From dd73dc1fd0007a05c739901db6de6e431065781f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 07:11:53 +0000 Subject: [PATCH] chore(deps): bump the github-actions group with 2 updates Bumps the github-actions group with 2 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `astral-sh/setup-uv` from 10.0.1 to 10.1.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/20cfd1bf945f4377ade1205e4dbc17946fc9a30d...bec219d24cd3e171d82865faccec33120bb574f4) Updates `github/codeql-action/upload-sarif` from 4.37.9 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/deps-watch.yml | 2 +- .github/workflows/governance-advisory.yml | 2 +- .github/workflows/governance-benchmark.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/selector-probe.yml | 2 +- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 23c694010..6b99e78e7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,7 +43,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Audit locked dependencies for known CVEs # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln # @@ -80,7 +80,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Audit workflows (zizmor) # --offline: the online audits need a GH token and reach the network, so @@ -116,7 +116,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Set up Python run: uv python install 3.13 @@ -172,7 +172,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Set up Python run: uv python install ${{ matrix.python-version }} @@ -260,7 +260,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Set up Python run: uv python install 3.13 diff --git a/.github/workflows/deps-watch.yml b/.github/workflows/deps-watch.yml index b144addbf..d16eea73e 100644 --- a/.github/workflows/deps-watch.yml +++ b/.github/workflows/deps-watch.yml @@ -33,7 +33,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Set up Python run: uv python install 3.13 diff --git a/.github/workflows/governance-advisory.yml b/.github/workflows/governance-advisory.yml index ae151dc7d..19d534f7c 100644 --- a/.github/workflows/governance-advisory.yml +++ b/.github/workflows/governance-advisory.yml @@ -25,7 +25,7 @@ jobs: fetch-depth: 0 # full history so `git diff origin/..HEAD` resolves - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Classify touched paths (advisory, never blocks) # BASE_REF arrives through `env:`, never interpolated into the script diff --git a/.github/workflows/governance-benchmark.yml b/.github/workflows/governance-benchmark.yml index 8e7b1fc43..5607d68ba 100644 --- a/.github/workflows/governance-benchmark.yml +++ b/.github/workflows/governance-benchmark.yml @@ -24,7 +24,7 @@ jobs: fetch-depth: 0 # full history — the backtest replays every commit - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - name: Run backtest (advisory; writes to job summary) run: uv run python scripts/dev/materiality_backtest.py >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8034c7ff3..6678a76e0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,7 +29,7 @@ jobs: fetch-depth: 0 - name: Install uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: # This is the one workflow that publishes artefacts (PyPI + GitHub # Release), so it must not restore a cache any other workflow can diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index dc18405ad..3c3652c60 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -47,6 +47,6 @@ jobs: retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 with: sarif_file: results.sarif diff --git a/.github/workflows/selector-probe.yml b/.github/workflows/selector-probe.yml index f62c00abe..f2c9a2365 100644 --- a/.github/workflows/selector-probe.yml +++ b/.github/workflows/selector-probe.yml @@ -16,7 +16,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: { persist-credentials: false } - - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 - run: uv sync --frozen - run: uv run playwright install chromium --with-deps - name: Probe