7c2f6c696b
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | major | `v7.6.0` → `v8.0.0` | --- ### Release Notes <details> <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary> ### [`v8.0.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v8.0.0): 🌈 Immutable releases and secure tags [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v7.6.0...v8.0.0) ### This is the first immutable release of `setup-uv` 🥳 All future releases are also immutable, if you want to know more about what this means checkout [the docs](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases). This release also has two breaking changes #### New format for `manifest-file` The previously deprecated way of defining a custom version manifest to control which `uv` versions are available and where to download them from got removed. The functionality is still there but you have to use the [new format](https://redirect.github.com/astral-sh/setup-uv/blob/main/docs/customization.md#format). #### No more major and minor tags To increase **security** even more we will **stop publishing minor tags**. You won't be able to use `@v8` or `@v8.0` any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to [tj-actions](https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/). > \[!TIP] > Use the immutable tag as a version `astral-sh/setup-uv@8.0.0` > Or even better the githash `astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57` #### 🚨 Breaking changes - Remove update-major-minor-tags workflow [@​eifinger](https://redirect.github.com/eifinger) ([#​826](https://redirect.github.com/astral-sh/setup-uv/issues/826)) - Remove deprecrated custom manifest [@​eifinger](https://redirect.github.com/eifinger) ([#​813](https://redirect.github.com/astral-sh/setup-uv/issues/813)) #### 🧰 Maintenance - Shortcircuit latest version from manifest [@​eifinger](https://redirect.github.com/eifinger) ([#​828](https://redirect.github.com/astral-sh/setup-uv/issues/828)) - Simplify inputs.ts [@​eifinger](https://redirect.github.com/eifinger) ([#​827](https://redirect.github.com/astral-sh/setup-uv/issues/827)) - Bump release-drafter to v7.1.1 [@​eifinger](https://redirect.github.com/eifinger) ([#​825](https://redirect.github.com/astral-sh/setup-uv/issues/825)) - Refactor inputs [@​eifinger](https://redirect.github.com/eifinger) ([#​823](https://redirect.github.com/astral-sh/setup-uv/issues/823)) - Replace inline compile args with tsconfig [@​eifinger](https://redirect.github.com/eifinger) ([#​824](https://redirect.github.com/astral-sh/setup-uv/issues/824)) - chore: update known checksums for 0.11.2 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​821](https://redirect.github.com/astral-sh/setup-uv/issues/821)) - chore: update known checksums for 0.11.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​817](https://redirect.github.com/astral-sh/setup-uv/issues/817)) - chore: update known checksums for 0.11.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​815](https://redirect.github.com/astral-sh/setup-uv/issues/815)) - Fix latest-version workflow check [@​eifinger](https://redirect.github.com/eifinger) ([#​812](https://redirect.github.com/astral-sh/setup-uv/issues/812)) - chore: update known checksums for 0.10.11/0.10.12 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​811](https://redirect.github.com/astral-sh/setup-uv/issues/811)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45NC4xIiwidXBkYXRlZEluVmVyIjoiNDMuOTQuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
78 lines
2.5 KiB
YAML
78 lines
2.5 KiB
YAML
# Publish uv version information to the versions repository.
|
|
#
|
|
# Assumed to run as a subworkflow of .github/workflows/release.yml; specifically, as a post-announce
|
|
# job within `cargo-dist`.
|
|
name: publish-versions
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
plan:
|
|
required: true
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
publish-versions:
|
|
runs-on: ubuntu-latest
|
|
environment:
|
|
name: release
|
|
env:
|
|
VERSION: ${{ fromJson(inputs.plan).announcement_tag }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: "Set branch name"
|
|
run: echo "BRANCH_NAME=update-versions-$VERSION-$(date +%s)" >> $GITHUB_ENV
|
|
|
|
- name: "Clone versions repo"
|
|
run: git clone https://${{ secrets.ASTRAL_VERSIONS_PAT }}@github.com/astral-sh/versions.git astral-versions
|
|
|
|
- name: "Install uv"
|
|
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
|
|
|
|
- name: "Update versions"
|
|
env:
|
|
PLAN: ${{ inputs.plan }}
|
|
run: printf '%s' "$PLAN" | uv run astral-versions/scripts/convert-cargo-dist-plan.py | uv run astral-versions/scripts/insert-versions.py --name uv
|
|
|
|
- name: "Commit versions"
|
|
working-directory: astral-versions
|
|
run: |
|
|
git config user.name "astral-versions-bot"
|
|
git config user.email "176161322+astral-versions-bot@users.noreply.github.com"
|
|
|
|
git checkout -b "$BRANCH_NAME"
|
|
git add -A
|
|
git commit -m "Update uv to version $VERSION"
|
|
|
|
- name: "Create Pull Request"
|
|
working-directory: astral-versions
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
|
|
run: |
|
|
pull_request_title="Add uv $VERSION"
|
|
|
|
gh pr list --state open --json title --jq ".[] | select(.title == \"$pull_request_title\") | .number" | \
|
|
xargs -I {} gh pr close {}
|
|
|
|
git push origin "$BRANCH_NAME"
|
|
|
|
gh pr create --base main --head "$BRANCH_NAME" \
|
|
--title "$pull_request_title" \
|
|
--body "Automated versions update for $VERSION" \
|
|
--label "automation"
|
|
|
|
- name: "Merge Pull Request"
|
|
if: ${{ !fromJson(inputs.plan).announcement_tag_is_implicit }}
|
|
working-directory: astral-versions
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
|
|
run: |
|
|
# Wait for PR to be created before merging
|
|
sleep 10
|
|
gh pr merge --squash "$BRANCH_NAME"
|