Repository navigation
chore(ci): bump github-actions group (setup-uv, codecov, taiki-e) - #2070
Merged
Merged
Conversation
Corrected subset of the dependabot group bump in #2067. Applies the safe action updates and drops the two that break CI. Applied: - astral-sh/setup-uv v7 -> v8.2.0 - codecov/codecov-action v6 (e79a696 -> fb8b358) - taiki-e/install-action v2 (4bc351f -> 7a79fe8) for the generic `with: tool:` installs (cargo-vet, coreutils, cargo-llvm-cov) Dropped (would break CI): - dtolnay/rust-toolchain @nightly (5b84223 -> e081816) broke the Pyodide/Emscripten wheel build: wasm32-unknown-emscripten std was no longer installed for the pinned nightly. - taiki-e/install-action @cargo-tarpaulin tag (3d6bdc4 -> 7a79fe8) collapsed the tool-specific tag into a generic release SHA, so `cargo tarpaulin` was no longer installed (Generate Rust Coverage failed with `no such command: tarpaulin`).
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 97b7896 | Commit Preview URL Branch Preview URL |
Jun 15 2026, 06:24 PM |
There was a problem hiding this comment.
Pull request overview
This PR fixes CI regressions introduced by a prior grouped Dependabot update by keeping the safe GitHub Actions bumps (setup-uv, Codecov, taiki-e install-action for generic tool installs) while avoiding the two action-ref changes that broke specific CI jobs.
Changes:
- Bump
astral-sh/setup-uvfrom v7 to v8.2.0 across Python/coverage/publish workflows. - Bump
taiki-e/install-action(v2) commit pin used for genericwith: tool:installs (cargo-vet, coreutils, cargo-llvm-cov). - Bump
codecov/codecov-action(v6) commit pin used in the coverage upload job.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/python.yml | Updates astral-sh/setup-uv pin to v8.2.0 for Python CI jobs. |
| .github/workflows/publish-python.yml | Updates astral-sh/setup-uv pin to v8.2.0 for release inspection/publish steps. |
| .github/workflows/coverage.yml | Updates taiki-e/install-action pin for cargo-llvm-cov, updates setup-uv pin, and bumps Codecov action pin. |
| .github/workflows/ci.yml | Updates taiki-e/install-action pin for cargo-vet and coreutils installs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Corrected subset of the Dependabot group bump in #2067. That PR's grouped update collapsed two semantically-named action refs into generic release SHAs, which broke CI. This PR keeps the safe updates and drops the two regressions.
What
Applied (safe):
astral-sh/setup-uvv7 → v8.2.0codecov/codecov-actionv6 (e79a696→fb8b358)taiki-e/install-actionv2 (4bc351f→7a79fe8) for the genericwith: tool:installs (cargo-vet, coreutils, cargo-llvm-cov)Dropped from #2067 (break CI):
dtolnay/rust-toolchain@nightly(5b84223→e081816) — broke Build wheel (Pyodide/Emscripten):wasm32-unknown-emscriptenstd was no longer installed for the pinned nightly (error[E0463]: can't find crate for std).taiki-e/install-action@cargo-tarpaulintag (3d6bdc4→7a79fe8) — the tool-specific tag was collapsed into a generic release SHA, so the step no longer installed tarpaulin. Generate Rust Coverage failed witherror: no such command: tarpaulin.Why
#2067's CI was red on those two jobs (plus the
Python Checkaggregator). PR #2069, which had no action bumps, passed all of them — confirming both failures were introduced by the grouped bump, not pre-existing. (#2067 also hit a transient rustup cache flake onBuild wheel, unrelated to the bumps.)Verification
YAML validated for all touched workflows. Behavior is validated by CI itself running green on this PR.
Supersedes #2067.
Generated by Claude Code