This addresses all of zizmor's non-pedantic findings, and adds a
workflow to proactively flag any more that come in.
Key changes:
* I've hash-pinned all actions references. Dependabot will continue to
keep these updated and will update the hash comments as well.
* I've marked every `actions/checkout` with `persist-credentials: false`
except for one that actually needs persisted credentials (which I've
explicitly enabled with an explanatory comment)
* I've dropped some workflow-level permissions in favor of job-level
permissions that were already provisioned.
* I fixed two small template injections caused by expanding output
contexts. I think these were not exploitable in practice, but fixing
them is good for defense in depth (and makes spellcheck work nicely on
these steps).
---------
Signed-off-by: William Woodruff <william@astral.sh>
setup-uv gets confused when there are backslashes in `requirements.txt`.
This changes the regex to ignore backslashes.
---------
Co-authored-by: axm2 <>
This will spam the GitHub summary with warnings as soon as a new version
is released and no new setup-uv version containing this version in the
distributed manifest-file is released
Closes: #461
If a manifest-file is supplied the default value of the version input
(latest) will get the latest version available in the manifest. That
might not be the actual latest version available in the official uv
repo.
To support more users by default we should support popular dependency
file formats. A quick GitHub search shows ~40k uses of `constraint.txt`
and ~16k uses of `requirements.in`.
Closes: #261
venv activation was implicit when python-version was supplied. This now
only happens when activate-environment is true. working-directory
controls where we work and thus also where the .venv will be created
Closes: #351Closes: #271Closes: #251Closes: #211
Bumps
[@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache)
from 4.0.2 to 4.0.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md"><code>@actions/cache</code>'s
changelog</a>.</em></p>
<blockquote>
<h3>4.0.3</h3>
<ul>
<li>Added masking for Shared Access Signature (SAS) cache entry URLs <a
href="https://redirect.github.com/actions/toolkit/pull/1982">#1982</a></li>
<li>Improved debugging by logging both the cache version alongside the
keys requested when a cache restore fails <a
href="https://redirect.github.com/actions/toolkit/pull/1994">#1994</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/cache">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Default behavior of caching is "auto", meaning it's enabled on
github-hosted runners. This wasn't obvious at first, and I was wondering
why I was getting warnings about cache when I didn't even have it
enabled. Hopefully this small documentation update will save some
headaches (for those who read the docs at least 😉)
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.10 to 22.12.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.9 to 22.10.10.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.7 to 22.10.9.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@actions/tool-cache](https://github.com/actions/toolkit/tree/HEAD/packages/tool-cache)
from 2.0.1 to 2.0.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/tool-cache/RELEASES.md"><code>@actions/tool-cache</code>'s
changelog</a>.</em></p>
<blockquote>
<h3>2.0.2</h3>
<ul>
<li>Update <code>@actions/core</code> to v1.11.1 <a
href="https://redirect.github.com/actions/toolkit/pull/1872">#1872</a></li>
<li>Remove dependency on <code>uuid</code> package <a
href="https://redirect.github.com/actions/toolkit/pull/1824">#1824</a>,
<a
href="https://redirect.github.com/actions/toolkit/pull/1842">#1842</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/tool-cache">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.6 to 22.10.7.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.5 to 22.10.6.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1. If defined use version input
2. If defined use uv-file input
3. If defined use pyproject-file input
4. Search for required-version in uv.toml in repo root
5. Search for required-version in pyproject.toml in repo root
6. Use latest
Closes: #215
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.3 to 22.10.5.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.2 to 22.10.3.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This approach was copied from setup-rye but uv now has the capability to
determine if a cache version is compatible. By removing it we will less
frequently invalidate the cache and thus save bandwidth
Closes: #203
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.10.1 to 22.10.2.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.9.0 to 22.9.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache)
from 3.2.4 to 3.3.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md"><code>@actions/cache</code>'s
changelog</a>.</em></p>
<blockquote>
<h3>3.3.0</h3>
<ul>
<li>Update <code>@actions/core</code> to <code>1.11.1</code></li>
<li>Remove dependency on <code>uuid</code> package <a
href="https://redirect.github.com/actions/toolkit/pull/1824">#1824</a>,
<a
href="https://redirect.github.com/actions/toolkit/pull/1842">#1842</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/toolkit/commits/HEAD/packages/cache">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.8.6 to 22.9.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.9 to 22.8.6.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.8 to 22.7.9.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.7 to 22.7.8.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.6 to 22.7.7.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.5 to 22.7.6.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Related https://github.com/astral-sh/setup-uv/issues/106
We can see the differences `uv --version` in different platforms:
OSX: uv 0.4.20 (0e1b25a53 2024-10-08)\n
Linux: uv 0.4.20\n
In getVersion function we split the output by space and return the
second part.
This PR trims the version number to remove the line break.
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.4 to 22.7.5.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.3 to 22.7.4.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.7.0 to 22.7.3.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.6.1 to 22.7.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.5.5 to 22.6.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
We should aim for a solution with sane defaults that work as most users
would expect it.
The current default leads to a cache that is never invalidated and thus
never updated.
This also mirrors the default behaviors for setup-python which use
`**/requirements.txt`, `**/Pipfile.lock` or `**/poetry.lock`
Also make it clear that the uv cache on the filesystem can be uploaded to the GitHub Actions cache, but they are distinct things.
Also make it clear that the local cache path can be changed without using `enable-cache: true`
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.5.4 to 22.5.5.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Closes: #40
Because of build conflics (forgot to run `npm i` after pulling) I
deleted the `dist`folder to start fresh. Turns out that it still
contained the source maps from the very first commit. I removed the
argument to generate those a long time ago
Restoring an existing cache can be enabled or disabled with the `restore-cache` input.
By default, the cache will be restored.
```yaml
- name:Don't restore an existing cache
uses:astral-sh/setup-uv@v6
with:
enable-cache:true
restore-cache:false
```
#### Save cache
You can also disable saving the cache after the run with the `save-cache` input.
This can be useful to save cache storage when you know you will not use the cache of the run again.
By default, the cache will be saved.
```yaml
- name:Don't save the cache after the run
uses:astral-sh/setup-uv@v6
with:
enable-cache:true
save-cache:false
```
### Local cache path
This action controls where uv stores its cache on the runner's filesystem by setting `UV_CACHE_DIR`.
It defaults to `setup-uv-cache` in the `TMP` dir, `D:\a\_temp\uv-tool-dir` on Windows and
`/tmp/setup-uv-cache` on Linux/macOS. You can change the default by specifying the path with the
`cache-local-path` input.
```yaml
- name:Define a custom uv cache path
uses:eifinger/setup-uv@v1
uses:astral-sh/setup-uv@v6
with:
enable-cache:true
cache-local-path:'/path/to/cache'
cache-local-path:"/path/to/cache"
```
#### Cache dependency glob
### Disable cache pruning
If you want to control when the cache is invalidated you can specify a glob pattern with the `cache-dependency-glob` input.
The cache will be invalidated if any file matching the glob pattern changes.
The glob matches files relative to the repository root.
By default, the uv cache is pruned after every run, removing pre-built wheels, but retaining any
wheels that were built from source. On GitHub-hosted runners, it's typically faster to omit those
pre-built wheels from the cache (and instead re-download them from the registry on each run).
However, on self-hosted or local runners, preserving the cache may be more efficient. See
the [documentation](https://docs.astral.sh/uv/concepts/cache/#caching-in-continuous-integration) for
more information.
If you want to persist the entire cache across runs, disable cache pruning with the `prune-cache`
input.
```yaml
- name:Define a custom cache dependency glob
uses:eifinger/setup-uv@v1
- name:Don't prune the cache before saving it
uses:astral-sh/setup-uv@v6
with:
enable-cache:true
cache-dependency-glob:'uv.lock'
prune-cache:false
```
### Ignore nothing to cache
By default, the action will fail if caching is enabled but there is nothing to upload (the uv cache directory does not exist).
If you want to ignore this, set the `ignore-nothing-to-cache` input to `true`.
```yaml
- name:Define a custom cache dependency glob
uses:eifinger/setup-uv@v1
- name:Ignore nothing to cache
uses:astral-sh/setup-uv@v6
with:
enable-cache:true
cache-dependency-glob:'**requirements*.txt'
ignore-nothing-to-cache:true
```
### API rate limit
### Ignore empty workdir
To avoid hitting the error `API rate limit exceeded` you can supply a GitHub token with the `github-token` input.
By default, the action will warn if the workdir is empty, because this is usually the case when
`actions/checkout` is configured to run after `setup-uv`, which is not supported.
If you want to ignore this, set the `ignore-empty-workdir` input to `true`.
```yaml
- name:Install uv and supply a GitHub token
uses:eifinger/setup-uv@v1
- name:Ignore empty workdir
uses:astral-sh/setup-uv@v6
with:
github-token:${{ secrets.GITHUB_TOKEN }}
ignore-empty-workdir:true
```
### GitHub authentication token
This action uses the GitHub API to fetch the uv release artifacts. To avoid hitting the GitHub API
rate limit too quickly, an authentication token can be provided via the `github-token` input. By
default, the `GITHUB_TOKEN` secret is used, which is automatically provided by GitHub Actions.
If the default
[permissions for the GitHub token](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
are not sufficient, you can provide a custom GitHub token with the necessary permissions.
```yaml
- name:Install the latest version of uv with a custom GitHub token
uses:astral-sh/setup-uv@v6
with:
github-token:${{ secrets.CUSTOM_GITHUB_TOKEN }}
```
### UV_TOOL_DIR
On Windows `UV_TOOL_DIR` is set to `uv-tool-dir` in the `TMP` dir (e.g. `D:\a\_temp\uv-tool-dir`).
On GitHub hosted runners this is on the much faster `D:` drive.
On all other platforms the tool environments are placed in the
You can disable this by setting the `add-problem-matchers` input to `false`.
```yaml
- name:Install the latest version of uv without problem matchers
uses:astral-sh/setup-uv@v6
with:
add-problem-matchers:false
```
## How it works
This action downloads uv from the releases of the [uv repo](https://github.com/astral-sh/uv) and uses the [GitHub Actions Toolkit](https://github.com/actions/toolkit) to cache it as a tool to speed up consecutive runs on self-hosted runners.
This action downloads uv from the uv repo's official
[GitHub Releases](https://github.com/astral-sh/uv) and uses the
[GitHub Actions Toolkit](https://github.com/actions/toolkit) to cache it as a tool to speed up
consecutive runs on self-hosted runners.
The installed version of uv is then added to the runner path so other steps can just use it by calling `uv`.
The installed version of uv is then added to the runner PATH, enabling later steps to invoke it
by name (`uv`).
## FAQ
### Do I still need actions/setup-python when using this action?
### Do I still need `actions/setup-python` alongside `setup-uv`?
No! This action was modelled as a drop-in replacement for `actions/setup-python` when using uv.
With `setup-uv`, you can install a specific version of Python using `uv python install` rather than
relying on `actions/setup-python`.
A simple example workflow could look like this:
Using `actions/setup-python` can be faster, because GitHub caches the Python versions alongside the runner.
For example:
```yaml
- name:Checkout the repository
uses:actions/checkout@main
- name:Install the latest version of uv
uses:eifinger/setup-uv@v1
uses:astral-sh/setup-uv@v6
with:
enable-cache:true
- name:Sync dependencies
run:uv sync
- name:Test
run:uv run pytest
run:uv run --frozen pytest # Uses the Python version automatically installed by uv
each job will have different dependencies or dependency versions.
But if you do not add the resolution strategy as a [cache-suffix](#enable-caching),
they will have the same cache key.
This means the first job which starts uploading its cache will win and all other job will fail
uploading the cache,
because they try to upload with the same cache key.
You might see errors like
`Failed to save: Failed to CreateCacheEntry: Received non-retryable error: Failed request: (409) Conflict: cache entry with the same key, version, and scope already exists`
### Why do I see warnings like `No GitHub Actions cache found for key`
When a workflow runs for the first time on a branch and has a new cache key, because the
[cache-dependency-glob](#cache-dependency-glob) found changed files (changed dependencies),
the cache will not be found and the warning `No GitHub Actions cache found for key` will be printed.
While this might be irritating at first, it is expected behaviour and the cache will be created
and reused in later workflows.
The reason for the warning is, that we have to way to know if this is the first run of a new
cache key or the user accidentally misconfigured the [cache-dependency-glob](#cache-dependency-glob)
or [cache-suffix](#enable-caching) and the cache never gets used.
### Do I have to run `actions/checkout` before or after `setup-uv`?
Some workflows need uv but do not need to access the repository content.
But **if** you need to access the repository content, you have run `actions/checkout` before running `setup-uv`.
Running `actions/checkout` after `setup-uv`**is not supported**.
### Does `setup-uv` also install my project or its dependencies automatically?
No, `setup-uv` alone wont install any libraries from your `pyproject.toml` or `requirements.txt`, it only sets up `uv`.
You should run `uv sync` or `uv pip install .` separately, or use `uv run ...` to ensure necessary dependencies are installed.
### Why is a changed cache not detected and not the full cache uploaded?
When `setup-uv` starts it has to know whether it is better to download an existing cache
or start fresh and download every dependency again.
It does this by using a combination of hashes calculated on the contents of e.g. `uv.lock`.
By calculating these hashes and combining them in a key `setup-uv` can check
if an uploaded cache exists for this key.
If yes (e.g. contents of `uv.lock` did not change since last run) the dependencies in the cache
are up to date and the cache will be downloaded and used.
Details on determining which files will lead to different caches can be read under
[cache-dependency-glob](#cache-dependency-glob)
Some dependencies will never be uploaded to the cache and will be downloaded again on each run
as described in [disable-cache-pruning](#disable-cache-pruning)
## Acknowledgements
`setup-uv` was initially written and published by [Kevin Stillhammer](https://github.com/eifinger)
before moving under the official [Astral](https://github.com/astral-sh) GitHub organization. You can
support Kevin's work in open source on [Buy me a coffee](https://www.buymeacoffee.com/eifinger) or
(()=>{vare={650:e=>{varr=Object.prototype.toString;varn=typeofBuffer.alloc==="function"&&typeofBuffer.allocUnsafe==="function"&&typeofBuffer.from==="function";functionisArrayBuffer(e){returnr.call(e).slice(8,-1)==="ArrayBuffer"}functionfromArrayBuffer(e,r,t){r>>>=0;varo=e.byteLength-r;if(o<0){thrownewRangeError("'offset' is out of bounds")}if(t===undefined){t=o}else{t>>>=0;if(t>o){thrownewRangeError("'length' is out of bounds")}}returnn?Buffer.from(e.slice(r,r+t)):newBuffer(newUint8Array(e.slice(r,r+t)))}functionfromString(e,r){if(typeofr!=="string"||r===""){r="utf8"}if(!Buffer.isEncoding(r)){thrownewTypeError('"encoding" must be a valid string encoding')}returnn?Buffer.from(e,r):newBuffer(e,r)}functionbufferFrom(e,r,t){if(typeofe==="number"){thrownewTypeError('"value" argument must not be a number')}if(isArrayBuffer(e)){returnfromArrayBuffer(e,r,t)}if(typeofe==="string"){returnfromString(e,r)}returnn?Buffer.from(e):newBuffer(e)}e.exports=bufferFrom},274:(e,r,n)=>{vart=n(339);varo=Object.prototype.hasOwnProperty;vari=typeofMap!=="undefined";functionArraySet(){this._array=[];this._set=i?newMap:Object.create(null)}ArraySet.fromArray=functionArraySet_fromArray(e,r){varn=newArraySet;for(vart=0,o=e.length;t<o;t++){n.add(e[t],r)}returnn};ArraySet.prototype.size=functionArraySet_size(){returni?this._set.size:Object.getOwnPropertyNames(this._set).length};ArraySet.prototype.add=functionArraySet_add(e,r){varn=i?e:t.toSetString(e);vara=i?this.has(e):o.call(this._set,n);varu=this._array.length;if(!a||r){this._array.push(e)}if(!a){if(i){this._set.set(e,u)}else{this._set[n]=u}}};ArraySet.prototype.has=functionArraySet_has(e){if(i){returnthis._set.has(e)}else{varr=t.toSetString(e);returno.call(this._set,r)}};ArraySet.prototype.indexOf=functionArraySet_indexOf(e){if(i){varr=this._set.get(e);if(r>=0){returnr}}else{varn=t.toSetString(e);if(o.call(this._set,n)){returnthis._set[n]}}thrownewError('"'+e+'" is not in the set.')};ArraySet.prototype.at=functionArraySet_at(e){if(e>=0&&e<this._array.length){returnthis._array[e]}thrownewError("No element indexed by "+e)};ArraySet.prototype.toArray=functionArraySet_toArray(){returnthis._array.slice()};r.I=ArraySet},449:(e,r,n)=>{vart=n(190);varo=5;vari=1<<o;vara=i-1;varu=i;functiontoVLQSigned(e){returne<0?(-e<<1)+1:(e<<1)+0}functionfromVLQSigned(e){varr=(e&1)===1;varn=e>>1;returnr?-n:n}r.encode=functionbase64VLQ_encode(e){varr="";varn;vari=toVLQSigned(e);do{n=i&a;i>>>=o;if(i>0){n|=u}r+=t.encode(n)}while(i>0);returnr};r.decode=functionbase64VLQ_decode(e,r,n){vari=e.length;vars=0;varl=0;varc,p;do{if(r>=i){thrownewError("Expected more digits in base 64 VLQ value.")}p=t.decode(e.charCodeAt(r++));if(p===-1){thrownewError("Invalid base64 digit: "+e.charAt(r-1))}c=!!(p&u);p&=a;s=s+(p<<l);l+=o}while(c);n.value=fromVLQSigned(s);n.rest=r}},190:(e,r)=>{varn="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("");r.encode=function(e){if(0<=e&&e<n.length){returnn[e]}thrownewTypeError("Must be between 0 and 63: "+e)};r.decode=function(e){varr=65;varn=90;vart=97;varo=122;vari=48;vara=57;varu=43;vars=47;varl=26;varc=52;if(r<=e&&e<=n){returne-r}if(t<=e&&e<=o){returne-t+l}if(i<=e&&e<=a){returne-i+c}if(e==u){return62}if(e==s){return63}return-1}},345:(e,r)=>{r.GREATEST_LOWER_BOUND=1;r.LEAST_UPPER_BOUND=2;functionrecursiveSearch(e,n,t,o,i,a){varu=Math.floor((n-e)/2)+e;vars=i(t,o[u],true);if(s===0){returnu}elseif(s>0){if(n-u>1){returnrecursiveSearch(u,n,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnn<o.length?n:-1}else{returnu}}else{if(u-e>1){returnrecursiveSearch(e,u,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnu}else{returne<0?-1:e}}}r.search=functionsearch(e,n,t,o){if(n.length===0){return-1}vari=recursiveSearch(-1,n.length,e,n,t,o||r.GREATEST_LOWER_BOUND);if(i<0){return-1}while(i-1>=0){if(t(n[i],n[i-1],true)!==0){break}--i}returni}},680:(e,r,n)=>{vart=n(339);functiongeneratedPositionAfter(e,r){varn=e.generatedLine;varo=r.generatedLine;vari=e.generatedColumn;vara=r.generatedColumn;returno>n||o==n&&a>=i||t.compareByGeneratedPositionsInflated(e,r)<=0}functionMappingList(){this._array=[];this._sorted=true;this._last={generatedLine:-1,generatedColumn:0}}MappingList.prototype.unsortedForEach=functionMappingList_forEach(e,r){this._array.forEach(e,r)};MappingList.prototype.add=functionMappingList_add(e){if(generatedPositionAfter(this._last,e)){this._last=e;this._array.push(e)}else{this._sorted=false;this._array.push(e)}};MappingList.prototype.toArray=functionMappingList_toArray(){if(!this._sorted){this._array.sort(t.compareByGeneratedPositionsInflated);this._sorted=true}returnthis._array};r.H=MappingList},758:(e,r)=>{functionswap(e,r,n){vart=e[r];e[r]=e[n];e[n]=t}functionrandomIntInRange(e,r){returnMath.round(e+Math.random()*(r-e))}functiondoQuickSort(e,r,n,t){if(n<t){varo=randomIntInRange(n,t);vari=n-1;swap(e,o,t);vara=e[t];for(varu=n;u<t;u++){if(r(e[u],Line truncated
(()=>{vare={650:e=>{varr=Object.prototype.toString;varn=typeofBuffer.alloc==="function"&&typeofBuffer.allocUnsafe==="function"&&typeofBuffer.from==="function";functionisArrayBuffer(e){returnr.call(e).slice(8,-1)==="ArrayBuffer"}functionfromArrayBuffer(e,r,t){r>>>=0;varo=e.byteLength-r;if(o<0){thrownewRangeError("'offset' is out of bounds")}if(t===undefined){t=o}else{t>>>=0;if(t>o){thrownewRangeError("'length' is out of bounds")}}returnn?Buffer.from(e.slice(r,r+t)):newBuffer(newUint8Array(e.slice(r,r+t)))}functionfromString(e,r){if(typeofr!=="string"||r===""){r="utf8"}if(!Buffer.isEncoding(r)){thrownewTypeError('"encoding" must be a valid string encoding')}returnn?Buffer.from(e,r):newBuffer(e,r)}functionbufferFrom(e,r,t){if(typeofe==="number"){thrownewTypeError('"value" argument must not be a number')}if(isArrayBuffer(e)){returnfromArrayBuffer(e,r,t)}if(typeofe==="string"){returnfromString(e,r)}returnn?Buffer.from(e):newBuffer(e)}e.exports=bufferFrom},274:(e,r,n)=>{vart=n(339);varo=Object.prototype.hasOwnProperty;vari=typeofMap!=="undefined";functionArraySet(){this._array=[];this._set=i?newMap:Object.create(null)}ArraySet.fromArray=functionArraySet_fromArray(e,r){varn=newArraySet;for(vart=0,o=e.length;t<o;t++){n.add(e[t],r)}returnn};ArraySet.prototype.size=functionArraySet_size(){returni?this._set.size:Object.getOwnPropertyNames(this._set).length};ArraySet.prototype.add=functionArraySet_add(e,r){varn=i?e:t.toSetString(e);vara=i?this.has(e):o.call(this._set,n);varu=this._array.length;if(!a||r){this._array.push(e)}if(!a){if(i){this._set.set(e,u)}else{this._set[n]=u}}};ArraySet.prototype.has=functionArraySet_has(e){if(i){returnthis._set.has(e)}else{varr=t.toSetString(e);returno.call(this._set,r)}};ArraySet.prototype.indexOf=functionArraySet_indexOf(e){if(i){varr=this._set.get(e);if(r>=0){returnr}}else{varn=t.toSetString(e);if(o.call(this._set,n)){returnthis._set[n]}}thrownewError('"'+e+'" is not in the set.')};ArraySet.prototype.at=functionArraySet_at(e){if(e>=0&&e<this._array.length){returnthis._array[e]}thrownewError("No element indexed by "+e)};ArraySet.prototype.toArray=functionArraySet_toArray(){returnthis._array.slice()};r.I=ArraySet},449:(e,r,n)=>{vart=n(190);varo=5;vari=1<<o;vara=i-1;varu=i;functiontoVLQSigned(e){returne<0?(-e<<1)+1:(e<<1)+0}functionfromVLQSigned(e){varr=(e&1)===1;varn=e>>1;returnr?-n:n}r.encode=functionbase64VLQ_encode(e){varr="";varn;vari=toVLQSigned(e);do{n=i&a;i>>>=o;if(i>0){n|=u}r+=t.encode(n)}while(i>0);returnr};r.decode=functionbase64VLQ_decode(e,r,n){vari=e.length;vars=0;varl=0;varc,p;do{if(r>=i){thrownewError("Expected more digits in base 64 VLQ value.")}p=t.decode(e.charCodeAt(r++));if(p===-1){thrownewError("Invalid base64 digit: "+e.charAt(r-1))}c=!!(p&u);p&=a;s=s+(p<<l);l+=o}while(c);n.value=fromVLQSigned(s);n.rest=r}},190:(e,r)=>{varn="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("");r.encode=function(e){if(0<=e&&e<n.length){returnn[e]}thrownewTypeError("Must be between 0 and 63: "+e)};r.decode=function(e){varr=65;varn=90;vart=97;varo=122;vari=48;vara=57;varu=43;vars=47;varl=26;varc=52;if(r<=e&&e<=n){returne-r}if(t<=e&&e<=o){returne-t+l}if(i<=e&&e<=a){returne-i+c}if(e==u){return62}if(e==s){return63}return-1}},345:(e,r)=>{r.GREATEST_LOWER_BOUND=1;r.LEAST_UPPER_BOUND=2;functionrecursiveSearch(e,n,t,o,i,a){varu=Math.floor((n-e)/2)+e;vars=i(t,o[u],true);if(s===0){returnu}elseif(s>0){if(n-u>1){returnrecursiveSearch(u,n,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnn<o.length?n:-1}else{returnu}}else{if(u-e>1){returnrecursiveSearch(e,u,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnu}else{returne<0?-1:e}}}r.search=functionsearch(e,n,t,o){if(n.length===0){return-1}vari=recursiveSearch(-1,n.length,e,n,t,o||r.GREATEST_LOWER_BOUND);if(i<0){return-1}while(i-1>=0){if(t(n[i],n[i-1],true)!==0){break}--i}returni}},680:(e,r,n)=>{vart=n(339);functiongeneratedPositionAfter(e,r){varn=e.generatedLine;varo=r.generatedLine;vari=e.generatedColumn;vara=r.generatedColumn;returno>n||o==n&&a>=i||t.compareByGeneratedPositionsInflated(e,r)<=0}functionMappingList(){this._array=[];this._sorted=true;this._last={generatedLine:-1,generatedColumn:0}}MappingList.prototype.unsortedForEach=functionMappingList_forEach(e,r){this._array.forEach(e,r)};MappingList.prototype.add=functionMappingList_add(e){if(generatedPositionAfter(this._last,e)){this._last=e;this._array.push(e)}else{this._sorted=false;this._array.push(e)}};MappingList.prototype.toArray=functionMappingList_toArray(){if(!this._sorted){this._array.sort(t.compareByGeneratedPositionsInflated);this._sorted=true}returnthis._array};r.H=MappingList},758:(e,r)=>{functionswap(e,r,n){vart=e[r];e[r]=e[n];e[n]=t}functionrandomIntInRange(e,r){returnMath.round(e+Math.random()*(r-e))}functiondoQuickSort(e,r,n,t){if(n<t){varo=randomIntInRange(n,t);vari=n-1;swap(e,o,t);vara=e[t];for(varu=n;u<t;u++){if(r(e[u],Line truncated
(()=>{vare={650:e=>{varr=Object.prototype.toString;varn=typeofBuffer.alloc==="function"&&typeofBuffer.allocUnsafe==="function"&&typeofBuffer.from==="function";functionisArrayBuffer(e){returnr.call(e).slice(8,-1)==="ArrayBuffer"}functionfromArrayBuffer(e,r,t){r>>>=0;varo=e.byteLength-r;if(o<0){thrownewRangeError("'offset' is out of bounds")}if(t===undefined){t=o}else{t>>>=0;if(t>o){thrownewRangeError("'length' is out of bounds")}}returnn?Buffer.from(e.slice(r,r+t)):newBuffer(newUint8Array(e.slice(r,r+t)))}functionfromString(e,r){if(typeofr!=="string"||r===""){r="utf8"}if(!Buffer.isEncoding(r)){thrownewTypeError('"encoding" must be a valid string encoding')}returnn?Buffer.from(e,r):newBuffer(e,r)}functionbufferFrom(e,r,t){if(typeofe==="number"){thrownewTypeError('"value" argument must not be a number')}if(isArrayBuffer(e)){returnfromArrayBuffer(e,r,t)}if(typeofe==="string"){returnfromString(e,r)}returnn?Buffer.from(e):newBuffer(e)}e.exports=bufferFrom},274:(e,r,n)=>{vart=n(339);varo=Object.prototype.hasOwnProperty;vari=typeofMap!=="undefined";functionArraySet(){this._array=[];this._set=i?newMap:Object.create(null)}ArraySet.fromArray=functionArraySet_fromArray(e,r){varn=newArraySet;for(vart=0,o=e.length;t<o;t++){n.add(e[t],r)}returnn};ArraySet.prototype.size=functionArraySet_size(){returni?this._set.size:Object.getOwnPropertyNames(this._set).length};ArraySet.prototype.add=functionArraySet_add(e,r){varn=i?e:t.toSetString(e);vara=i?this.has(e):o.call(this._set,n);varu=this._array.length;if(!a||r){this._array.push(e)}if(!a){if(i){this._set.set(e,u)}else{this._set[n]=u}}};ArraySet.prototype.has=functionArraySet_has(e){if(i){returnthis._set.has(e)}else{varr=t.toSetString(e);returno.call(this._set,r)}};ArraySet.prototype.indexOf=functionArraySet_indexOf(e){if(i){varr=this._set.get(e);if(r>=0){returnr}}else{varn=t.toSetString(e);if(o.call(this._set,n)){returnthis._set[n]}}thrownewError('"'+e+'" is not in the set.')};ArraySet.prototype.at=functionArraySet_at(e){if(e>=0&&e<this._array.length){returnthis._array[e]}thrownewError("No element indexed by "+e)};ArraySet.prototype.toArray=functionArraySet_toArray(){returnthis._array.slice()};r.I=ArraySet},449:(e,r,n)=>{vart=n(190);varo=5;vari=1<<o;vara=i-1;varu=i;functiontoVLQSigned(e){returne<0?(-e<<1)+1:(e<<1)+0}functionfromVLQSigned(e){varr=(e&1)===1;varn=e>>1;returnr?-n:n}r.encode=functionbase64VLQ_encode(e){varr="";varn;vari=toVLQSigned(e);do{n=i&a;i>>>=o;if(i>0){n|=u}r+=t.encode(n)}while(i>0);returnr};r.decode=functionbase64VLQ_decode(e,r,n){vari=e.length;vars=0;varl=0;varc,p;do{if(r>=i){thrownewError("Expected more digits in base 64 VLQ value.")}p=t.decode(e.charCodeAt(r++));if(p===-1){thrownewError("Invalid base64 digit: "+e.charAt(r-1))}c=!!(p&u);p&=a;s=s+(p<<l);l+=o}while(c);n.value=fromVLQSigned(s);n.rest=r}},190:(e,r)=>{varn="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("");r.encode=function(e){if(0<=e&&e<n.length){returnn[e]}thrownewTypeError("Must be between 0 and 63: "+e)};r.decode=function(e){varr=65;varn=90;vart=97;varo=122;vari=48;vara=57;varu=43;vars=47;varl=26;varc=52;if(r<=e&&e<=n){returne-r}if(t<=e&&e<=o){returne-t+l}if(i<=e&&e<=a){returne-i+c}if(e==u){return62}if(e==s){return63}return-1}},345:(e,r)=>{r.GREATEST_LOWER_BOUND=1;r.LEAST_UPPER_BOUND=2;functionrecursiveSearch(e,n,t,o,i,a){varu=Math.floor((n-e)/2)+e;vars=i(t,o[u],true);if(s===0){returnu}elseif(s>0){if(n-u>1){returnrecursiveSearch(u,n,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnn<o.length?n:-1}else{returnu}}else{if(u-e>1){returnrecursiveSearch(e,u,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnu}else{returne<0?-1:e}}}r.search=functionsearch(e,n,t,o){if(n.length===0){return-1}vari=recursiveSearch(-1,n.length,e,n,t,o||r.GREATEST_LOWER_BOUND);if(i<0){return-1}while(i-1>=0){if(t(n[i],n[i-1],true)!==0){break}--i}returni}},680:(e,r,n)=>{vart=n(339);functiongeneratedPositionAfter(e,r){varn=e.generatedLine;varo=r.generatedLine;vari=e.generatedColumn;vara=r.generatedColumn;returno>n||o==n&&a>=i||t.compareByGeneratedPositionsInflated(e,r)<=0}functionMappingList(){this._array=[];this._sorted=true;this._last={generatedLine:-1,generatedColumn:0}}MappingList.prototype.unsortedForEach=functionMappingList_forEach(e,r){this._array.forEach(e,r)};MappingList.prototype.add=functionMappingList_add(e){if(generatedPositionAfter(this._last,e)){this._last=e;this._array.push(e)}else{this._sorted=false;this._array.push(e)}};MappingList.prototype.toArray=functionMappingList_toArray(){if(!this._sorted){this._array.sort(t.compareByGeneratedPositionsInflated);this._sorted=true}returnthis._array};r.H=MappingList},758:(e,r)=>{functionswap(e,r,n){vart=e[r];e[r]=e[n];e[n]=t}functionrandomIntInRange(e,r){returnMath.round(e+Math.random()*(r-e))}functiondoQuickSort(e,r,n,t){if(n<t){varo=randomIntInRange(n,t);vari=n-1;swap(e,o,t);vara=e[t];for(varu=n;u<t;u++){if(r(e[u],Line truncated
(()=>{vare={650:e=>{varr=Object.prototype.toString;varn=typeofBuffer.alloc==="function"&&typeofBuffer.allocUnsafe==="function"&&typeofBuffer.from==="function";functionisArrayBuffer(e){returnr.call(e).slice(8,-1)==="ArrayBuffer"}functionfromArrayBuffer(e,r,t){r>>>=0;varo=e.byteLength-r;if(o<0){thrownewRangeError("'offset' is out of bounds")}if(t===undefined){t=o}else{t>>>=0;if(t>o){thrownewRangeError("'length' is out of bounds")}}returnn?Buffer.from(e.slice(r,r+t)):newBuffer(newUint8Array(e.slice(r,r+t)))}functionfromString(e,r){if(typeofr!=="string"||r===""){r="utf8"}if(!Buffer.isEncoding(r)){thrownewTypeError('"encoding" must be a valid string encoding')}returnn?Buffer.from(e,r):newBuffer(e,r)}functionbufferFrom(e,r,t){if(typeofe==="number"){thrownewTypeError('"value" argument must not be a number')}if(isArrayBuffer(e)){returnfromArrayBuffer(e,r,t)}if(typeofe==="string"){returnfromString(e,r)}returnn?Buffer.from(e):newBuffer(e)}e.exports=bufferFrom},274:(e,r,n)=>{vart=n(339);varo=Object.prototype.hasOwnProperty;vari=typeofMap!=="undefined";functionArraySet(){this._array=[];this._set=i?newMap:Object.create(null)}ArraySet.fromArray=functionArraySet_fromArray(e,r){varn=newArraySet;for(vart=0,o=e.length;t<o;t++){n.add(e[t],r)}returnn};ArraySet.prototype.size=functionArraySet_size(){returni?this._set.size:Object.getOwnPropertyNames(this._set).length};ArraySet.prototype.add=functionArraySet_add(e,r){varn=i?e:t.toSetString(e);vara=i?this.has(e):o.call(this._set,n);varu=this._array.length;if(!a||r){this._array.push(e)}if(!a){if(i){this._set.set(e,u)}else{this._set[n]=u}}};ArraySet.prototype.has=functionArraySet_has(e){if(i){returnthis._set.has(e)}else{varr=t.toSetString(e);returno.call(this._set,r)}};ArraySet.prototype.indexOf=functionArraySet_indexOf(e){if(i){varr=this._set.get(e);if(r>=0){returnr}}else{varn=t.toSetString(e);if(o.call(this._set,n)){returnthis._set[n]}}thrownewError('"'+e+'" is not in the set.')};ArraySet.prototype.at=functionArraySet_at(e){if(e>=0&&e<this._array.length){returnthis._array[e]}thrownewError("No element indexed by "+e)};ArraySet.prototype.toArray=functionArraySet_toArray(){returnthis._array.slice()};r.I=ArraySet},449:(e,r,n)=>{vart=n(190);varo=5;vari=1<<o;vara=i-1;varu=i;functiontoVLQSigned(e){returne<0?(-e<<1)+1:(e<<1)+0}functionfromVLQSigned(e){varr=(e&1)===1;varn=e>>1;returnr?-n:n}r.encode=functionbase64VLQ_encode(e){varr="";varn;vari=toVLQSigned(e);do{n=i&a;i>>>=o;if(i>0){n|=u}r+=t.encode(n)}while(i>0);returnr};r.decode=functionbase64VLQ_decode(e,r,n){vari=e.length;vars=0;varl=0;varc,p;do{if(r>=i){thrownewError("Expected more digits in base 64 VLQ value.")}p=t.decode(e.charCodeAt(r++));if(p===-1){thrownewError("Invalid base64 digit: "+e.charAt(r-1))}c=!!(p&u);p&=a;s=s+(p<<l);l+=o}while(c);n.value=fromVLQSigned(s);n.rest=r}},190:(e,r)=>{varn="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("");r.encode=function(e){if(0<=e&&e<n.length){returnn[e]}thrownewTypeError("Must be between 0 and 63: "+e)};r.decode=function(e){varr=65;varn=90;vart=97;varo=122;vari=48;vara=57;varu=43;vars=47;varl=26;varc=52;if(r<=e&&e<=n){returne-r}if(t<=e&&e<=o){returne-t+l}if(i<=e&&e<=a){returne-i+c}if(e==u){return62}if(e==s){return63}return-1}},345:(e,r)=>{r.GREATEST_LOWER_BOUND=1;r.LEAST_UPPER_BOUND=2;functionrecursiveSearch(e,n,t,o,i,a){varu=Math.floor((n-e)/2)+e;vars=i(t,o[u],true);if(s===0){returnu}elseif(s>0){if(n-u>1){returnrecursiveSearch(u,n,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnn<o.length?n:-1}else{returnu}}else{if(u-e>1){returnrecursiveSearch(e,u,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnu}else{returne<0?-1:e}}}r.search=functionsearch(e,n,t,o){if(n.length===0){return-1}vari=recursiveSearch(-1,n.length,e,n,t,o||r.GREATEST_LOWER_BOUND);if(i<0){return-1}while(i-1>=0){if(t(n[i],n[i-1],true)!==0){break}--i}returni}},680:(e,r,n)=>{vart=n(339);functiongeneratedPositionAfter(e,r){varn=e.generatedLine;varo=r.generatedLine;vari=e.generatedColumn;vara=r.generatedColumn;returno>n||o==n&&a>=i||t.compareByGeneratedPositionsInflated(e,r)<=0}functionMappingList(){this._array=[];this._sorted=true;this._last={generatedLine:-1,generatedColumn:0}}MappingList.prototype.unsortedForEach=functionMappingList_forEach(e,r){this._array.forEach(e,r)};MappingList.prototype.add=functionMappingList_add(e){if(generatedPositionAfter(this._last,e)){this._last=e;this._array.push(e)}else{this._sorted=false;this._array.push(e)}};MappingList.prototype.toArray=functionMappingList_toArray(){if(!this._sorted){this._array.sort(t.compareByGeneratedPositionsInflated);this._sorted=true}returnthis._array};r.H=MappingList},758:(e,r)=>{functionswap(e,r,n){vart=e[r];e[r]=e[n];e[n]=t}functionrandomIntInRange(e,r){returnMath.round(e+Math.random()*(r-e))}functiondoQuickSort(e,r,n,t){if(n<t){varo=randomIntInRange(n,t);vari=n-1;swap(e,o,t);vara=e[t];for(varu=n;u<t;u++){if(r(e[u],Line truncated
`No file matched to [${cacheDependencyGlob.split("\n").join(",")}]. The cache will never get invalidated. Make sure you have checked out the target repository and configured the cache-dependency-glob input correctly.`,
`Cache path ${cacheLocalPath} does not exist on disk. This likely indicates that there are no dependencies to cache. Consider disabling the cache input if it is not needed.`,
);
}
try{
awaitcache.saveCache([cacheLocalPath],cacheKey);
core.info(`cache saved with the key: ${cacheKey}`);
}catch(e){
if(
einstanceofError&&
e.message===
"Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved."
){
core.info(
"No cacheable paths were found. Ignoring because ignore-nothing-to-save is enabled.",
core.warning(`Error while parsing ${filePath}: ${message}`);
returnundefined;
}
if(uvVersion?.startsWith("==")){
uvVersion=uvVersion.slice(2);
}
if(uvVersion!==undefined){
core.info(`Found version for uv in ${filePath}: ${uvVersion}`);
}
returnuvVersion;
}
Loaded 100 of 103 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Kevin Stillhammer
dependabot[bot]
Kevin Stillhammer
github-actions[bot]andeifinger
William Woodruff
axm2andpublic
Zanie Blue
Zoupers Zou
Nick Sweeting
Philipp A.
Jeremy Mayeres
Zxilly
samypr100
Jinzhe Zeng
pollenJP(@'ω'@)
Trevor Manz
Yoshihisa Mochihara
Bartosz Sławecki
hori-ryota
Lukas Burgholzer
Hynek Schlawack
