chore(deps): update github actions

[agntcy-automation]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	patch	v7.0.0 → v7.0.1
astral-sh/uv	uses-with	patch	0.11.29 → 0.11.32	0.12.1 (+2)
docker/login-action	action	minor	v4.4.0 → v4.5.1	v4.6.0 (+1)
github/codeql-action	action	patch	v4.37.1 → v4.37.3	v4.37.4

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

astral-sh/uv (astral-sh/uv)

v0.11.32

Compare Source

Release Notes

Released on 2026-07-23.

Preview features

• Add --package and --all-packages selection to uv check (#​20628)
• Allow uv upgrade to update multiple marker-specific declarations of the same package (#​20335)
• Reject non-canonically formatted lockfiles in uv lock --check and commands using --locked (#​20646)
• Regenerate non-canonically formatted lockfiles with uv lock --refresh (#​20634)
• Include best-effort information about the active environment in uv workspace metadata by default (#​20643)

Performance

• Skip dependency-group conflict expansion when no additional conflicts can be inferred (#​20611)

Bug fixes

• Fork universal resolutions when Requires-Python is discovered only from distribution metadata (#​20586)

Install uv 0.11.32

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"

Download uv 0.11.32

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.11.31

Compare Source

Release Notes

Released on 2026-07-21.

Enhancements

• Allow workspace sources to reference members in another workspace by path (#​18401)
• Support .venv files containing paths to centralized project environments (#​20022)
• Update bundled Windows timezone data to IANA 2026c (#​20554)

Preview features

• Add an index-specific hash-algorithm setting for lockfile generation (#​20605)

Configuration

• Add audit.malware-check and audit.malware-check-url settings (#​20587)

Performance

• Avoid quadratic work when deduplicating transitive conflicts (#​20578)

Bug fixes

• Suggest --emit-build-options for unsupported uv pip compile --emit-options (#​20582)
• Reject source distributions and wheels with mismatched package names (#​20432)
• Avoid retrying TLS certificate verification failures (#​16245)
• Avoid warnings about uv_build settings for in-tree build backends (#​20153)

Install uv 0.11.31

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"

Download uv 0.11.31

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.11.30

Compare Source

Release Notes

Released on 2026-07-20.

Python

• Add CPython 3.15.0b4 (#​20519)

Preview features

• Allow uv workspace metadata --sync to target the active virtual environment with --active (#​20500)
• Reuse centralized project environments when workspaces are accessed through symlinks (#​20436)

Performance

• Skip resolver candidates whose files are all excluded by exclude-newer (#​20460)
• Limit parallel cache reads to reduce resolver scheduling and allocation overhead (#​20427)
• Accelerate lockfile serialization with toml_writer (#​20450)
• Compact cached Simple API distribution metadata and hashes (#​20463, #​20483)
• Decode stale cache entries in a single blocking task (#​20486)
• Decode cached payloads outside resolver workers (#​20464)
• Cache resolver Python requirement markers (#​20461)
• Reuse resolver fork markers while recording preferences (#​20462)

Bug fixes

• Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall (#​20429)
• Preserve literal extends-environment paths in pyvenv.cfg on Unix (#​20466)

Documentation

• Add a contribution guide (#​20511, #​20552)

Install uv 0.11.30

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.ps1 | iex"

Download uv 0.11.30

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

docker/login-action (docker/login-action)

v4.5.1

Compare Source

• Support dhi.io as Docker Hub OIDC registry by @​crazy-max in #​1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Compare Source

• Docker Hub OIDC login support by @​crazy-max in #​1048
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1091.0 in #​1037
• Bump @​docker/actions-toolkit from 0.92.0 to 0.94.0 in #​1044 #​1050
• Bump brace-expansion from 1.1.13 to 1.1.16 in #​1046
• Bump js-yaml from 5.2.0 to 5.2.1 in #​1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

github/codeql-action (github/codeql-action)

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!