From ba1362cc17d0bbad0e0a06bcf532d04fe110661d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 14 Sep 2026 16:32:25 +0000 Subject: [PATCH] ci: bump setup-uv pin to v10.1.0 and update contract test Companion for Dependabot #212. Keep uv 0.12.5 and assert the new pinned SHA so the release security contract stays in sync. Co-authored-by: John Osumi --- .github/workflows/release.yml | 2 +- tests/test_ci_security_contract.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cc09ac70..3eb82db5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -126,7 +126,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: { python-version: '3.12' } - - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: '0.12.5' enable-cache: false diff --git a/tests/test_ci_security_contract.py b/tests/test_ci_security_contract.py index e2609485..18e144f3 100644 --- a/tests/test_ci_security_contract.py +++ b/tests/test_ci_security_contract.py @@ -163,7 +163,7 @@ def test_release_validates_runtime_manifest_schema_before_archive(self) -> None: def test_release_provisions_pinned_uv_before_schema_validation(self) -> None: text = (WORKFLOWS / "release.yml").read_text(encoding="utf-8") setup = text.index( - "astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d" + "astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4" ) version = text.index("version: '0.12.5'", setup) validate = text.index("scripts/validate_runtime_manifest_schema.py", version)