Files
uv/.github/workflows/publish-versions.yml
T
renovate[bot] 7c2f6c696b Update astral-sh/setup-uv action to v8 (#18765)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
action | major | `v7.6.0` → `v8.0.0` |

---

### Release Notes

<details>
<summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary>

###
[`v8.0.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v8.0.0):
🌈 Immutable releases and secure tags

[Compare
Source](https://redirect.github.com/astral-sh/setup-uv/compare/v7.6.0...v8.0.0)

### This is the first immutable release of `setup-uv` 🥳

All future releases are also immutable, if you want to know more about
what this means checkout [the
docs](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases).

This release also has two breaking changes

#### New format for `manifest-file`

The previously deprecated way of defining a custom version manifest to
control which `uv` versions are available and where to download them
from got removed. The functionality is still there but you have to use
the [new
format](https://redirect.github.com/astral-sh/setup-uv/blob/main/docs/customization.md#format).

#### No more major and minor tags

To increase **security** even more we will **stop publishing minor
tags**. You won't be able to use `@v8` or `@v8.0` any longer. We do this
because pinning to major releases opens up users to supply chain attacks
like what happened to
[tj-actions](https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/).

> \[!TIP]
> Use the immutable tag as a version `astral-sh/setup-uv@8.0.0`
> Or even better the githash
`astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57`

#### 🚨 Breaking changes

- Remove update-major-minor-tags workflow
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;826](https://redirect.github.com/astral-sh/setup-uv/issues/826))
- Remove deprecrated custom manifest
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;813](https://redirect.github.com/astral-sh/setup-uv/issues/813))

#### 🧰 Maintenance

- Shortcircuit latest version from manifest
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;828](https://redirect.github.com/astral-sh/setup-uv/issues/828))
- Simplify inputs.ts
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;827](https://redirect.github.com/astral-sh/setup-uv/issues/827))
- Bump release-drafter to v7.1.1
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;825](https://redirect.github.com/astral-sh/setup-uv/issues/825))
- Refactor inputs
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;823](https://redirect.github.com/astral-sh/setup-uv/issues/823))
- Replace inline compile args with tsconfig
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;824](https://redirect.github.com/astral-sh/setup-uv/issues/824))
- chore: update known checksums for 0.11.2
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;821](https://redirect.github.com/astral-sh/setup-uv/issues/821))
- chore: update known checksums for 0.11.1
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;817](https://redirect.github.com/astral-sh/setup-uv/issues/817))
- chore: update known checksums for 0.11.0
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;815](https://redirect.github.com/astral-sh/setup-uv/issues/815))
- Fix latest-version workflow check
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;812](https://redirect.github.com/astral-sh/setup-uv/issues/812))
- chore: update known checksums for 0.10.11/0.10.12
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;811](https://redirect.github.com/astral-sh/setup-uv/issues/811))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45NC4xIiwidXBkYXRlZEluVmVyIjoiNDMuOTQuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-30 09:48:20 +02:00

78 lines
2.5 KiB
YAML

# Publish uv version information to the versions repository.
#
# Assumed to run as a subworkflow of .github/workflows/release.yml; specifically, as a post-announce
# job within `cargo-dist`.
name: publish-versions
on:
workflow_call:
inputs:
plan:
required: true
type: string
permissions: {}
jobs:
publish-versions:
runs-on: ubuntu-latest
environment:
name: release
env:
VERSION: ${{ fromJson(inputs.plan).announcement_tag }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: "Set branch name"
run: echo "BRANCH_NAME=update-versions-$VERSION-$(date +%s)" >> $GITHUB_ENV
- name: "Clone versions repo"
run: git clone https://${{ secrets.ASTRAL_VERSIONS_PAT }}@github.com/astral-sh/versions.git astral-versions
- name: "Install uv"
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
- name: "Update versions"
env:
PLAN: ${{ inputs.plan }}
run: printf '%s' "$PLAN" | uv run astral-versions/scripts/convert-cargo-dist-plan.py | uv run astral-versions/scripts/insert-versions.py --name uv
- name: "Commit versions"
working-directory: astral-versions
run: |
git config user.name "astral-versions-bot"
git config user.email "176161322+astral-versions-bot@users.noreply.github.com"
git checkout -b "$BRANCH_NAME"
git add -A
git commit -m "Update uv to version $VERSION"
- name: "Create Pull Request"
working-directory: astral-versions
env:
GITHUB_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
run: |
pull_request_title="Add uv $VERSION"
gh pr list --state open --json title --jq ".[] | select(.title == \"$pull_request_title\") | .number" | \
xargs -I {} gh pr close {}
git push origin "$BRANCH_NAME"
gh pr create --base main --head "$BRANCH_NAME" \
--title "$pull_request_title" \
--body "Automated versions update for $VERSION" \
--label "automation"
- name: "Merge Pull Request"
if: ${{ !fromJson(inputs.plan).announcement_tag_is_implicit }}
working-directory: astral-versions
env:
GITHUB_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
run: |
# Wait for PR to be created before merging
sleep 10
gh pr merge --squash "$BRANCH_NAME"