From 221973547e136521f5b36609b7d01b24c9bb2ddd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 04:25:21 +0000 Subject: [PATCH 1/3] build(deps): bump the actions-deps group across 1 directory with 8 updates Bumps the actions-deps group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.3.2` | `10.3.3` | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.3` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `7.0.0` | `7.1.1` | | [re-actors/alls-green](https://github.com/re-actors/alls-green) | `1.2.2` | `1.3.0` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v7...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `astral-sh/setup-uv` from 8.3.2 to 10.3.3 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...68559e99cc807c1eb7e9238fd43a15bba460eec2) Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/5fda3b95a4ea91299a34e894583c3862153e4b97...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0) Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc) Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/cef221092ed1bacb1cc03d23a2d87d1d172e277b...7245906fb61fa33a13554f9d5fb856fe61758086) Updates `codecov/codecov-action` from 7.0.0 to 7.1.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/fb8b3582c8e4def4969c97caa2f19720cb33a72f...303a32d7a59b442fa8d48b6a1cc6825c09c847a5) Updates `re-actors/alls-green` from 1.2.2 to 1.3.0 - [Release notes](https://github.com/re-actors/alls-green/releases) - [Commits](https://github.com/re-actors/alls-green/compare/05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe...b5b5b37504aa4183270bd3d855c52a67f212be35) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: astral-sh/setup-uv dependency-version: 10.3.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: codecov/codecov-action dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: re-actors/alls-green dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps ... Signed-off-by: dependabot[bot] --- .github/workflows/build.yaml | 4 ++-- .github/workflows/build_image.yml | 6 +++--- .github/workflows/release.yaml | 6 +++--- .github/workflows/test.yaml | 8 ++++---- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 6cca7d4d7..de14f5cee 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -17,13 +17,13 @@ jobs: package: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - name: Build package run: uv build - name: Check package diff --git a/.github/workflows/build_image.yml b/.github/workflows/build_image.yml index 031f1e480..9041689dd 100644 --- a/.github/workflows/build_image.yml +++ b/.github/workflows/build_image.yml @@ -38,7 +38,7 @@ jobs: persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.x" @@ -83,13 +83,13 @@ jobs: - name: Login to GitHub Container Registry if: ${{ env.skip_build == 'false' }} - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 if: ${{ env.skip_build == 'false' }} env: IMAGE_TAG: ${{ env.REGISTRY }}/scverse/spatialdata:${{ env.IMAGE_TAG_SUFFIX }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index bb5a0bbf7..ced9482bc 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -18,16 +18,16 @@ jobs: contents: read id-token: write # IMPORTANT: this permission is mandatory for trusted publishing steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: false - name: Build package run: uv build - name: Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 7f92f751b..c81f0e6ba 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -23,13 +23,13 @@ jobs: envs: ${{ steps.get-envs.outputs.envs }} steps: - &clone - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: filter: blob:none fetch-depth: 0 persist-credentials: false - &setup-uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - name: Get test environments id: get-envs run: | @@ -82,7 +82,7 @@ jobs: uvx hatch run ${{ matrix.env.name }}:cov-report # report visibly uvx hatch run ${{ matrix.env.name }}:coverage xml # create report for upload - name: Upload coverage - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: fail_ci_if_error: true use_oidc: true @@ -106,6 +106,6 @@ jobs: - lint runs-on: ubuntu-latest steps: - - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2 + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 with: jobs: ${{ toJSON(needs) }} From 0fa6329f223743d7e5e6f97b447165a257d0ecc2 Mon Sep 17 00:00:00 2001 From: Ajayrama Kumaraswamy Date: Mon, 9 Nov 2026 18:03:03 +0100 Subject: [PATCH 2/3] fix (ci/build.yaml): disable uv cache small effect, but makes it consistent with release.yaml --- .github/workflows/build.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index de14f5cee..352b9a2d0 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -24,6 +24,8 @@ jobs: persist-credentials: false - name: Install uv uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + with: + enable-cache: false - name: Build package run: uv build - name: Check package From 22883425a95fc9f3af9809facbfb49e8e5406006 Mon Sep 17 00:00:00 2001 From: Ajayrama Kumaraswamy Date: Mon, 9 Nov 2026 18:04:13 +0100 Subject: [PATCH 3/3] feat(ci/test.yaml): explicitly enable uv cache pruning action v10 sets change default behaviour to no cache pruning most runs need to get new versions anyway, and uv env setup is much faster than actual testing --- .github/workflows/test.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index c81f0e6ba..e13afce72 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -30,6 +30,8 @@ jobs: persist-credentials: false - &setup-uv uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + with: + prune-cache: true - name: Get test environments id: get-envs run: |