Skip to content

chore(deps): update github actions (major) - #4

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions
Open

chore(deps): update github actions (major)#4
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions

Conversation

@renovate

@renovate renovate Bot commented Mar 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v6 → v7
actions/download-artifact action major v7 → v8
actions/upload-artifact action major v6 → v7
astral-sh/setup-uv action major v7 → v10.2.0
codecov/codecov-action action major v5 → v7
softprops/action-gh-release action major v2 → v3

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

actions/download-artifact (actions/download-artifact)

v8.0.1

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@​v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @​actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

astral-sh/setup-uv (astral-sh/setup-uv)

v10.2.0

Compare Source

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v9.0.0

Compare Source

v8.3.2

Compare Source

v8.3.1

Compare Source

v8.3.0

Compare Source

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Compare Source

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates

v8.1.0: 🌈 New input no-project

Compare Source

Changes

This add the a new boolean input no-project.
It only makes sense to use in combination with activate-environment: true and will append --no project to the uv venv call. This is for example useful if you have a pyproject.toml file with parts unparseable by uv

🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.0.0: 🌈 Immutable releases and secure tags

Compare Source

This is the first immutable release of setup-uv 🥳

All future releases are also immutable, if you want to know more about what this means checkout the docs.

This release also has two breaking changes

New format for manifest-file

The previously deprecated way of defining a custom version manifest to control which uv versions are available and where to download them from got removed. The functionality is still there but you have to use the new format.

No more major and minor tags

To increase security even more we will stop publishing minor tags. You won't be able to use @v8 or @v8.0 any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to tj-actions.

[!TIP]
Use the immutable tag as a version astral-sh/setup-uv@v8.0.0
Or even better the githash astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57

🚨 Breaking changes
🧰 Maintenance
codecov/codecov-action (codecov/codecov-action)

v7.1.1

Compare Source

v7.1.0

Compare Source

v7.0.0

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

Compare Source

What's Changed

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️
What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

softprops/action-gh-release (softprops/action-gh-release)

v3.0.3

Compare Source

3.0.3 is a maintenance release with updated dependencies. It also safely
classifies malformed GitHub API errors to avoid secondary failures (#​822).

What's Changed

Bug fixes 🐛
Other Changes 🔄
  • dependency updates

v3.0.2

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #​795, #​438, and #​803. The upload transport hardening covers the
historical failure reported in #​790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #​786 and does not
claim a reproducible release-creation fix.

What's Changed
Exciting New Features 🎉
Bug fixes 🐛
Other Changes 🔄

v3.0.1

Compare Source

3.0.1

  • maintenance release with updated dependencies

v3.0.0

Compare Source

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24.
Use v3 on GitHub-hosted runners and self-hosted fleets that already support the
Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on
v2.6.2.

What's Changed

Other Changes 🔄
  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Mar 2, 2026
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from 8a3d63d to dfa4e00 Compare April 1, 2026 13:28
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 8645abe to 411b8db Compare April 16, 2026 18:59
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 411b8db to 1146c32 Compare April 21, 2026 21:11
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from 4596166 to e83a8fb Compare June 7, 2026 05:12
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from e83a8fb to ef572e4 Compare June 18, 2026 19:53
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 3 times, most recently from d8f7ff1 to b427a1a Compare July 8, 2026 12:41
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from b427a1a to 88cc829 Compare July 21, 2026 16:02
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 88cc829 to 36abc56 Compare August 1, 2026 16:31
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from ff4ffe5 to 6c400fb Compare August 14, 2026 09:15
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 6c400fb to cf03230 Compare September 1, 2026 18:09
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from cf03230 to f4923dc Compare September 10, 2026 23:16
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from f4923dc to 35e0374 Compare September 21, 2026 21:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants