ci(deps): Bump mamba-org/setup-micromamba from 3.1.0 to 3.2.1 in /.github/actions/setup-env in the actions-composite group across 1 directory

[dependabot]

Bumps the actions-composite group with 1 update in the /.github/actions/setup-env directory: mamba-org/setup-micromamba.

Updates mamba-org/setup-micromamba from 3.1.0 to 3.2.1

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.1

What's Changed

Bug fixes

• fix: Extract prerelease packages on Windows with --force-local by @​jjerphan in mamba-org/setup-micromamba#315

Full Changelog: mamba-org/setup-micromamba@v3.2.0...v3.2.1

v3.2.0

What's Changed

New features

• feat: Support prereleases of micromamba by @​jjerphan in mamba-org/setup-micromamba#310

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

Commits

• f457c30 fix: Extract prerelease packages on Windows with --force-local (#315)
• d6abac3 feat: Support prereleases of micromamba (#310)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated the environment setup process to use the latest pinned setup action version.

[bioedca]

Review lane — Codex leg

• Final head SHA: ca1cddd (see below for the full 40-hex in the merge binding).

• Opened ready rather than as a draft — not a choice made here; Dependabot opens ready. The
  order the draft rule protects was still kept: the unmetered provider read the diff first, and no
  metered provider has been asked yet.

• Codex — first, on the green diff, and not optional: reviewed, nothing blocking. Run locally
  with codex review --base origin/main (CLI 0.147.0, gpt-5.6-sol) in a worktree at this PR's
  head. Its verdict, quoted:

  The patch updates the action to the verified v3.2.1 tag SHA while retaining the pinned
  micromamba binary version. Relevant CI consumers, including the three-OS test matrix,
  completed successfully with no evident regression.

  It verified f457c30a868e4760d3a6fcea5f25dc655b8edf39 against the upstream repository rather
  than trusting the # v3.2.1 comment — which is the one thing worth checking on a SHA-pin bump,
  since the comment is the only human-readable half and nothing enforces that it matches.

• Greptile: skipped (say why) — a one-line uses: SHA bump with no src/, schema, lock or
  logic change. The seat's budget is better spent elsewhere; recording the reason rather than the
  spend, as the lane requires.

• Findings: 0 serious, 0 below the floor on this PR.

One cross-PR note, tracked rather than fixed here

Codex raised on the sibling PR #446 (P2, below the blocking floor) that this pair splits the
setup-micromamba pin across two PRs: .github/actions/setup-env/action.yml moves here, while
packaging.yml and release.yml move there. Landing only one leaves the repository on two
different versions of the same action across seven workflows, including required checks — and
tests/test_marker_contract.py compares only micromamba-version, never the action SHA, so CI
would not say so.

The disposition is land both, which closes it directly rather than deferring it. The missing
guard itself is real and outlives this pair, so it is tracked in #448.

[bioedca]

@coderabbitai full review

Final head ca1cddd797f67b007dfb09c031e2e1547d2400e3. All required checks are green there
(CodeQL reads skipping — this diff touches no code it analyses, which is neutral, not a failure).

The unmetered leg is done and recorded above: Codex read this diff first and reported nothing
blocking, having verified f457c30a868e4760d3a6fcea5f25dc655b8edf39 against the upstream repository
rather than trusting the # v3.2.1 comment. Greptile is recorded as skipped with its reason.

One thing worth your attention specifically, since it is not visible from this diff alone: this is
one half of a Dependabot pair. #446 moves the same action to the same SHA in packaging.yml and
release.yml; this PR moves it in the .github/actions/setup-env composite. Both are being merged,
because landing only one leaves seven workflows — including required checks — on two different
versions of the same action, and tests/test_marker_contract.py compares only micromamba-version,
never the action SHA, so CI would stay green through the split. That missing guard is tracked in #448.

[coderabbitai]

@bioedca I will perform a full review of the final head. I will consider the paired update in #446 and the tracked guard in #448.

---

🧠 Learnings used

Learnt from: bioedca
Repo: bioedca/tether PR: 427
File: CONTRIBUTING.md:392-395
Timestamp: 2026-08-08T21:33:13.669Z
Learning: In bioedca/tether review-governance documentation, do not describe the review lane as having a fixed provider count. Greptile is optional and can be skipped when its seat has no credits, while draft-phase Codex is uncounted. For the ADR-0064 drop-rule rationale, state that a follow-up issue re-enters the same review lane.

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 569d19ea-48f6-4b17-b4c2-bd8c0c2a22b5

📥 Commits

Reviewing files that changed from the base of the PR and between e70a12c and ca1cddd.

📒 Files selected for processing (1)

• .github/actions/setup-env/action.yml

---

📝 Walkthrough

Walkthrough

The composite setup action updates its pinned setup-micromamba revision from v3.1.0 to v3.2.1.

Changes

Setup environment

Layer / File(s)	Summary
Update setup-micromamba revision .github/actions/setup-env/action.yml	The action now uses the pinned setup-micromamba v3.2.1 revision instead of v3.1.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: bioedca

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the dependency update but omits the required Summary, Linked tracking, change type, checklist, and Testing sections.	Add the required template sections and complete the tracking fields, self-review checklist, review records, risk rationale, and testing details.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI dependency update from setup-micromamba 3.1.0 to 3.2.1, although it is longer than necessary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[bioedca]

Gate closed — merging

• Final head SHA: ca1cddd797f67b007dfb09c031e2e1547d2400e3
• Codex (first, unmetered, uncapped): reviewed, nothing blocking. Quoted above.
• Greptile: skipped, reason recorded above. Seat budget untouched.
• CodeRabbit — the last metered gate: no actionable comments. One completed full review, asked
  with the full-review command, at the final head:
  • Permalink: ci(deps): Bump mamba-org/setup-micromamba from 3.1.0 to 3.2.1 in /.github/actions/setup-env in the actions-composite group across 1 directory #445 (comment)
  • Head read: ca1cddd797f67b007dfb09c031e2e1547d2400e3 — stated in its own Commits block as
    the range e70a12c41dc504c4205bf3004a1ff7633ed1afc8 … ca1cddd797f67b007dfb09c031e2e1547d2400e3,
    with .github/actions/setup-env/action.yml as the one file selected for processing.
  • submitted_at: 2026-08-12T02:19:00Z, with the acknowledgement at 02:18:51Z reading
    "Full review finished."
  • What it said: "No actionable comments were generated in the recent review. 🎉"
  • It carries a walkthrough, which is what separates a real review here from the adaptive-limit
    refusal that leaves a green status check and an empty body behind.
• Provider that did not review: none.
• Findings: 0 serious, 0 below the floor on this PR.
• Human sign-off: n/a — no release, tag, signing, or scientific claim.

On the recording shape, since it is not the usual one: this review posted no inline comments,
so GitHub created no review object and the verdict lives on the issue comment linked above rather
than at a #pullrequestreview- permalink with a COMMENTED state. The evidence the gate actually
asks for — which provider, which head, when, and what it found — is all present; it is the container
that differs.

The pair, deliberately not held: #446 moves the same action to the same SHA in packaging.yml
and release.yml and has not closed its gate yet, so merging this leaves .github/actions/setup-env
on v3.2.1 while those two sit on v3.1.0 for as long as that takes. That window is real and named
rather than glossed: nothing is being released through it, only setup-env restores a conda-lock,
and #446 is next in the same lane. Holding a gate-closed PR to chase simultaneity is not something
the contract asks for, and the missing guard that would make such a split visible is tracked in #448.