build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 - #14
build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0#14dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughBoth release and test workflows update the pinned ChangesCI action updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/test.yml (1)
45-45: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winMake CI cache pruning explicit.
This update changes
prune-cachefromtruetofalse. The test workflow will now retain unused uv cache entries. Setprune-cache: trueif the previous CI cache behavior is intended.uvdocuments cache pruning as the CI-oriented way to reduce cache size. (github.com)Proposed fix
- name: Set up uv uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + with: + prune-cache: true🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test.yml at line 45, Update the setup-uv configuration in the test workflow to explicitly set prune-cache: true, preserving the prior CI behavior of removing unused uv cache entries.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 39: Update the setup-uv action configuration in the release job to
explicitly disable cache restoration by setting its cache option to false; do
not rely on prune-cache, and leave the action version and other workflow
behavior unchanged.
---
Nitpick comments:
In @.github/workflows/test.yml:
- Line 45: Update the setup-uv configuration in the test workflow to explicitly
set prune-cache: true, preserving the prior CI behavior of removing unused uv
cache entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 49049055-b834-47a9-82e8-e5d480abd4fd
📒 Files selected for processing (2)
.github/workflows/release.yml.github/workflows/test.yml
|
|
||
| - name: Set up uv | ||
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | ||
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- release workflow ---'
sed -n '1,140p' .github/workflows/release.yml
printf '%s\n' '--- setup-uv references and cache settings ---'
rg -n -C 3 'setup-uv|enable-cache|prune-cache|cache' .github/workflows .github 2>/dev/null || true
printf '%s\n' '--- repository metadata relevant to release inputs ---'
rg -n -C 2 'release event|release:|publish|build|uv sync|uv run|uv build|uv publish' .github/workflows pyproject.toml uv.lock 2>/dev/null || trueRepository: Xquik-dev/xquik-haystack
Length of output: 8682
🌐 Web query:
zizmor setup-uv release workflow enable-cache false cache poisoning guidance
💡 Result:
The zizmor security tool flags the use of caching in GitHub Actions workflows—specifically with astral-sh/setup-uv—as a potential cache poisoning vulnerability if the workflow triggers on events that can be influenced by untrusted or lower-privilege actors (e.g., push events to branches or tags, or pull_request_target triggers) [1][2][3]. When a sensitive or privileged job (such as a release or publish workflow) restores a cache that was populated by a less-privileged job, an attacker may be able to inject malicious content into that cache [3]. Subsequent restoration of this poisoned cache in the privileged job can then lead to unauthorized code execution or the exfiltration of secrets, such as OIDC tokens [3]. Guidance for addressing this zizmor finding: 1. Understanding the Risk: If your release or build workflow uses astral-sh/setup-uv and is triggered by events that allow external contributors (like pull requests or tag pushes), you are potentially exposed to cache poisoning [1][3]. The recommendation is to disable caching in these specific jobs [4][1][3]. 2. Remediation: To mitigate this, explicitly disable caching in your workflow steps where artifact building or publishing occurs by setting enable-cache to false [4][1][2]. - example: - uses: astral-sh/setup-uv@v6 with: enable-cache: false 3. Zizmor's Audit Rules: Zizmor includes a specific audit rule (cache-poisoning) designed to detect these scenarios [5][4][1]. Note that there have been reports of bugs where zizmor's automatic fix suggestions might have initially proposed an incorrect configuration; always verify that your remediation correctly disables caching when that is your intended security posture [5][6]. 4. Best Practice: In environments where reproducibility is paramount and the performance benefits of caching are not critical (such as final release jobs), disabling the cache is the standard security control [1][3]. For more information, refer to the documentation for zizmor at https://docs.zizmor.sh/ and the astral-sh/setup-uv caching documentation at https://github.com/astral-sh/setup-uv/blob/main/docs/caching.md [7][8].
Citations:
- 1: ci(api-docs): disable uv cache to close cache-poisoning alert (#44) resq-software/pypi#48
- 2: resq-software/pypi@de461aa
- 3: https://nesbitt.io/2026/05/25/github-actions-security-in-python-packages.html
- 4: C3EQUALZz/dishka-ag2@c3e7172
- 5: [BUG]: uv cache poisoning result is flipped zizmorcore/zizmor#1081
- 6: Add Fix for cache-poisoning audit rule zizmorcore/zizmor#923
- 7: https://docs.zizmor.sh/
- 8: https://github.com/astral-sh/setup-uv/blob/main/docs/caching.md
🌐 Web query:
astral-sh/setup-uv v9 enable-cache default cache dependency cache documentation
💡 Result:
In astral-sh/setup-uv v9, caching is managed through several specific input configurations [1][2]. Key Caching Features and Configuration: - enable-cache: This input controls whether the uv cache is uploaded to the GitHub Actions cache [1]. It accepts true, false, or auto [2]. When set to auto (the default), caching is enabled only on GitHub-hosted runners and disabled on self-hosted runners [2][3]. - cache-dependency-glob: You can use this input to specify a glob pattern (e.g., /uv.lock, /pyproject.toml) to control cache invalidation [1][2]. The GitHub Actions cache will be invalidated and recalculated if any file matching the pattern changes [1][4]. By default, it monitors standard dependency files like lock files, requirements files, and pyproject.toml [2][5]. - prune-cache: As of v9.0.0, the default value for prune-cache is false [6]. When enabled (true), the action runs cache pruning before saving the cache to reduce storage size [1][4]. Disabling it (the default) persists the entire cache, which may increase GitHub Actions cache usage [6]. - Caching Logic: The action computes a cache key based on the dependency files matched by cache-dependency-glob, as well as the platform, OS version, and CPU architecture [1][4]. If an existing cache matches the generated key, it is restored; otherwise, the workflow proceeds without it [2][4]. You can further customize caching behavior using restore-cache (to enable/disable restoration), save-cache (to enable/disable saving), and cache-local-path (to define where the cache is stored on the runner) [2][5]. Detailed documentation can be found in the docs/caching.md file within the repository [1][4].
Citations:
- 1: https://github.com/astral-sh/setup-uv/blob/main/docs/caching.md
- 2: https://github.com/astral-sh/setup-uv/blob/main/README.md
- 3: https://github.com/astral-sh/setup-uv/blob/06e4edb2/src/utils/inputs.ts
- 4: https://github.com/astral-sh/setup-uv/blob/224c887d/docs/caching.md
- 5: https://github.com/astral-sh/setup-uv?tab=readme-ov-file
- 6: https://github.com/astral-sh/setup-uv/releases/tag/v9.0.0
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- lockfile and Hatch environment configuration ---'
sed -n '1,180p' pyproject.toml
printf '%s\n' '--- lockfile presence and size ---'
if [ -f uv.lock ]; then
wc -l uv.lock
sed -n '1,40p' uv.lock
else
echo 'uv.lock not present'
fi
printf '%s\n' '--- workflow permissions and cache actions ---'
rg -n -C 2 'permissions:|actions/cache|setup-uv|uv tool|hatch run|hatch build' .github/workflowsRepository: Xquik-dev/xquik-haystack
Length of output: 8886
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- test workflow triggers and jobs ---'
sed -n '1,90p' .github/workflows/test.yml
printf '%s\n' '--- setup-uv v9 action metadata ---'
curl -fsSL https://raw.githubusercontent.com/astral-sh/setup-uv/c771a70e6277c0a99b617c7a806ffedaca235ff9/action.yml | sed -n '1,220p'
printf '%s\n' '--- setup-uv v9 cache documentation ---'
curl -fsSL https://raw.githubusercontent.com/astral-sh/setup-uv/c771a70e6277c0a99b617c7a806ffedaca235ff9/docs/caching.md | sed -n '1,240p'
printf '%s\n' '--- zizmor cache-poisoning guidance ---'
curl -fsSL https://docs.zizmor.sh/audits/ | rg -n -C 8 'cache-poison|setup-uv|release|enable-cache' | head -160Repository: Xquik-dev/xquik-haystack
Length of output: 22747
Disable setup-uv caching in the release job.
The release workflow restores the uv cache by default. A poisoned cache can execute during linting, tests, or builds and compromise published distributions. prune-cache: true does not disable restoration.
Proposed fix
- name: Set up uv
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+ with:
+ enable-cache: false🧰 Tools
🪛 zizmor (1.28.0)
[error] 39-39: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 39, Update the setup-uv action
configuration in the release job to explicitly disable cache restoration by
setting its cache option to false; do not rely on prune-cache, and leave the
action version and other workflow behavior unchanged.
Source: Linters/SAST tools
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@11f9893...c771a70) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
7d6c0a9 to
8112606
Compare
|
Closed as superseded by the consolidated dependency update merged into the default branch. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps astral-sh/setup-uv from 8.3.2 to 9.0.0.
Release notes
Sourced from astral-sh/setup-uv's releases.
Commits
c771a70chore(deps): roll up Dependabot updates (#970)2f537cachore: update known checksums for 0.11.30 (#968)2269552Speed up version client by partial response reads (#807)47a7f4fChangeprune-cachedefault tofalse(#967)71966efchore(deps): roll up Dependabot updates (#962)f12b1f0fix: fall back to distribution ID when os-release has no version field (#961)ecd24ddchore: update known checksums for 0.11.29 (#960)6a19136docs: update version references to v8.3.2 (#949)