Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @soujasK (#1111)
• fix: only report a saved cache when saving succeeded @soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

• docs: update version references to v10.3.1 @github-actions[bot] (#1102)

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @dannyward630 (#1093)

🧰 Maintenance

• chore: update known checksums for 0.13.4 @github-actions[bot] (#1099)
• chore: update known checksums for 0.13.2/0.13.3 @github-actions[bot] (#1098)
• chore: update known checksums for 0.13.1 @github-actions[bot] (#1094)
• Verify npm dependency signatures before builds @zaniebot (#1027)

📚 Documentation

• docs: cache-dependency-glob matches relative to the working directory @flange-ipb (#1092)
• docs: update version references to v10.3.0 @github-actions[bot] (#1090)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#1101)

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

• Use macOS 15 runners for tests @charliermarsh (#1081)

🚀 Enhancements

• Add python-arch support @zanieb (#1079)

🧰 Maintenance

• chore: update known checksums for 0.13.0 @github-actions[bot] (#1089)
• chore: update known checksums for 0.12.24 @github-actions[bot] (#1084)
• chore: update known checksums for 0.12.23 @github-actions[bot] (#1082)
• chore: update known checksums for 0.12.22 @github-actions[bot] (#1080)
• chore: update known checksums for 0.12.21 @github-actions[bot] (#1078)
• chore: update known checksums for 0.12.20 @github-actions[bot] (#1076)
• chore: update known checksums for 0.12.19 @github-actions[bot] (#1068)
• chore: update known checksums for 0.12.18 @github-actions[bot] (#1065)

⬆️ Dependency updates

• chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @dependabot[bot] (#1077)

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

• Disable automatic cache saves for merge queues @eifinger (#1056)

🧰 Maintenance

• chore: update known checksums for 0.12.17 @github-actions[bot] (#1058)
• chore: update known checksums for 0.12.16 @github-actions[bot] (#1057)
• chore: update known checksums for 0.12.15 @github-actions[bot] (#1054)
• chore: update known checksums for 0.12.14 @github-actions[bot] (#1053)
• chore: update known checksums for 0.12.13 @github-actions[bot] (#1045)

📚 Documentation

• docs: update version references to v10.1.0 @github-actions[bot] (#1044)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#1059)

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @mj0nez (#1037)
• Use JSON + a typed wrapper instead of TS codegen @woodruffw (#1025)

🚀 Enhancements

• Expose a Python "identity" output @woodruffw (#1036)
• Verify downloads with astral-sh/versions checksums @zaniebot (#1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @github-actions[bot] (#1041)
• chore: update known checksums for 0.12.10/0.12.11 @github-actions[bot] (#1038)
• chore: update known checksums for 0.12.9 @github-actions[bot] (#1035)
• chore: update known checksums for 0.12.7/0.12.8 @github-actions[bot] (#1031)
• chore: update known checksums for 0.12.6 @github-actions[bot] (#1030)
• chore: update known checksums for 0.12.5 @github-actions[bot] (#1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @woodruffw (#1024)
• Pin one-shot tools @woodruffw (#1022)
• ci: remove obsolete direct push attempts @eifinger (#1019)

📚 Documentation

• docs: update version references to v10.0.1 @github-actions[bot] (#1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @eifinger (#1043)
• Harden npm install defaults @zaniebot (#1026)
• Add dependency cooldowns @woodruffw (#1021)

Changes

Thank you @arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in #984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @eifinger (#992)

🐛 Bug fixes

• Reject paths in .tool-versions @eifinger (#1007)

🚀 Enhancements

• Read Python version from .tool-versions @eifinger (#996)
• Add latest-known version selector @eifinger (#993)

🧰 Maintenance

• Require pull requests for Dependabot rollups @eifinger (#1005)
• ci: pin Alpine container image @eifinger (#995)
• chore: update known checksums for 0.12.3 @github-actions[bot] (#991)
• chore: update known checksums for 0.12.2 @github-actions[bot] (#985)
• chore: update known checksums for 0.12.1 @github-actions[bot] (#982)
• chore: update known checksums for 0.12.0 @github-actions[bot] (#981)
• chore: update known checksums for 0.11.31/0.11.32 @github-actions[bot] (#972)

📚 Documentation

• docs: update version references to v9.0.0 @github-actions[bot] (#971)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#1013)
• chore(deps): roll up Dependabot updates @eifinger (#1004)
• chore(deps): roll up Dependabot updates @eifinger (#994)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @dependabot[bot] (#976)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#980)

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

• Change prune-cache default to false @charliermarsh (#967)

🐛 Bug fixes

• fix: fall back to distribution ID when os-release has no version field @cxzhong (#961)

🚀 Enhancements

• Speed up version client by partial response reads @eifinger (#807)

🧰 Maintenance

• chore: update known checksums for 0.11.30 @github-actions[bot] (#968)
• chore: update known checksums for 0.11.29 @github-actions[bot] (#960)

📚 Documentation

• docs: update version references to v8.3.2 @github-actions[bot] (#949)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#970)
• chore(deps): roll up Dependabot updates @eifinger (#962)

Changes

Just a maintenance release

🧰 Maintenance

• chore: update known checksums for 0.11.28 @github-actions[bot] (#947)

📚 Documentation

• docs: update version references to v8.3.1 @github-actions[bot] (#946)

⬆️ Dependency updates

• chore: roll up Dependabot updates @eifinger (#948)