Compare commits

..
Author SHA1 Message Date
dependabot[bot]andGitHub 3050ded628 chore(deps): bump github/codeql-action/autobuild from 4.38.1 to 4.38.2
Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.38.1 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-10-26 10:54:41 +00:00
10 changed files with 13 additions and 189 deletions
+1 -1
View File
@@ -59,7 +59,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
+1 -1
View File
@@ -242,7 +242,7 @@ describe("download-version", () => {
"token",
),
).rejects.toThrow(
"Could not find artifact for version 0.9.26, arch x86_64, platform unknown-linux-gnu in https://releases.astral.sh/github/versions/main/v1/uv.ndjson .",
"Could not find artifact for version 0.9.26, arch x86_64, platform unknown-linux-gnu in https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson .",
);
expect(mockDownloadTool).not.toHaveBeenCalled();
+1 -73
View File
@@ -96,78 +96,6 @@ describe("manifest", () => {
expect(versions).toHaveLength(2);
expect(versions[0]?.version).toBe("0.9.26");
expect(versions[1]?.version).toBe("0.9.25");
expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
"https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
]);
});
it("falls back to GitHub after mirror network retries are exhausted", async () => {
jest.useFakeTimers();
mockFetch
.mockRejectedValueOnce(new Error("mirror unavailable"))
.mockRejectedValueOnce(new Error("mirror unavailable"))
.mockRejectedValueOnce(new Error("mirror unavailable"))
.mockResolvedValueOnce(
createMockResponse(true, 200, "OK", sampleManifestResponse),
);
const result = fetchManifest();
await jest.runAllTimersAsync();
await expect(result).resolves.toEqual([
expect.objectContaining({ version: "0.9.26" }),
expect.objectContaining({ version: "0.9.25" }),
]);
expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
"https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
"https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
"https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
"https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson",
]);
await expect(getLatestVersion()).resolves.toBe("0.9.26");
expect(mockFetch).toHaveBeenCalledTimes(4);
});
it.each([404, 429, 503])(
"falls back to a streaming GitHub manifest on mirror HTTP %s",
async (status) => {
mockFetch
.mockResolvedValueOnce(createMockResponse(false, status, "Error", ""))
.mockResolvedValueOnce(
createStreamingMockResponse([`${sampleManifestResponse}\n`]),
);
await expect(getLatestVersion()).resolves.toBe("0.9.26");
await expect(
getArtifact("0.9.26", "aarch64", "apple-darwin"),
).resolves.toEqual({
archiveFormat: "tar.gz",
checksum:
"fcf0a9ea6599c6ae28a4c854ac6da76f2c889354d7c36ce136ef071f7ab9721f",
downloadUrl:
"https://github.com/astral-sh/uv/releases/download/0.9.26/uv-aarch64-apple-darwin.tar.gz",
});
expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
"https://releases.astral.sh/github/versions/main/v1/uv.ndjson",
"https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson",
]);
},
);
it("does not fall back from a custom manifest", async () => {
mockFetch.mockResolvedValue(
createMockResponse(false, 503, "Service Unavailable", ""),
);
await expect(
fetchManifest("https://example.com/custom.ndjson"),
).rejects.toThrow(
"Failed to fetch manifest data: 503 Service Unavailable",
);
expect(mockFetch.mock.calls.map(([url]) => url)).toEqual([
"https://example.com/custom.ndjson",
]);
});
it("retries network failures", async () => {
@@ -195,7 +123,7 @@ describe("manifest", () => {
await jest.runAllTimersAsync();
await result;
expect(mockFetch).toHaveBeenCalledTimes(MANIFEST_FETCH_ATTEMPTS * 2);
expect(mockFetch).toHaveBeenCalledTimes(MANIFEST_FETCH_ATTEMPTS);
});
it("throws on a failed fetch", async () => {
Generated Vendored
+1 -33
View File
@@ -94499,8 +94499,7 @@ function _getGlobal(key, defaultValue) {
var TOOL_CACHE_NAME = "uv";
var STATE_UV_PATH = "uv-path";
var STATE_UV_VERSION = "uv-version";
var VERSIONS_MANIFEST_URL = "https://releases.astral.sh/github/versions/main/v1/uv.ndjson";
var GITHUB_VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
var VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
var GITHUB_RELEASES_PREFIX = "https://github.com/astral-sh/uv/releases/download/";
var ASTRAL_MIRROR_PREFIX = "https://releases.astral.sh/github/uv/releases/download/";
@@ -94510,24 +94509,6 @@ var fs10 = __toESM(require("node:fs"), 1);
// src/download/checksum/known-checksums.json
var known_checksums_default = {
"aarch64-apple-darwin-0.13.6": "60fbd5c8a1ed681845eea28d9d622fcde03c51e91a43465b64a1e17db1ed3472",
"aarch64-pc-windows-msvc-0.13.6": "c2426c0c8e28b53d8c440e47a18d96ad4db51e159866c0e81435b196d7f0081c",
"aarch64-unknown-linux-gnu-0.13.6": "229e194255c7958d86d56e8790d969a6f74736592133f0dfd0076f754c642c1d",
"aarch64-unknown-linux-musl-0.13.6": "819692e404d23e5aae6bc44c0e260f1f5492fd1910ab4693b2c650f926dbe800",
"arm-unknown-linux-musleabihf-0.13.6": "57ac0f7c04deb42c5d686b4eeeef555c442db6ffea16fe4cbd7adb0384403794",
"armv7-unknown-linux-gnueabihf-0.13.6": "d00cd4949c4524c934afcfee1aedfa9d337cf4e43be4d6b692ad8d74d0a65562",
"armv7-unknown-linux-musleabihf-0.13.6": "b215398c886e8cc2cfa282fe346c02025957f8633b75a3d4fd848e0adda4eddd",
"i686-pc-windows-msvc-0.13.6": "32ceb64db231cbedfd499f7654c72e4c0b564f2846f9e76c0a4a7b2d03d7e67c",
"i686-unknown-linux-gnu-0.13.6": "665ea831c38d342900950e606beb2ccc37b7ba0fcefc37b814eb4b076305f2b6",
"i686-unknown-linux-musl-0.13.6": "de3a015c4b0fce63c178ae4fa95c94c873adfd92fa1e258c6a2a94e529812629",
"powerpc64le-unknown-linux-gnu-0.13.6": "3b2847185ec2946fcc928500efef7e3e74c255d3be6f2cb435081a84885d8c6c",
"riscv64gc-unknown-linux-gnu-0.13.6": "517052603ed46483b59d8875c9c61a577946b8f493c73e4339e45e7b119171d0",
"riscv64gc-unknown-linux-musl-0.13.6": "659a95dc6aee3ecf86742a08d8ca6c6261422121cbd41decc0042f5a71af6305",
"s390x-unknown-linux-gnu-0.13.6": "fb56d731308aa5c7718059d71afcb14d9a933a974997cee3d4eb5d06fc462a4b",
"x86_64-apple-darwin-0.13.6": "63ba17fdda55ad1a230d4b37fc6017ffa10c23688c83818bd3bfdf914c652a02",
"x86_64-pc-windows-msvc-0.13.6": "a2a8820d5eea32f08ef467ef3b7f66883a9b076d5737a2fc2fbb5f458d1bb50f",
"x86_64-unknown-linux-gnu-0.13.6": "f29c3e94ffabd7e6f3ba521dba169a9b7ec12100bf3257087f0f24f6123f3645",
"x86_64-unknown-linux-musl-0.13.6": "5d61f26b6c7213779eda90edc6971ea6b0b796bfb8d49a574c8ad69b59838548",
"aarch64-apple-darwin-0.13.5": "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73",
"aarch64-pc-windows-msvc-0.13.5": "09f47edf90726084a70f9426f6e3ca4f46e9bf7cbf23b1716ec64d60b055fae3",
"aarch64-unknown-linux-gnu-0.13.5": "4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403",
@@ -100306,19 +100287,6 @@ async function getArtifact(version3, arch3, platform2, manifestUrl = VERSIONS_MA
};
}
async function fetchManifestResponse(manifestUrl) {
try {
return await fetchManifestResponseFromUrl(manifestUrl);
} catch (error2) {
if (manifestUrl !== VERSIONS_MANIFEST_URL) {
throw error2;
}
info2(
`Failed to fetch manifest from Astral mirror, falling back to GitHub: ${error2.message}`
);
return await fetchManifestResponseFromUrl(GITHUB_VERSIONS_MANIFEST_URL);
}
}
async function fetchManifestResponseFromUrl(manifestUrl) {
let response;
for (let attempt = 1; attempt <= MANIFEST_FETCH_ATTEMPTS; attempt++) {
info2(`Fetching manifest data from ${manifestUrl} ...`);
+1 -33
View File
@@ -47182,24 +47182,6 @@ var semver = __toESM(require_semver(), 1);
// src/download/checksum/known-checksums.json
var known_checksums_default = {
"aarch64-apple-darwin-0.13.6": "60fbd5c8a1ed681845eea28d9d622fcde03c51e91a43465b64a1e17db1ed3472",
"aarch64-pc-windows-msvc-0.13.6": "c2426c0c8e28b53d8c440e47a18d96ad4db51e159866c0e81435b196d7f0081c",
"aarch64-unknown-linux-gnu-0.13.6": "229e194255c7958d86d56e8790d969a6f74736592133f0dfd0076f754c642c1d",
"aarch64-unknown-linux-musl-0.13.6": "819692e404d23e5aae6bc44c0e260f1f5492fd1910ab4693b2c650f926dbe800",
"arm-unknown-linux-musleabihf-0.13.6": "57ac0f7c04deb42c5d686b4eeeef555c442db6ffea16fe4cbd7adb0384403794",
"armv7-unknown-linux-gnueabihf-0.13.6": "d00cd4949c4524c934afcfee1aedfa9d337cf4e43be4d6b692ad8d74d0a65562",
"armv7-unknown-linux-musleabihf-0.13.6": "b215398c886e8cc2cfa282fe346c02025957f8633b75a3d4fd848e0adda4eddd",
"i686-pc-windows-msvc-0.13.6": "32ceb64db231cbedfd499f7654c72e4c0b564f2846f9e76c0a4a7b2d03d7e67c",
"i686-unknown-linux-gnu-0.13.6": "665ea831c38d342900950e606beb2ccc37b7ba0fcefc37b814eb4b076305f2b6",
"i686-unknown-linux-musl-0.13.6": "de3a015c4b0fce63c178ae4fa95c94c873adfd92fa1e258c6a2a94e529812629",
"powerpc64le-unknown-linux-gnu-0.13.6": "3b2847185ec2946fcc928500efef7e3e74c255d3be6f2cb435081a84885d8c6c",
"riscv64gc-unknown-linux-gnu-0.13.6": "517052603ed46483b59d8875c9c61a577946b8f493c73e4339e45e7b119171d0",
"riscv64gc-unknown-linux-musl-0.13.6": "659a95dc6aee3ecf86742a08d8ca6c6261422121cbd41decc0042f5a71af6305",
"s390x-unknown-linux-gnu-0.13.6": "fb56d731308aa5c7718059d71afcb14d9a933a974997cee3d4eb5d06fc462a4b",
"x86_64-apple-darwin-0.13.6": "63ba17fdda55ad1a230d4b37fc6017ffa10c23688c83818bd3bfdf914c652a02",
"x86_64-pc-windows-msvc-0.13.6": "a2a8820d5eea32f08ef467ef3b7f66883a9b076d5737a2fc2fbb5f458d1bb50f",
"x86_64-unknown-linux-gnu-0.13.6": "f29c3e94ffabd7e6f3ba521dba169a9b7ec12100bf3257087f0f24f6123f3645",
"x86_64-unknown-linux-musl-0.13.6": "5d61f26b6c7213779eda90edc6971ea6b0b796bfb8d49a574c8ad69b59838548",
"aarch64-apple-darwin-0.13.5": "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73",
"aarch64-pc-windows-msvc-0.13.5": "09f47edf90726084a70f9426f6e3ca4f46e9bf7cbf23b1716ec64d60b055fae3",
"aarch64-unknown-linux-gnu-0.13.5": "4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403",
@@ -52854,8 +52836,7 @@ var import_node_readline = require("node:readline");
var import_node_stream = require("node:stream");
// src/utils/constants.ts
var VERSIONS_MANIFEST_URL = "https://releases.astral.sh/github/versions/main/v1/uv.ndjson";
var GITHUB_VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
var VERSIONS_MANIFEST_URL = "https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
// src/utils/fetch.ts
var import_undici2 = __toESM(require_undici2(), 1);
@@ -52927,19 +52908,6 @@ async function getLatestVersion(manifestUrl = VERSIONS_MANIFEST_URL) {
return latestVersion;
}
async function fetchManifestResponse(manifestUrl) {
try {
return await fetchManifestResponseFromUrl(manifestUrl);
} catch (error2) {
if (manifestUrl !== VERSIONS_MANIFEST_URL) {
throw error2;
}
info2(
`Failed to fetch manifest from Astral mirror, falling back to GitHub: ${error2.message}`
);
return await fetchManifestResponseFromUrl(GITHUB_VERSIONS_MANIFEST_URL);
}
}
async function fetchManifestResponseFromUrl(manifestUrl) {
let response;
for (let attempt = 1; attempt <= MANIFEST_FETCH_ATTEMPTS; attempt++) {
info2(`Fetching manifest data from ${manifestUrl} ...`);
+2 -4
View File
@@ -20,12 +20,10 @@ You can specify a checksum to override those values. The sha256 hashes can also
## Manifest file
By default, setup-uv reads version metadata from
the [Astral mirror](https://releases.astral.sh/github/versions/main/v1/uv.ndjson).
If the mirror request fails, it falls back to [`astral-sh/versions`](https://github.com/astral-sh/versions).
[`astral-sh/versions`](https://github.com/astral-sh/versions).
The `manifest-file` input lets you override that source with your own URL, for example to test
custom uv builds or alternate download locations. Custom manifest URLs do not fall back to the
default sources.
custom uv builds or alternate download locations.
### Format
+5 -6
View File
@@ -50,13 +50,12 @@ You can customize the venv location with `venv-path`, for example to place it in
## GitHub authentication token
By default, this action fetches version metadata and uv archives from the Astral mirror.
If a manifest request fails, it falls back to `raw.githubusercontent.com`. If an archive download
fails, it falls back to GitHub Releases.
By default, this action resolves available uv versions from
[`astral-sh/versions`](https://github.com/astral-sh/versions), then downloads uv artifacts from
GitHub Releases.
You can provide a token via `github-token` to authenticate GitHub Releases downloads. The token
is not sent to the Astral mirror or used for manifest requests. By default, the `GITHUB_TOKEN`
secret is used, which is automatically provided by GitHub Actions.
You can provide a token via `github-token` to authenticate those downloads. By default, the
`GITHUB_TOKEN` secret is used, which is automatically provided by GitHub Actions.
If the default
[permissions for the GitHub token](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
-18
View File
@@ -1,22 +1,4 @@
{
"aarch64-apple-darwin-0.13.6": "60fbd5c8a1ed681845eea28d9d622fcde03c51e91a43465b64a1e17db1ed3472",
"aarch64-pc-windows-msvc-0.13.6": "c2426c0c8e28b53d8c440e47a18d96ad4db51e159866c0e81435b196d7f0081c",
"aarch64-unknown-linux-gnu-0.13.6": "229e194255c7958d86d56e8790d969a6f74736592133f0dfd0076f754c642c1d",
"aarch64-unknown-linux-musl-0.13.6": "819692e404d23e5aae6bc44c0e260f1f5492fd1910ab4693b2c650f926dbe800",
"arm-unknown-linux-musleabihf-0.13.6": "57ac0f7c04deb42c5d686b4eeeef555c442db6ffea16fe4cbd7adb0384403794",
"armv7-unknown-linux-gnueabihf-0.13.6": "d00cd4949c4524c934afcfee1aedfa9d337cf4e43be4d6b692ad8d74d0a65562",
"armv7-unknown-linux-musleabihf-0.13.6": "b215398c886e8cc2cfa282fe346c02025957f8633b75a3d4fd848e0adda4eddd",
"i686-pc-windows-msvc-0.13.6": "32ceb64db231cbedfd499f7654c72e4c0b564f2846f9e76c0a4a7b2d03d7e67c",
"i686-unknown-linux-gnu-0.13.6": "665ea831c38d342900950e606beb2ccc37b7ba0fcefc37b814eb4b076305f2b6",
"i686-unknown-linux-musl-0.13.6": "de3a015c4b0fce63c178ae4fa95c94c873adfd92fa1e258c6a2a94e529812629",
"powerpc64le-unknown-linux-gnu-0.13.6": "3b2847185ec2946fcc928500efef7e3e74c255d3be6f2cb435081a84885d8c6c",
"riscv64gc-unknown-linux-gnu-0.13.6": "517052603ed46483b59d8875c9c61a577946b8f493c73e4339e45e7b119171d0",
"riscv64gc-unknown-linux-musl-0.13.6": "659a95dc6aee3ecf86742a08d8ca6c6261422121cbd41decc0042f5a71af6305",
"s390x-unknown-linux-gnu-0.13.6": "fb56d731308aa5c7718059d71afcb14d9a933a974997cee3d4eb5d06fc462a4b",
"x86_64-apple-darwin-0.13.6": "63ba17fdda55ad1a230d4b37fc6017ffa10c23688c83818bd3bfdf914c652a02",
"x86_64-pc-windows-msvc-0.13.6": "a2a8820d5eea32f08ef467ef3b7f66883a9b076d5737a2fc2fbb5f458d1bb50f",
"x86_64-unknown-linux-gnu-0.13.6": "f29c3e94ffabd7e6f3ba521dba169a9b7ec12100bf3257087f0f24f6123f3645",
"x86_64-unknown-linux-musl-0.13.6": "5d61f26b6c7213779eda90edc6971ea6b0b796bfb8d49a574c8ad69b59838548",
"aarch64-apple-darwin-0.13.5": "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73",
"aarch64-pc-windows-msvc-0.13.5": "09f47edf90726084a70f9426f6e3ca4f46e9bf7cbf23b1716ec64d60b055fae3",
"aarch64-unknown-linux-gnu-0.13.5": "4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403",
+1 -18
View File
@@ -1,10 +1,7 @@
import { createInterface } from "node:readline";
import { Readable } from "node:stream";
import * as core from "@actions/core";
import {
GITHUB_VERSIONS_MANIFEST_URL,
VERSIONS_MANIFEST_URL,
} from "../utils/constants";
import { VERSIONS_MANIFEST_URL } from "../utils/constants";
import { fetch } from "../utils/fetch";
import * as log from "../utils/logging";
import { selectDefaultVariant } from "./variant-selection";
@@ -170,20 +167,6 @@ export function clearManifestCache(manifestUrl?: string): void {
}
async function fetchManifestResponse(manifestUrl: string) {
try {
return await fetchManifestResponseFromUrl(manifestUrl);
} catch (error) {
if (manifestUrl !== VERSIONS_MANIFEST_URL) {
throw error;
}
log.info(
`Failed to fetch manifest from Astral mirror, falling back to GitHub: ${(error as Error).message}`,
);
return await fetchManifestResponseFromUrl(GITHUB_VERSIONS_MANIFEST_URL);
}
}
async function fetchManifestResponseFromUrl(manifestUrl: string) {
let response: Awaited<ReturnType<typeof fetch>> | undefined;
for (let attempt = 1; attempt <= MANIFEST_FETCH_ATTEMPTS; attempt++) {
log.info(`Fetching manifest data from ${manifestUrl} ...`);
-2
View File
@@ -2,8 +2,6 @@ export const TOOL_CACHE_NAME = "uv";
export const STATE_UV_PATH = "uv-path";
export const STATE_UV_VERSION = "uv-version";
export const VERSIONS_MANIFEST_URL =
"https://releases.astral.sh/github/versions/main/v1/uv.ndjson";
export const GITHUB_VERSIONS_MANIFEST_URL =
"https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson";
/** GitHub Releases URL prefix for uv artifacts. */