From 3acd1be157d1db266fe3fd881ae785d64829fe5b Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 28 Sep 2026 14:23:39 +0000 Subject: [PATCH] ci: bump setup-uv pin to v10.2.0 and update contract test Companion for Dependabot #228. Keep uv 0.12.5 and assert the new pinned SHA so the release security contract stays in sync. Co-authored-by: John Osumi --- .github/workflows/release.yml | 2 +- tests/test_ci_security_contract.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3eb82db..35b0520 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -126,7 +126,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: { python-version: '3.12' } - - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: '0.12.5' enable-cache: false diff --git a/tests/test_ci_security_contract.py b/tests/test_ci_security_contract.py index 18e144f..5998fc3 100644 --- a/tests/test_ci_security_contract.py +++ b/tests/test_ci_security_contract.py @@ -163,7 +163,7 @@ def test_release_validates_runtime_manifest_schema_before_archive(self) -> None: def test_release_provisions_pinned_uv_before_schema_validation(self) -> None: text = (WORKFLOWS / "release.yml").read_text(encoding="utf-8") setup = text.index( - "astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4" + "astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7" ) version = text.index("version: '0.12.5'", setup) validate = text.index("scripts/validate_runtime_manifest_schema.py", version)