chore(deps): bump github/codeql-action/init from 4.38.1 to 4.38.2

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.1 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/codeql-analysis.yml

@@ -47,7 +47,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           source-root: src

README.md

@@ -27,7 +27,7 @@ Set up your GitHub Actions workflow with a specific version of [uv](https://docs
 
 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
 ```
 
 If you do not specify a version, this action will look for a [required-version](https://docs.astral.sh/uv/reference/settings/#required-version)
@@ -43,7 +43,7 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed
 
 ```yaml
 - name: Install uv with all available options
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     # The version of uv to install, e.g., "0.5.0", "latest", or "latest-known" (default: searches for version in config files, then latest)
     version: ""
@@ -161,7 +161,7 @@ python 3.13
 ```
 
 ```yaml
-- uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+- uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version-file: ".tool-versions"
 ```
@@ -172,7 +172,7 @@ a warning.
 
 ```yaml
 - name: Install the latest version of uv and set the python version to 3.13t
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     python-version: 3.13t
 - run: uv pip install --python=3.13t pip
@@ -190,7 +190,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - name: Install the latest version of uv and set the python version
-        uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: ${{ matrix.python-version }}
       - name: Test with python ${{ matrix.python-version }}
@@ -226,7 +226,7 @@ It also controls where [the venv gets created](#activate-environment), unless `v
 
 ```yaml
 - name: Install uv based on the config files in the working-directory
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     working-directory: my/subproject/dir
 ```
@@ -268,7 +268,7 @@ For example:
 - name: Checkout the repository
   uses: actions/checkout@main
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
 - name: Test
@@ -280,7 +280,7 @@ To install a specific version of Python, use
 
 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
 - name: Install Python 3.12
@@ -299,7 +299,7 @@ output:
   uses: actions/checkout@main
 - name: Install the default version of uv
   id: setup-uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
 - name: Print the installed version
   run: echo "Installed uv version is ${{ steps.setup-uv.outputs.uv-version }}"
 ```

__tests__/cache/save-cache.test.ts

@@ -0,0 +1,87 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+import { CacheLocalSource, type SetupInputs } from "../../src/utils/inputs";
+import { createSetupInputs } from "../helpers/setup-inputs";
+
+const mockSaveCache = jest.fn<() => Promise<number>>();
+const mockInfo = jest.fn();
+const mockLoadInputs = jest.fn<() => SetupInputs>(() =>
+  createSetupInputs({ enableCache: false }),
+);
+const state: Record<string, string> = {};
+
+jest.unstable_mockModule("@actions/cache", () => ({
+  saveCache: mockSaveCache,
+}));
+
+jest.unstable_mockModule("@actions/core", () => ({
+  getState: jest.fn((name: string) => state[name] ?? ""),
+  setFailed: jest.fn(),
+}));
+
+jest.unstable_mockModule("../../src/utils/inputs", () => ({
+  loadInputs: mockLoadInputs,
+}));
+
+jest.unstable_mockModule("../../src/utils/logging", () => ({
+  info: mockInfo,
+  warning: jest.fn(),
+}));
+
+jest.spyOn(process, "exit").mockImplementation((() => undefined) as never);
+
+const { run } = await import("../../src/save-cache");
+
+const cacheDir = mkdtempSync(join(tmpdir(), "setup-uv-save-cache-"));
+const cacheKey = "setup-uv-2-x86_64-unknown-linux-gnu-ubuntu-24.04-3.12-hash";
+
+function infoMessages(): string[] {
+  return mockInfo.mock.calls.map(([msg]) => msg as string);
+}
+
+beforeEach(() => {
+  delete process.env.UV_CACHE_DIR;
+  state["cache-key"] = cacheKey;
+  state["cache-matched-key"] = "";
+  mockLoadInputs.mockReturnValue(
+    createSetupInputs({
+      cacheLocalPath: { path: cacheDir, source: CacheLocalSource.Input },
+    }),
+  );
+});
+
+afterAll(() => {
+  rmSync(cacheDir, { force: true, recursive: true });
+});
+
+describe("saveCache", () => {
+  it("reports the saved key when the cache is saved", async () => {
+    mockSaveCache.mockResolvedValue(42);
+
+    await run();
+
+    expect(mockSaveCache).toHaveBeenCalledWith([cacheDir], cacheKey);
+    expect(infoMessages()).toContain(`uv cache saved with key: ${cacheKey}`);
+  });
+
+  it("does not report the cache as saved when saving fails", async () => {
+    // @actions/cache logs the failure itself and returns -1
+    mockSaveCache.mockResolvedValue(-1);
+
+    await run();
+
+    expect(mockSaveCache).toHaveBeenCalledWith([cacheDir], cacheKey);
+    expect(infoMessages()).not.toContain(
+      `uv cache saved with key: ${cacheKey}`,
+    );
+  });
+});

__tests__/download/download-version.test.ts

@@ -146,6 +146,28 @@ describe("download-version", () => {
       expect(mockGetAllVersions).not.toHaveBeenCalled();
     });
 
+    it("resolves ~= with PEP 440 compatible release semantics", async () => {
+      mockGetFirstMatchingVersion.mockImplementation(
+        (predicate: (version: string) => boolean) =>
+          ["1.0.0", "0.10.2", "0.9.26"].find(predicate),
+      );
+
+      const version = await resolveVersion("~=0.9", undefined);
+
+      expect(version).toBe("0.10.2");
+    });
+
+    it("resolves ~= with PEP 440 compatible release semantics from manifest-file", async () => {
+      mockGetAllVersions.mockResolvedValue(["1.0.0", "0.10.2", "0.9.26"]);
+
+      const version = await resolveVersion(
+        "~=0.9",
+        "https://example.com/custom.ndjson",
+      );
+
+      expect(version).toBe("0.10.2");
+    });
+
     it("treats == exact pins as explicit versions", async () => {
       const version = await resolveVersion("==0.9.26", undefined);
 

__tests__/version/requirements-file.test.ts

@@ -35,3 +35,14 @@ test("strips PEP 508 markers from requirements dependencies", () => {
 
   expect(parsedVersion).toBe("==0.11.20");
 });
+
+test.each([
+  ["uv >= 0.5.0", ">=0.5.0"],
+  ["uv == 0.11.20", "==0.11.20"],
+  ["uv>=0.5.0, <0.6.0", ">=0.5.0,<0.6.0"],
+  ["uv >= 0.5.0 , < 0.6.0", ">=0.5.0,<0.6.0"],
+  ["uv==0.11.20 --hash=sha256:abc", "==0.11.20"],
+  ["uv==0.11.20  # pinned for CI", "==0.11.20"],
+])("allows whitespace in the uv specifier %s", (dependency, expected) => {
+  expect(getUvVersionFromRequirementsText(dependency)).toBe(expected);
+});

dist/save-cache/index.cjs

@@ -66671,9 +66671,11 @@ async function saveCacheToKey(cacheKey, cachePath, stateKey, cacheName) {
     return;
   }
   info2(`Including ${cacheName} path: ${cachePath}`);
-  await saveCache2([cachePath], cacheKey);
+  const cacheId = await saveCache2([cachePath], cacheKey);
+  if (cacheId !== -1) {
     info2(`${cacheName} saved with key: ${cacheKey}`);
   }
+}
 __name(saveCacheToKey, "saveCacheToKey");
 run();
 // Annotate the CommonJS export names for ESM import in node:

dist/setup/index.cjs

@@ -101579,7 +101579,7 @@ function getUvVersionFromAllDependencies(allDependencies) {
 }
 function getUvVersionFromDependency(dependency) {
   const dependencyWithoutMarker = dependency.split(";", 1)[0]?.trim();
-  return dependencyWithoutMarker?.match(/^uv([=<>~!]+\S*)/)?.[1].trim();
+  return dependencyWithoutMarker?.match(/^uv\s*((?:[=<>~!]+\s*[^\s,]+\s*,?\s*)+)/)?.[1].replace(/\s/g, "");
 }
 
 // src/version/tool-versions-file.ts
@@ -101937,7 +101937,7 @@ async function resolveVersion(versionInput, manifestUrl, resolutionStrategy = "h
   throw new Error(`No version found for ${versionInput}`);
 }
 async function findHighestSatisfyingVersion(versionSpecifier) {
-  const semverRange = semver5.validRange(versionSpecifier);
+  const semverRange = isCompatibleReleaseSpecifier(versionSpecifier) ? null : semver5.validRange(versionSpecifier);
   if (semverRange !== null) {
     const semverMatch = await getFirstMatchingVersion(
       (version3) => semver5.satisfies(version3, semverRange)
@@ -101959,8 +101959,11 @@ async function findHighestSatisfyingVersion(versionSpecifier) {
   }
   return pep440Match;
 }
+function isCompatibleReleaseSpecifier(versionSpecifier) {
+  return versionSpecifier.includes("~=");
+}
 function maxSatisfying2(versions, version3) {
-  const maxSemver = evaluateVersions(versions, version3);
+  const maxSemver = isCompatibleReleaseSpecifier(version3) ? "" : evaluateVersions(versions, version3);
   if (maxSemver !== "") {
     debug(`Found a version that satisfies the semver range: ${maxSemver}`);
     return maxSemver;
@@ -101975,7 +101978,7 @@ function maxSatisfying2(versions, version3) {
   return void 0;
 }
 function minSatisfying3(versions, version3) {
-  const minSemver = semver5.minSatisfying(versions, version3);
+  const minSemver = isCompatibleReleaseSpecifier(version3) ? null : semver5.minSatisfying(versions, version3);
   if (minSemver !== null) {
     debug(`Found a version that satisfies the semver range: ${minSemver}`);
     return minSemver;

docs/advanced-version-configuration.md

@@ -6,7 +6,7 @@ This document covers advanced options for configuring which version of uv to ins
 
 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: "latest"
 ```
@@ -19,7 +19,7 @@ When `manifest-file` is set, `latest-known` still selects a version from setup-u
 
 ```yaml
 - name: Install the latest version of uv known to setup-uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: "latest-known"
 ```
@@ -28,7 +28,7 @@ When `manifest-file` is set, `latest-known` still selects a version from setup-u
 
 ```yaml
 - name: Install a specific version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: "0.4.4"
 ```
@@ -41,21 +41,21 @@ to install the latest version that satisfies the range.
 
 ```yaml
 - name: Install a semver range of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: ">=0.4.0"
 ```
 
 ```yaml
 - name: Pinning a minor version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: "0.4.x"
 ```
 
 ```yaml
 - name: Install a pep440-specifier-satisfying version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: ">=0.4.25,<0.5"
 ```
@@ -67,7 +67,7 @@ You can change this behavior using the `resolution-strategy` input:
 
 ```yaml
 - name: Install the lowest compatible version of uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: ">=0.4.0"
     resolution-strategy: "lowest"
@@ -92,7 +92,7 @@ as `UV_PYTHON`. Only a single Python version is supported; multiple fallback ver
 
 ```yaml
 - name: Install uv based on the version defined in pyproject.toml
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version-file: "pyproject.toml"
 ```
@@ -103,7 +103,7 @@ silently picking up a newer uv until the lockfile is updated.
 
 ```yaml
 - name: Install uv based on the version locked in uv.lock
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version-file: "uv.lock"
 ```

docs/caching.md

@@ -24,7 +24,7 @@ The computed cache key is available as the `cache-key` output:
 ```yaml
 - name: Setup uv
   id: setup-uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
 - name: Print cache key
@@ -54,7 +54,7 @@ You can optionally define a custom cache key suffix.
 ```yaml
 - name: Enable caching and define a custom cache key suffix
   id: setup-uv
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     cache-suffix: "optional-suffix"
@@ -93,7 +93,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Define a cache dependency glob
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     cache-dependency-glob: "**/pyproject.toml"
@@ -101,7 +101,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Define a list of cache dependency globs
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     cache-dependency-glob: |
@@ -111,7 +111,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Define an absolute cache dependency glob
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     cache-dependency-glob: "/tmp/my-folder/requirements*.txt"
@@ -119,7 +119,7 @@ changes. If you use relative paths, they are relative to the working directory.
 
 ```yaml
 - name: Never invalidate the cache
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     cache-dependency-glob: ""
@@ -132,7 +132,7 @@ By default, the cache will be restored.
 
 ```yaml
 - name: Don't restore an existing cache
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     restore-cache: false
@@ -148,7 +148,7 @@ these events. Set `save-cache: true` to save the cache for all events.
 
 ```yaml
 - name: Don't save the cache after the run
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     save-cache: false
@@ -174,7 +174,7 @@ It defaults to `setup-uv-cache` in the `TMP` dir, `D:\a\_temp\setup-uv-cache` on
 
 ```yaml
 - name: Define a custom uv cache path
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     cache-local-path: "/path/to/cache"
 ```
@@ -191,7 +191,7 @@ If you want to prune the cache before saving it, enable cache pruning with the `
 
 ```yaml
 - name: Prune the cache before saving it
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     prune-cache: true
@@ -210,7 +210,7 @@ To force managed Python installs, set `UV_PYTHON_PREFERENCE=only-managed`.
 
 ```yaml
 - name: Cache Python installs
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     cache-python: true
@@ -228,7 +228,7 @@ If you want to ignore this, set the `ignore-nothing-to-cache` input to `true`.
 
 ```yaml
 - name: Ignore nothing to cache
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     enable-cache: true
     ignore-nothing-to-cache: true

docs/customization.md

@@ -11,7 +11,7 @@ You can specify a checksum to override those values. The sha256 hashes can also
 
 ```yaml
 - name: Install a specific version and validate the checksum
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     version: "0.3.1"
     checksum: "e11b01402ab645392c7ad6044db63d37e4fd1e745e015306993b07695ea5f9f8"
@@ -40,7 +40,7 @@ The `archive_format` field is currently ignored.
 
 ```yaml
 - name: Use a custom manifest file
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     manifest-file: "https://example.com/my-custom-manifest.ndjson"
 ```
@@ -59,7 +59,7 @@ You can disable this by setting the `add-problem-matchers` input to `false`.
 
 ```yaml
 - name: Install the latest version of uv without problem matchers
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     add-problem-matchers: false
 ```

docs/environment-and-tools.md

@@ -9,7 +9,7 @@ This allows directly using it in later steps:
 
 ```yaml
 - name: Install the latest version of uv and activate the environment
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     activate-environment: true
 - run: uv pip install pip
@@ -32,7 +32,7 @@ key: build-${{ runner.os }}-${{ runner.arch }}-${{ steps.setup-uv.outputs.python
 You can customize the venv location with `venv-path`, for example to place it in the runner temp directory:
 
 ```yaml
-- uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+- uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     activate-environment: true
     venv-path: ${{ runner.temp }}/custom-venv
@@ -63,7 +63,7 @@ are not sufficient, you can provide a custom GitHub token with the necessary per
 
 ```yaml
 - name: Install the latest version of uv with a custom GitHub token
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
 ```
@@ -81,7 +81,7 @@ input:
 
 ```yaml
 - name: Install the latest version of uv with a custom tool dir
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     tool-dir: "/path/to/tool/dir"
 ```
@@ -100,7 +100,7 @@ If you want to change this behaviour (especially on self-hosted runners) you can
 
 ```yaml
 - name: Install the latest version of uv with a custom tool bin dir
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     tool-bin-dir: "/path/to/tool-bin/dir"
 ```
@@ -117,7 +117,7 @@ This action supports expanding the `~` character to the user's home directory fo
 
 ```yaml
 - name: Expand the tilde character
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     cache-local-path: "~/path/to/cache"
     tool-dir: "~/path/to/tool/dir"
@@ -134,7 +134,7 @@ If you want to ignore this, set the `ignore-empty-workdir` input to `true`.
 
 ```yaml
 - name: Ignore empty workdir
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     ignore-empty-workdir: true
 ```
@@ -160,7 +160,7 @@ This action sets several environment variables that influence uv's behavior and
 
 ```yaml
 - name: Example using environment variables
-  uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+  uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
   with:
     python-version: "3.12"
     tool-dir: "/custom/tool/dir"

src/save-cache.ts

@@ -159,8 +159,10 @@ async function saveCacheToKey(
   }
 
   log.info(`Including ${cacheName} path: ${cachePath}`);
-  await cache.saveCache([cachePath], cacheKey);
+  const cacheId = await cache.saveCache([cachePath], cacheKey);
+  if (cacheId !== -1) {
     log.info(`${cacheName} saved with key: ${cacheKey}`);
   }
+}
 
 run();

src/version/requirements-file.ts

@@ -69,5 +69,7 @@ function getUvVersionFromAllDependencies(
 
 function getUvVersionFromDependency(dependency: string): string | undefined {
   const dependencyWithoutMarker = dependency.split(";", 1)[0]?.trim();
-  return dependencyWithoutMarker?.match(/^uv([=<>~!]+\S*)/)?.[1].trim();
+  return dependencyWithoutMarker
+    ?.match(/^uv\s*((?:[=<>~!]+\s*[^\s,]+\s*,?\s*)+)/)?.[1]
+    .replace(/\s/g, "");
 }

src/version/resolve.ts

@@ -169,7 +169,9 @@ async function findHighestSatisfyingVersion(
 ): Promise<string | undefined> {
   // This fast path assumes uv releases are semver-monotonic: newer manifest
   // entries always have higher versions, with no lower-version backports.
-  const semverRange = semver.validRange(versionSpecifier);
+  const semverRange = isCompatibleReleaseSpecifier(versionSpecifier)
+    ? null
+    : semver.validRange(versionSpecifier);
   if (semverRange !== null) {
     const semverMatch = await getFirstMatchingVersion((version) =>
       semver.satisfies(version, semverRange),
@@ -193,11 +195,22 @@ async function findHighestSatisfyingVersion(
   return pep440Match;
 }
 
+/**
+ * `~=` is the PEP 440 compatible release operator. semver accepts it as a
+ * tilde range with a narrower upper bound (`~=0.5` as `<0.6.0` instead of
+ * `<1.0`), so it must only be evaluated as PEP 440.
+ */
+function isCompatibleReleaseSpecifier(versionSpecifier: string): boolean {
+  return versionSpecifier.includes("~=");
+}
+
 function maxSatisfying(
   versions: string[],
   version: string,
 ): string | undefined {
-  const maxSemver = tc.evaluateVersions(versions, version);
+  const maxSemver = isCompatibleReleaseSpecifier(version)
+    ? ""
+    : tc.evaluateVersions(versions, version);
   if (maxSemver !== "") {
     core.debug(`Found a version that satisfies the semver range: ${maxSemver}`);
     return maxSemver;
@@ -218,7 +231,9 @@ function minSatisfying(
   versions: string[],
   version: string,
 ): string | undefined {
-  const minSemver = semver.minSatisfying(versions, version);
+  const minSemver = isCompatibleReleaseSpecifier(version)
+    ? null
+    : semver.minSatisfying(versions, version);
   if (minSemver !== null) {
     core.debug(`Found a version that satisfies the semver range: ${minSemver}`);
     return minSemver;