Repository navigation
chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.2.0 in the github-actions group across 1 directory - #3433
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.
Approve — this is a mechanical, low-risk dependency bump: astral-sh/setup-uv is pinned from v10.0.1 to v10.1.0 (full commit SHA + version comment) across 17 workflow files, with no other logic, permissions, or triggers touched. The inline finding about docs/klaud.md's now-stale pin table is a minor documentation nit, not a functional or security issue with the workflow changes themselves.
Extended reasoning...
Diff is a pure Dependabot version-pin bump of astral-sh/setup-uv (10.0.1 -> 10.1.0) in 17 .github/workflows/*.yml files, each hunk swapping only the pinned SHA and version comment; verified via git diff that no job structure, permissions, secrets, or run: logic changed. No CODEOWNERS entry restricts .github/workflows or docs/klaud.md beyond the default owning team. Confirmed the one reported finding is real (docs/klaud.md:125 still lists the old SHA/version despite line 117's claim that the table reflects current pins) but it is a cosmetic doc-staleness issue, not a bug in the bumped action reference itself, so it does not block approval of this mechanical change.
Additional findings (outside the current diff — GitHub can't attach inline comments there):
-
🟡
docs/klaud.md— Merging this bump makes docs/klaud.md's action-pin table wrong: it still lists astral-sh/setup-uv as v10.0.1 / 20cfd1bf945f, but klaud-candidate.yml and klaud-plan.yml now pin v10.1.0 (bec219d24cd3). Line 117 explicitly promises "the table reflects the current workflow pins," so a maintainer or Klaud agent trusting this doc gets stale, self-contradicting SHA/version info for auditing the candidate/plan workflows' supply chain. Fix: update the astral-sh/setup-uv row (and its zh mirror) whenever any workflow it documents is re-pinned, ideally checked by CI/lint so doc and workflow pins can't drift.Why this was flagged
docs/klaud.md:117 states "All external actions use full commit SHAs; the table reflects the current workflow pins," then the table at line 125 pins astral-sh/setup-uv to v10.0.1 / 20cfd1bf945f4377ade1205e4dbc17946fc9a30d. This PR (verified via git diff) bumps .github/workflows/klaud-candidate.yml:47 and .github/workflows/klaud-plan.yml:49 to astral-sh/setup-uv@ bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 without touching the docs. The identical stale row also exists in docs/klaud_zh.md:125 (its line 117 makes the same "下表与当前工作流中的固定版本一致" claim), so the bilingual pair AGENTS.md requires stays in sync now disagrees with the actual workflow files. Anyone auditing the candidate/plan workflow's action pins via this doc gets an outdated SHA. No safeguard catches this: dependabot only updates workflow files, not docs, and no CI check compares the table to the live pins.
Verification: nit. The discrepancy is real and reachable. The diff bumps both Klaud workflows:
git diffon .github/workflows/klaud-candidate.yml and klaud-plan.yml shows- uses: astral-sh/setup-uv@ 20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1->+ uses: astral-sh/setup-uv@ bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0. No docs file is in the diff (--name-only | grep docsreturns nothing).…
2334a6f to
82dadc3
Compare
dependabot
Bot
changed the title
6c4dbc4 to
c5c6165
Compare
Bumps the github-actions group with 1 update in the / directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 10.0.1 to 10.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@20cfd1b...c18668a) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
c5c6165 to
2889898
Compare
|
Looks like astral-sh/setup-uv is updatable in another way, so this is no longer needed. |
Bumps the github-actions group with 1 update in the / directory: astral-sh/setup-uv.
Updates
astral-sh/setup-uvfrom 10.0.1 to 10.2.0Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
c18668achore(deps): roll up Dependabot updates (#1059)ffe1476chore: update known checksums for 0.12.17 (#1058)f5548c5chore: update known checksums for 0.12.16 (#1057)a761a4eDisable automatic cache saves for merge queues (#1056)3377a30chore: update known checksums for 0.12.15 (#1054)dfb5f38chore: update known checksums for 0.12.14 (#1053)45c121fchore: update known checksums for 0.12.13 (#1045)8073452docs: update version references to v10.1.0 (#1044)bec219dchore(deps-dev): roll up Dependabot updates (#1043)b90ec40fix: respect no proxy directive (#1037)