Update astral-sh/setup-uv action to v10 - #52
tag1-renovate-bot[bot] wants to merge 1 commit into
Conversation
SummaryBumps the Type: config Walkthrough (1 file)
AI Review Summary — generated by ai-pr-review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Review: Approved
🟡 Overall Risk: Medium | Findings: 1 (1 inline)
No Critical or High findings. The changes look good — Medium/Low findings are informational only.
🔵 Out-of-diff analyzer findings (3) — pre-existing issues on unchanged lines, capped to Low
- 🔵 [Low] [F1] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:24(line not in diff)) - 🔵 [Low] [F2] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:58(line not in diff)) - 🔵 [Low] [F3] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:85(line not in diff))
Token usage by agent
| Agent | Model | Input | Output | Cache Write | Cache Read | Total | Est. Cost |
|---|---|---|---|---|---|---|---|
| code-reviewer | Sonnet 5 | 1 | 27 / 16384 | 7487 | 0 | 7515 | $0.0284 |
| judge-pass | Sonnet 5 | 994 | 191 | 1197 | 0 | 2382 | $0.0103 |
| Total | 995 | 218 | 8684 | 0 | 9897 | $0.0387 | |
| Language profiles | (profile) | 723 | — | — | — | — | — |
AI Review — generated by ai-pr-review
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v9.0.0 | ||
| uses: astral-sh/setup-uv@v10.0.0 |
There was a problem hiding this comment.
🟡 [Medium] [F4] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
Remediation: See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
There was a problem hiding this comment.
AI Review: Approved
🟡 Overall Risk: Medium | Findings: 1 (1 inline)
No Critical or High findings. The changes look good — Medium/Low findings are informational only.
🔵 Out-of-diff analyzer findings (3) — pre-existing issues on unchanged lines, capped to Low
- 🔵 [Low] [F1] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:24(line not in diff)) - 🔵 [Low] [F2] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:58(line not in diff)) - 🔵 [Low] [F3] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:85(line not in diff))
Token usage by agent
| Agent | Model | Input | Output | Cache Write | Cache Read | Total | Est. Cost |
|---|---|---|---|---|---|---|---|
| code-reviewer | Sonnet 5 | 1 | 27 / 16384 | 7487 | 0 | 7515 | $0.0284 |
| judge-pass | Sonnet 5 | 994 | 191 | 1197 | 0 | 2382 | $0.0103 |
| Total | 995 | 218 | 8684 | 0 | 9897 | $0.0387 | |
| Language profiles | (profile) | 723 | — | — | — | — | — |
AI Review — generated by ai-pr-review
581fca4 to
e7b5fc7
Compare
There was a problem hiding this comment.
AI Review: Approved
🟡 Overall Risk: Medium | Findings: 1 (1 inline)
No Critical or High findings. The changes look good — Medium/Low findings are informational only.
🔵 Out-of-diff analyzer findings (3) — pre-existing issues on unchanged lines, capped to Low
- 🔵 [Low] [F1] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:24(line not in diff)) - 🔵 [Low] [F2] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:58(line not in diff)) - 🔵 [Low] [F3] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:85(line not in diff))
Token usage by agent
| Agent | Model | Input | Output | Cache Write | Cache Read | Total | Est. Cost |
|---|---|---|---|---|---|---|---|
| code-reviewer | Sonnet 5 | 1 | 18 / 16384 | 7486 | 0 | 7505 | $0.0283 |
| judge-pass | Sonnet 5 | 994 | 178 | 1197 | 0 | 2369 | $0.0101 |
| Total | 995 | 196 | 8683 | 0 | 9874 | $0.0384 | |
| Language profiles | (profile) | 723 | — | — | — | — | — |
AI Review — generated by ai-pr-review
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v9.0.0 | ||
| uses: astral-sh/setup-uv@v10.0.1 |
There was a problem hiding this comment.
🟡 [Medium] [F4] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
Remediation: See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
There was a problem hiding this comment.
AI Review: Approved
🟡 Overall Risk: Medium | Findings: 1 (1 inline)
No Critical or High findings. The changes look good — Medium/Low findings are informational only.
🔵 Out-of-diff analyzer findings (3) — pre-existing issues on unchanged lines, capped to Low
- 🔵 [Low] [F1] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:24(line not in diff)) - 🔵 [Low] [F2] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:58(line not in diff)) - 🔵 [Low] [F3] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:85(line not in diff))
Token usage by agent
| Agent | Model | Input | Output | Cache Write | Cache Read | Total | Est. Cost |
|---|---|---|---|---|---|---|---|
| code-reviewer | Sonnet 5 | 1 | 18 / 16384 | 7486 | 0 | 7505 | $0.0283 |
| judge-pass | Sonnet 5 | 994 | 178 | 1197 | 0 | 2369 | $0.0101 |
| Total | 995 | 196 | 8683 | 0 | 9874 | $0.0384 | |
| Language profiles | (profile) | 723 | — | — | — | — | — |
AI Review — generated by ai-pr-review
e7b5fc7 to
c8a87bb
Compare
There was a problem hiding this comment.
AI Review: Approved
🟡 Overall Risk: Medium | Findings: 3 (1 inline)
No Critical or High findings. The changes look good — Medium/Low findings are informational only.
🔵 Out-of-diff analyzer findings (3) — pre-existing issues on unchanged lines, capped to Low
- 🔵 [Low] [F1] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:24(line not in diff) ↗) - 🔵 [Low] [F2] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:58(line not in diff) ↗) - 🔵 [Low] [F3] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:85(line not in diff) ↗)
Review cost: $0.0451 · 11,589 tokens · 1 agent · Sonnet 5 · full breakdown
AI Review — generated by ai-pr-review
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v9.0.0 | ||
| uses: astral-sh/setup-uv@v10.1.0 |
There was a problem hiding this comment.
🟡 [Medium] [F4] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
Remediation: See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
There was a problem hiding this comment.
AI Review: Approved
🟡 Overall Risk: Medium | Findings: 3 (1 inline)
No Critical or High findings. The changes look good — Medium/Low findings are informational only.
🔵 Out-of-diff analyzer findings (3) — pre-existing issues on unchanged lines, capped to Low
- 🔵 [Low] [F1] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:24(line not in diff) ↗) - 🔵 [Low] [F2] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:58(line not in diff) ↗) - 🔵 [Low] [F3] [semgrep] yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. (at.github/workflows/ci.yml:85(line not in diff) ↗)
Review cost: $0.0451 · 11,589 tokens · 1 agent · Sonnet 5 · full breakdown
AI Review — generated by ai-pr-review
This PR contains the following updates:
v9.0.0→v10.1.0Release Notes
astral-sh/setup-uv (astral-sh/setup-uv)
v10.1.0: 🌈 New outputpython-runtime-idand respect NO_PROXYCompare Source
Changes
This release adds more bheind the scene security improvements and also 2 small improvements.
NO_PROXY
This action now respects
no_proxy/NO_PROXYenvironment variables which were previously ignored.New output
python-runtime-idThe new output
python-runtime-idcan be used to know which python version exactly was installed if you useactivate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v10.0.1: 🌈 Tolerate transient manifest timeoutsCompare Source
Changes
Thank you @arguile- for making this action more resilient.
🐛 Bug fixes
🧰 Maintenance
📚 Documentation
v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL featuresCompare Source
Changes
Another breaking release, directly after v9.0.0 but we think the added security justifies that.
Extra security by default
If you use the default
enable-cache: autothis will now DISABLE THE CACHE to protect against cache poisoning for the following events:pull_request_targetworkflow_runreleaseYou can read the full reasoning in #984
version: latest-knownThis will now install the latest version with a checksum that is known by this action. The known
uvchecksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.Read python version from
.tool-versionsWill now also set the python version if it is defined in
.tool-versions. You can read the details in the docs🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.