## Summary
Roll up the remaining dependency changes from eight open Dependabot PRs
against current `main`, without reverting newer workflow settings:
- CodeQL init, analyze, and autobuild: 4.37.7 → 4.38.1 (#1097, #1096,
#1095)
- zizmor-action: 0.6.3 → 0.6.4 (#1085)
- @biomejs/biome: 2.5.9 → 2.5.11, including its schema URL (#1075)
- @types/node: 26.2.0 → 26.4.0 (#1074)
- Jest: 30.4.2 → 30.5.0 (#1073)
- js-yaml: 5.3.0 → 5.4.1 (#1072)
All nine open Dependabot PRs had remaining dependency changes; none was
a no-op. TypeScript 7.0.2 (#1029) is intentionally deferred with
maintainer approval: ts-jest 29.4.11 requires TypeScript <7, and
applying the update caused all 15 test suites to fail before running
with `Cannot read properties of undefined (reading 'readFile')`.
The lockfile was regenerated using npm install with scripts disabled. No
runtime dependency entries changed, and repackaging produced no `dist/`
changes.
## Validation
Using Node 24.19.0 and npm 11.10.0:
- `npm ci --ignore-scripts`
- `npm run all` — passed; 15 test suites, 159 tests; Biome applied no
fixes
- `npm audit signatures` — all 353 audited packages have verified
registry signatures; 38 have verified attestations
- `actionlint .github/workflows/codeql-analysis.yml
.github/workflows/test.yml` — passed
- `uvx zizmor --no-progress --offline
.github/workflows/codeql-analysis.yml .github/workflows/test.yml` — no
findings
- `git diff --check` — passed
Refs: pi-session 01a15ec2-de1a-7557-a0bb-00369b0a4a10
## Summary
- bump `@biomejs/biome` from 2.5.7 to 2.5.8 (#1042)
- bump `@types/node` from 26.1.2 to 26.2.0 (#1039)
- bump `esbuild` from 0.28.1 to 0.28.2 (#1040)
- update the Biome schema URL to 2.5.8
The TypeScript 7.0.2 update from #1029 is intentionally excluded:
`ts-jest` currently declares TypeScript `<7`, and the update causes all
unit suites to fail during ts-jest configuration.
## Validation
- `npm run all` (npm 11.10.0)
Refs: pi-session 01a08ca1-d3b3-7190-a02e-9a955e1b58b0
With the self-repo syntax, we also shouldn't need any of these
`actions/checkout` calls.
Signed-off-by: William Woodruff <william@yossarian.net>
---------
Signed-off-by: William Woodruff <william@yossarian.net>
This just adds some pins to the action tests; these tests don't rely on
the packages under test being unpinned.
---
<sub>Stack created with <a
href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a
href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>
This does two things:
- Bumps our Dependabot-side cooldowns to 30d
- Adds an NPM-side 7d cooldown
The idea is to give automated cooldowns a longer period, whereas humans
doing maintenance/manual bumps can opt into a newer package as needed.
---
<sub>Stack created with <a
href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a
href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>
## Summary
- remove direct pushes to `main` from the docs update workflow
- remove the same dead push path from the known-checksums workflow
- create update pull requests directly when changes exist
Direct pushes cannot satisfy the repository rule requiring changes
through pull requests.
## Validation
- `npm ci --ignore-scripts`
- `npm run all`
- `actionlint .github/workflows/update-docs.yml
.github/workflows/update-known-checksums.yml`
- `uvx zizmor .github/workflows/update-docs.yml
.github/workflows/update-known-checksums.yml`
Refs: pi-session 019fff9d-7357-783c-8529-65bc5bf562c2
## Summary
- reject path-like uv versions from `.tool-versions`
- reject path-like Python versions from `.tool-versions`
- document the restriction and cover Unix and Windows paths in tests
## Testing
- `npm ci --ignore-scripts`
- `npm run all`
Refs: pi-session 019ff4bb-8b7c-7c4b-8bdf-7c188dfa2e3f
## Summary
- require the Dependabot rollup skill to commit and push validated
changes
- always create a pull request with the `dependencies` label
- report the created PR and label confirmation
## Testing
- `git diff --check`
Refs: pi-session 019ff0f1-1aee-7691-8a2c-7c708812f7b0
## Summary
Roll up the remaining dependency changes from Dependabot PRs #997, #998,
#999, #1000, #1001, #1002, and #1003:
- update `github/codeql-action` to 4.37.6
- update `zizmorcore/zizmor-action` to 0.6.2
- update `undici` to 8.10.0
- update `smol-toml` to 1.7.1
- update `@biomejs/biome` and its schema to 2.5.6
- regenerate the published bundles
PRs #905 and #907 were excluded because their requested Jest and pep440
versions are already present on `main`.
## Validation
- `npm run all`
- `actionlint .github/workflows/codeql-analysis.yml
.github/workflows/test.yml`
- `uvx zizmor .github/workflows/codeql-analysis.yml
.github/workflows/test.yml`
- `git diff --check`
Refs: pi-session 019ff0c9-8e00-72d3-99ad-d4383a4c57d4
## Summary
Roll up the remaining net changes from the open Dependabot updates:
- release-drafter/release-drafter 7.7.0 (#990)
- github/codeql-action 4.37.4 (#987, #988, #989)
- zizmorcore/zizmor-action 0.6.1 (#986)
- @actions/cache 6.2.0 (#975)
- @biomejs/biome 2.5.4 (#974)
- undici 8.7.0 (#973)
The Jest 30.4.2 (#905) and @renovatebot/pep440 5.0.0 (#907) updates are
already present on main and require no additional changes.
This also updates the Biome schema, applies the formatter changes from
Biome 2.5.4, and regenerates the published bundles.
## Testing
- `npm run all`
- `actionlint`
- `git diff --check`
Refs: pi-session 019ff01b-f917-73c1-950e-2966956f263c
## Summary
- add `latest-known` as an explicit version selector
- resolve it locally to the newest version in the bundled checksum table
- preserve existing default and `latest` behavior
- document custom-manifest checksum semantics and update published
bundles
## Testing
- `npm ci --ignore-scripts`
- `npm run all` (99 tests passed)
Closes#919
Refs: pi-session 019fed0e-6019-7504-911b-bd9955cbbd49
## Summary
- disable `enable-cache: auto` for `pull_request_target`,
`workflow_run`, and `release` events
- disable automatic caching for tag pushes while leaving branch pushes
unchanged
- preserve explicit `enable-cache: true` as an override
- run a `workflow_run` integration fixture with `act` in pull request CI
and verify caching is disabled
- document the behavior and update the published bundles
## Testing
- `npm run all`
- `actionlint .github/workflows/test.yml
__tests__/workflows/workflow-run.yml`
- `uvx zizmor __tests__/workflows/workflow-run.yml`
Closes#984
Refs: pi-session 019fec42-9b26-714e-a359-830ac4401ecd
## Summary
Roll up the remaining dependency changes from Dependabot PRs:
- #966: update `actions/setup-node` from 6.4.0 to 7.0.0
- #965: update `js-yaml` from 4.1.1 to 5.2.1
- #964: update `@types/node` from 26.0.1 to 26.1.1
- #963: update `esbuild` from 0.28.0 to 0.28.1
PRs #907 and #905 require no net changes because `@renovatebot/pep440`
5.0.0 and Jest 30.4.2 are already on `main`.
## Validation
- `npm run all`
Refs: pi-session 019f854e-4714-73ad-8de2-e79900f41b4d
## Summary
- update all CodeQL actions from 4.36.2 to 4.37.0
- update `smol-toml` from 1.6.1 to 1.7.0
- update `@types/node` from 25.5.0 to 26.0.1
- update `@vercel/ncc` from 0.44.0 to 0.44.1
- regenerate bundled action artifacts
Supersedes #950, #951, #952, #957, #958, and #959. The updates from #905
and #907 are already present on `main`.
Refs: pi-session 019f796d-a374-7a76-a8e4-1699b89ec8e6
## Summary
- roll up remaining open Dependabot updates for zizmor-action,
@actions/cache, @biomejs/biome, and @vercel/ncc
- update Biome schema and migrate recommended rules to the new preset
field
- regenerate dist bundles
## Validation
- npm run check
- npm run all
Refs: pi-session 019f4055-b39c-778f-9d9f-092115939c33
## Summary
- strip PEP 508 environment markers before extracting uv versions from
dependency entries
- cover dependency-group pins with and without whitespace before the
marker
- cover requirements-style pins with markers
Fixes#920
## Validation
- npm ci --ignore-scripts
- npm run all
Refs: pi-session 019f316a-4108-7975-892f-ee5bf8abc7c3
## Summary
- URL-encode the Python version component before adding it to the cache
key
- URL-encode the user-provided cache suffix for the same reason
- Add cache key tests for Python ranges, comma-containing suffixes, and
unchanged simple inputs
Fixes#914
Refs: pi-session 019f3164-85e7-7817-bffd-501d89b3a1fd
## Tests
- npm run all
## Summary
- Roll up open Dependabot npm and GitHub Actions updates
- Update Biome schema to 2.4.16
- Regenerate bundled dist artifacts
## Validation
- npm run all
Refs: pi-session 019f3160-c4af-7606-b4be-648e0abff131
- replace the docs update tag-push trigger with manual and reusable
workflow entrypoints
- call the docs update reusable workflow after publishing a release
- keep manual docs updates available by selecting the latest semver tag
Refs: pi-session 019f2352-565c-7f60-b96b-f2546fb1690f
Rolls up the current open Dependabot npm updates:
- #848 esbuild from 0.27.5 to 0.28.0
- #847 undici from 8.0.0 to 8.3.0
- #846 ts-jest from 29.4.9 to 29.4.11
- #841 @biomejs/biome from 2.4.10 to 2.4.15, including the matching
biome.json schema URL update
Validation:
- npm run all
Updates the dependabot-pr-rollup skill to document that @biomejs/biome
dependency updates must also update the matching schema URL version in
biome.json.
Rolls up the current open Dependabot npm updates:
- #848 esbuild from 0.27.4 to 0.27.5
- #847 undici from 7.24.2 to 8.0.0
- #846 ts-jest from 29.4.6 to 29.4.9
- #841 @biomejs/biome from 2.4.7 to 2.4.10, including the matching
biome.json schema URL update
- #834 smol-toml from 1.6.0 to 1.6.1
Validation:
- npm run all
## Summary
Adds a new `quiet` input (default: `false`) that suppresses `info`-level
log output when set to `true`. Only warnings and errors are shown.
Contributes to: #868
## Summary
Add a new boolean input `download-from-astral-mirror` (default: `true`)
that controls whether uv is downloaded from the Astral mirror or
directly from GitHub Releases.
When set to `false`, the mirror rewrite is skipped entirely and the
download goes straight to GitHub Releases.
Closes: #870
## Summary
- add top-level uncaughtException and unhandledRejection handlers for
the save-cache entrypoint
- report unexpected post-action failures through core.setFailed with
stack/context
- regenerate the committed save-cache bundle
## Summary
- add top-level uncaughtException and unhandledRejection handlers for
the setup entrypoint
- report unexpected failures through core.setFailed with stack/context
- regenerate the committed setup bundle
## Problem
The release workflow fails at the `validate-release` job because `gh
release view` cannot find draft releases. This is because the job only
has `contents: read` permission, but GitHub requires `contents: write`
to view draft releases.
See failed run:
https://github.com/astral-sh/setup-uv/actions/runs/24528604608
## Fix
Bump `validate-release` job permissions from `contents: read` to
`contents: write`, matching the `release` job which already has this
permission.
Update all README and docs examples to use the pinned v8 release SHA for
astral-sh/setup-uv, with a comment showing the release version for
clarity and best practices.
## Summary
- make the latest-version workflow test use the action output for the
exact installed version
- allow `uv --version` to include additional platform/build metadata
- keep validating that the reported version matches the latest GitHub
release
## Testing
- npm ci --ignore-scripts
- npm run all
- actionlint .github/workflows/test.yml
Fixes the failure in
https://github.com/astral-sh/setup-uv/actions/runs/23332230171/job/67866051063
## Summary
- replace the root `AGENTS.md` symlink with a real file
- move the agent instructions out of `.github/copilot-instructions.md`
into `AGENTS.md`
- trim the content down to concise, repo-specific guidance and add a
short repository orientation
## Testing
- not run (docs-only change)
## Summary
- add a reusable skill for the Dependabot PR rollup workflow
- place it under `.agents/skills/` for cross-client discovery
- keep the skill aligned with the Agent Skills standard and
client-agnostic
## Details
- adds `.agents/skills/dependabot-pr-rollup/SKILL.md`
- documents the workflow for:
- finding open Dependabot PRs
- comparing PR heads to their base branch
- replaying only net dependency changes in a fresh worktree
- running `npm run all`
- optionally committing, pushing, and opening a PR
## Notes
- `.agents/skills/` is the shared interoperability location used across
multiple coding agents
- no code changes
- tests not run (documentation-only skill)
## Summary
- replicate the currently open Dependabot dependency updates in a single
branch
- update `smol-toml` to `^1.6.0`
- update `@biomejs/biome` to `2.3.8`
- regenerate `package-lock.json` and bundled `dist` output
## Notes
- `main` already includes the open Octokit Dependabot bumps, so those
PRs required no additional net changes here
- the open `smol-toml` Dependabot PR currently resolves to `^1.6.0`,
which is what this branch mirrors
## Validation
- `npm run all`
## Summary
- keep the Dependabot build workflow single-job, but harden it a bit
- replace `git-auto-commit-action` with explicit `git` commands and
step-scoped push auth
- add concurrency, a timeout, stricter Dependabot gating, and a guard
for moved PR heads
## Why
The workflow currently fails in the commit step because
`actions/checkout` uses `persist-credentials: false`, but
`git-auto-commit-action` later tries to push via `origin` without any
credentials:
```
fatal: could not read Username for 'https://github.com': No such device or address
```
This change fixes that failure while keeping credentials scoped to the
push step instead of persisting them for the whole job.
## Details
- require `github.event.pull_request.user.login == 'dependabot[bot]'`
- also require the PR head repo to match `github.repository`
- also require the head ref to start with `dependabot/`
- check out the exact PR head SHA
- run `npm ci --ignore-scripts`
- disable git hooks before commit
- skip the dist commit if the PR head moved during the run
## Validation
- `actionlint .github/workflows/dependabot-build.yml`
This commit splits up the "normal" cache containing the dependencies and
the "python" cache containing the python binaries. This will lead to a
one-time invalidation of caches.
Closes: #713
The test-no-python-version test was failing because hatchling's
dependency on pathspec was incompatible with Python 3.9,
causing a TypeError during the build process.
Fixed by switching from hatchling to uv_build backend
(0.9.22-0.10.0 range) which is fully compatible with
Python 3.9. The uv.lock file is updated to reflect the
new build backend and latest compatible versions of dependencies.
## Summary
- Adds OS name and version (e.g., `ubuntu-22.04`, `macos-14`,
`windows-2022`) to cache keys to prevent binary incompatibility when
GitHub updates runner images
- Fixes issue where cached uv binaries compiled against older
glibc/library versions fail on newer runner OS versions
## Changes
- Added `getOSNameVersion()` function to `src/utils/platforms.ts` with
OS-specific detection for Linux (via `/etc/os-release`), macOS (Darwin
kernel version mapping), and Windows
- Updated cache key format to include OS version, bumped `CACHE_VERSION`
to `"2"`
- Added `cache-key` output to expose the generated cache key for
debugging
- Added `test-cache-key-os-version` job testing across multiple OS
versions
- Updated `docs/caching.md` with cache key documentation
Closes#703
