I need to test features that require push to a registry, e.g., #18252,
and want to do so without releasing. This adds publish to a `uv-dev`
namespace and uses the sha instead of the version. It requires the
`release-test` environment, which is allowed from non-main but requires
approval from me to run. It is trigged by the `build:push-docker` label.
See https://github.com/astral-sh/uv/pkgs/container/uv-dev
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) |
action | patch | `v6.0.1` → `v6.0.2` |
---
### Release Notes
<details>
<summary>actions/checkout (actions/checkout)</summary>
###
[`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602)
[Compare
Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2)
- Fix tag handling: preserve annotations and explicit fetch-tags by
[@​ericsciple](https://redirect.github.com/ericsciple) in
[#​2356](https://redirect.github.com/actions/checkout/pull/2356)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDIuOTIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1yZWxlYXNlIiwiaW50ZXJuYWwiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
These are hitting OIDC failures on Depot and run for 30m consuming a lot
of CI concurrency.
These timeouts are based on historical data retrieved by Claude.
Closes https://github.com/astral-sh/uv/issues/17095
This also stabilizes the Alpine version for users that do not choose to
pin it. We could add this to the build matrix separately to avoid that,
but I think that's okay?
## Summary
Tentative PR to drop the `-rc` suffix from the published images.
Do not merge this yet until the formal release
[upstream](https://hub.docker.com/_/python) :)
## Summary
Semi related to https://github.com/astral-sh/uv/issues/15270, except
there's no removal.
Makes Alpine 3.22 and debian trixie the default tags instead of removing
bookworm and alpine 3.21 to minimize churn.
~~This PR is pending https://github.com/astral-sh/uv/pull/15351 merged
first.~~ Merged
## Test Plan
No functional changes made besides changing tag pointers.
## Summary
Follow up to
https://github.com/astral-sh/uv/pull/15269#issuecomment-3194000772
Enables the following additional images to be published
* buildpack-deps:trixie
* debian:trixie-slim
* alpine:3.22
## Test Plan
Existing Tests. The newly added images were checked manually.
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[depot/build-push-action](https://redirect.github.com/depot/build-push-action)
| action | patch | `v1.16.1` -> `v1.16.2` |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.
---
### Release Notes
<details>
<summary>depot/build-push-action (depot/build-push-action)</summary>
###
[`v1.16.2`](https://redirect.github.com/depot/build-push-action/releases/tag/v1.16.2)
[Compare
Source](https://redirect.github.com/depot/build-push-action/compare/v1.16.1...v1.16.2)
##### What's Changed
- Use ubuntu-latest for release workflow
([#​42](https://redirect.github.com/depot/build-push-action/issues/42))
[@​jacobwgillespie](https://redirect.github.com/jacobwgillespie)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS43MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuNzEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[depot/build-push-action](https://redirect.github.com/depot/build-push-action)
| action | patch | `v1.16.0` -> `v1.16.1` |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.
---
### Release Notes
<details>
<summary>depot/build-push-action (depot/build-push-action)</summary>
###
[`v1.16.1`](https://redirect.github.com/depot/build-push-action/releases/tag/v1.16.1)
[Compare
Source](https://redirect.github.com/depot/build-push-action/compare/v1.16.0...v1.16.1)
##### What's Changed
- Update
[@​depot/actions-public-oidc-client](https://redirect.github.com/depot/actions-public-oidc-client)
to v1.1.0
([#​41](https://redirect.github.com/depot/build-push-action/issues/41))
[@​jacobwgillespie](https://redirect.github.com/jacobwgillespie)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS43MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuNzEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[depot/build-push-action](https://redirect.github.com/depot/build-push-action)
| action | minor | `v1.15.0` -> `v1.16.0` |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.
---
### Release Notes
<details>
<summary>depot/build-push-action (depot/build-push-action)</summary>
###
[`v1.16.0`](https://redirect.github.com/depot/build-push-action/releases/tag/v1.16.0)
[Compare
Source](https://redirect.github.com/depot/build-push-action/compare/v1.15.0...v1.16.0)
##### What's Changed
- Add support for annotations
([#​38](https://redirect.github.com/depot/build-push-action/issues/38))
[@​zanieb](https://redirect.github.com/zanieb)
- feat: add `save-tags` for multiple depot registry tags
([#​40](https://redirect.github.com/depot/build-push-action/issues/40))
[@​goller](https://redirect.github.com/goller)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS42Ni4yIiwidXBkYXRlZEluVmVyIjoiNDEuNjYuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Summary
This re-creates #15145, with fixes following the revert in #15174.
The overall approach is the same, except that I've added an explicit
permissions block to `docker-annotate-base` that should cover the needed
permissions in that job.
(One confusion is around how that wasn't failing before -- FWICT it was
receiving the default `GITHUB_TOKEN`, which doesn't include `id-token:
write` or `packages: write`. So it _should_ have been failing even
before I explicitly did `permissions: {}`...)
Edit: Oh, I see why -- the actual release process does a
`workflow_call`, so this inherits its `GITHUB_TOKEN` from
`release.yml:custom-build-docker`, which in turn has the right
permissions granted to it.
## Test Plan
See what happens in CI. Plus maybe we could do a release dry-run?
Signed-off-by: William Woodruff <william@astral.sh>
## Summary
Addresses zizmor findings in `build-docker.yml`.
Key changes: primarily removing template expansions and restricting some
permissions.
## Test Plan
Let the CI run.
Signed-off-by: William Woodruff <william@astral.sh>
Closes#13057
Sets `UV_TOOL_BIN_DIR` to `/usr/local/bin` for all derived images to
allow `uv tool install` to work out of the box.
Note, when the default image user is overwritten (e.g. `USER <UID>`) by
a less privileged one, an alternative writable location would now need
to be set by downstream consumers to prevent issues, hence I'm labeling
this as a breaking change for 0.8.x release.
Relates to https://github.com/astral-sh/uv-docker-example/pull/55
Each image was tested to work with uv tool with `UV_TOOL_BIN_DIR` set to
`/usr/local/bin` with the default root user and alternative non-root
users to confirm breaking nature of the change.
More follow-up to #13459
- Depot doesn't support annotations, so we push those manually
- Docker push for the re-tag was breaking the manifest, since we need to
annotate manually, we just do that instead
- We attest after the annotation
A bit of an aside
- We test building the extra images, it's very fast and I don't see why
it's better to gate it
I tested this on my fork then cleaned it up a bit for a commit here. You
can see the images at
- https://github.com/zanieb/uv/pkgs/container/uv
- https://hub.docker.com/r/astral/uv/tags
---------
Co-authored-by: samypr100 <3933065+samypr100@users.noreply.github.com>
Zanie Blue