[jayaddison]

Purpose

Given the current state-of-affairs, Dependabot won't automatically upgrade to the recently-published immutable astral-sh GitHub Actions releases, because they do not have major-version-only semver tags (v7 exists for astral-sh/setup-uv, for example, but v8 does not -- instead only v8.0.0 does).

I'm opening this as a draft pull request because I haven't yet reviewed the diffs in the source repositories for the actions -- and also because it'd be worthwhile to build a collective sense about whether this is a worthwhile change before applying it.

References

Refs:

• Dependabot fails to upgrade setup-uv from v7 to v8.0.0 dependabot/dependabot-core#14713
• Release v8.0.0 does not work with v8 or v8.0 astral-sh/setup-uv#830

Edit: action-name fixup (was: uv, intended: setup-uv)
Edit: pull request is now flagged ready-for-review, so add strikethrough to part of this description

[jayaddison]

I'm opening this as a draft pull request because I haven't yet reviewed the diffs in the source repositories for the actions -- and also because it'd be worthwhile to build a collective sense about whether this is a worthwhile change before applying it.

From review of astral-sh/setup-uv:v7.6.0...v8.0.0 and astral-sh/ruff-action:v3.6.1...v4.0.0: those changesets seem OK to me.

[timhoffm]

Pinning exact versions makes sense. And with dependabot structured updates are easy.

The changes in version bumps of the actions look ok.

[jayaddison]

Thanks @timhoffm

[jayaddison]

NB: a few incremental releases of the astral-sh/setup-uv action (latest: v10.3.2) have taken place since the last update here (ref: v10.0.1); it would probably be worth reviewing the latest changes there, and perhaps to update to the latest tag if all looks well. The astral-sh/ruff-action references are still to the latest release tag (v4.1.0), at the time-of-writing.