10.2.0, so consumers who pin a release tag only become SHA-pinning compliant after the next release.

[github-actions]

No blocking findings.

The pin resolves to the release it claims and executes: astral-sh/setup-uv refs/tags/v10.2.0 is commit c18668ad3cf93ea998bef934396af7bb5c839dc7, that commit ships its bundled dist/setup/index.cjs as a node24 action with no nested uses: steps to pin further, and this run's Landing feedback job is currently running the composite action (uses: ./) from the merge checkout with the pinned setup-uv step already past. action.yml now contains no floating dependency refs.