[anth-volk]

Fixes #59

Follow-up to #48. Dependabot's first pull request, #56, which changes only uv.lock, fails "Check changelog fragment", and so "Required checks". This PR fixes that failure, and the same failure in the Push workflow on a merge without fragments, and corrects the documentation and rule statements the third review of #48 found inaccurate.

Cause

astral-sh/setup-uv caches by default on GitHub-hosted runners (enable-cache: auto). Its post-job step fails the job when uv's cache directory does not exist and ignore-nothing-to-cache is false (src/save-cache.ts at the pinned commit d0d8abe). The directory exists only once a uv command has used the cache.

• Changelog job (pr.yaml): tools/check-changelog.sh lets a Dependabot pull request that changes only uv.lock pass before running uv. Run 41097041571 on Bump the locked-dependencies group across 1 directory with 3 updates #56 shows the script exiting 0, then "Cache path … does not exist on disk".
• Versioning job (push.yaml): on a merge without fragments, tools/update-version.sh writes released=false and exits before any uv command, so the run would end failed although nothing is released. Not yet observed: no merge without fragments has happened.

Changes

1. Test first (cb12a5f): tests/test_workflows.py::test_setup_uv_caches_only_in_jobs_that_always_run_uv, registered as the new rule emitter.ci.uv-cache-only-where-uv-runs. For every setup-uv step in every workflow, it requires enable-cache: false unless a later step of the same job, with no if:, runs a command starting with uv or uvx, or runs bash tools/<script>.sh where the script's unindented lines reach such a command before any if, case, loop, function definition or exit.
   • Locally on cb12a5f: failed, listing ('pr.yaml', 'changelog') and ('push.yaml', 'versioning').
2. Fix (0c894e6): enable-cache: false on the setup-uv steps of those two jobs. Locally on 0c894e6: passed.
   • Every other setup-uv step keeps the cache, because its job runs uv in every successful run: quality, tests and build-packages in ci.yml start with uv sync --locked, rules in pr.yaml with uv tool install, and tools/check-collector.sh, which the collector job runs, reaches uv sync --locked before any branch.
3. Documentation and rule statements (e0f6bd9):
   • The README's Publication section and push.yaml's header comment now say that only a merge with changelog fragments releases, and that a merge without them runs push.yaml once and commits nothing.
   • The README's Development section no longer restates "uv 0.13.6 or later in the 0.13 series", which required-version = ">=0.13" does not enforce. It now points to the lower bound in [tool.uv] required-version, and to .github/uv-version.txt for the one release CI installs.
   • emitter.dependencies.install-from-lock and emitter.dependencies.test-from-lock claimed every command the Python scripts under tools/ start. The locked-installs check reads only calls whose leading arguments, or the list or tuple passed first, give the command as string literals, and the statements now say exactly that.
   • emitter.distributions.version-from-fragments said the release refuses missing fragments. Now only tools/bump-version.py does, since tools/update-version.sh releases nothing without them, and the statement names it.
   • emitter.dependencies.uv-version-pinned said the bound is written >=X.Y and that Dependabot's uv still runs. The check also accepts >=X.Y.Z and does not check Dependabot's uv release, so the statement and the guard's docstring now say what is checked.
   • python -m scripts.rules render regenerated AGENTS.md and docs/generated/rules.md.
4. Changelog fragment (bdfe968): every pull request except Dependabot's lock-only ones needs one, so this PR adds changelog.d/uv-cache-without-uv.fixed.md. Merging releases 0.11.7 of both distributions (after Check that workflow steps are single commands, and that tools scripts pass shellcheck and have tests #50 released 0.11.6) (a patch bump; the wheels' contents are unchanged).

Local checks

• Only the new test, by node ID: failed on cb12a5f and passed on 0c894e6, with uv 0.13.6.
• python -m scripts.rules guard --base-ref origin/main: passed. scripts/run_quality_guards.py: all four guards passed.
• Ruff check and format on the changed Python files, and actionlint 1.7.12 on pr.yaml and push.yaml: passed.
• No full test suite was run locally; CI runs it.

Secrets and variables of the changed jobs

Name	Read by	Provider	Reaches the job
PR_AUTHOR	tools/check-changelog.sh in the changelog job	github.event.pull_request.user.login, from the pull_request event	The step's env:; unchanged by this PR
BASE_REF	the same script	github.base_ref, set on pull_request events	The step's env:; unchanged
secrets.APP_ID, secrets.APP_PRIVATE_KEY	the versioning job's App-token step	GitHub Actions organisation secrets; both are among the organisation secrets this repository can read (names checked with the API)	The token step's with:; unchanged. Run 41096704729 created the token after #48 merged
steps.app-token.outputs.token	checkout and the commit step of the versioning job	actions/create-github-app-token, at run time	The same job; unchanged
GITHUB_OUTPUT	tools/update-version.sh	the runner	Every step; the job reads it back as steps.version.outputs.released
github.token	setup-uv's default github-token input in both jobs, and checkout in the changelog job	GitHub Actions automatic token	The workflow-level permissions: contents: read; unchanged
.github/uv-version.txt	each setup-uv step's version-file input	the repository	Both jobs check out before their setup-uv step

enable-cache: false adds no variable. setup-uv no longer restores or saves a cache in these two jobs, so they no longer use the runner's cache service. The repository has no repository-level secrets or variables, and no Dependabot secrets. Nothing in this table is unverified, except that the versioning job's run without fragments on main will first happen when a merge without fragments, such as #56, lands.

After merging

#56 was opened before this fix, so it needs a rebase (for example @dependabot rebase) to pick up the new pr.yaml. This PR does not comment on #56.

🤖 Generated with Claude Code