chore(deps): bump astral-sh/setup-uv from 4.2.0 to 8.0.0

[dependabot]

Bumps astral-sh/setup-uv from 4.2.0 to 8.0.0.

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.0.0 🌈 Immutable releases and secure tags

This is the first immutable release of setup-uv 🥳

All future releases are also immutable, if you want to know more about what this means checkout the docs.

This release also has two breaking changes

New format for manifest-file

The previously deprecated way of defining a custom version manifest to control which uv versions are available and where to download them from got removed. The functionality is still there but you have to use the new format.

No more major and minor tags

To increase security even more we will stop publishing minor tags. You won't be able to use @v8 or @v8.0 any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to tj-actions.

[!TIP] Use the immutable tag as a version astral-sh/setup-uv@v8.0.0 Or even better the githash astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57

🚨 Breaking changes

• Remove update-major-minor-tags workflow @​eifinger (#826)
• Remove deprecrated custom manifest @​eifinger (#813)

🧰 Maintenance

• Shortcircuit latest version from manifest @​eifinger (#828)
• Simplify inputs.ts @​eifinger (#827)
• Bump release-drafter to v7.1.1 @​eifinger (#825)
• Refactor inputs @​eifinger (#823)
• Replace inline compile args with tsconfig @​eifinger (#824)
• chore: update known checksums for 0.11.2 @github-actions[bot] (#821)
• chore: update known checksums for 0.11.1 @github-actions[bot] (#817)
• chore: update known checksums for 0.11.0 @github-actions[bot] (#815)
• Fix latest-version workflow check @​eifinger (#812)
• chore: update known checksums for 0.10.11/0.10.12 @github-actions[bot] (#811)

v7.6.0 🌈 Fetch uv from Astral's mirror by default

Changes

We now default to download uv from releases.astral.sh. This means by default we don't hit the GitHub API at all and shouldn't see any rate limits and timeouts any more.

🚀 Enhancements

• Fetch uv from Astral's mirror by default @​zsol (#809)

🧰 Maintenance

• Switch to ESM for source and test, use CommonJS for dist @​eifinger (#806)
• chore: update known checksums for 0.10.10 @github-actions[bot] (#804)

... (truncated)

Commits

• cec2083 Shortcircuit latest version from manifest (#828)
• 4dd8ab4 Simplify inputs.ts (#827)
• 7fdbe7c Remove update-major-minor-tags workflow (#826)
• 485abd0 Bump release-drafter to v7.1.1 (#825)
• f82eb19 Refactor inputs (#823)
• 868d1f7 Replace inline compile args with tsconfig (#824)
• 447e6d0 chore: update known checksums for 0.11.2 (#821)
• 5c62c59 chore: update known checksums for 0.11.1 (#817)
• e1a7373 chore: update known checksums for 0.11.0 (#815)
• 8970931 Remove deprecrated custom manifest (#813)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[greptile-apps]

Greptile Summary

This PR bumps astral-sh/setup-uv from v4.2.0 to v8.0.0 in the test workflow, using secure commit-hash pinning throughout.

• The only changed line updates the pinned commit hash from 38f3f104447c67c051c4a08e39b64a148898af3a (v4.2.0) to cec208311dfd045dd5311c1add060b2062131d57 (v8.0.0).
• v8.0.0 introduces two breaking changes: removal of the deprecated manifest-file format and discontinuation of major/minor floating tags (e.g. @v8). Neither affects this workflow, which uses neither manifest-file nor floating tags.
• A notable improvement in v7.6.0+ is that uv is now downloaded from releases.astral.sh by default (instead of hitting the GitHub API), which should reduce rate-limit and timeout issues in CI.
• The workflow already follows the security best practice recommended in the v8.0.0 release notes by pinning to a full commit SHA rather than a mutable tag.

Confidence Score: 5/5

Safe to merge — a clean, automated dependency bump with commit-hash pinning and no breaking changes affecting the current workflow inputs.

The change is a single-line update to a commit hash, generated by Dependabot. Both breaking changes in v8.0.0 (deprecated manifest-file format removal and no more floating major/minor tags) are irrelevant to this workflow. No inputs were removed or renamed that this workflow relies on. Commit-hash pinning is already in use, satisfying the security recommendation from the v8.0.0 release notes.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/test.yml	Bumps astral-sh/setup-uv from v4.2.0 (commit hash pinned) to v8.0.0 (commit hash pinned); no inputs used that are affected by the breaking changes in v8.0.0.

Sequence Diagram

sequenceDiagram
    participant GHA as GitHub Actions Runner
    participant checkout as actions/checkout@v4.3.1
    participant setupuv as astral-sh/setup-uv@v8.0.0
    participant uv as uv CLI

    GHA->>checkout: Checkout source code
    GHA->>setupuv: Install uv (enable-cache: true)
    Note over setupuv: Downloads uv from releases.astral.sh (new default in v7.6.0+)
    setupuv-->>GHA: uv available in PATH
    GHA->>uv: uv python install 3.11
    GHA->>uv: uv sync --extra dev
    GHA->>uv: uv run ruff check src/ tests/
    GHA->>uv: uv run pytest --tb=short -v --cov=hippofloop

Loading

_{Reviews (1): Last reviewed commit: "chore(deps): bump astral-sh/setup-uv fro..." | Re-trigger Greptile}