Skip to content

Repository navigation

ci: bump the github-actions group with 2 updates - #81

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-87d14250dc
Closed

ci: bump the github-actions group with 2 updates#81
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-87d14250dc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates: astral-sh/setup-uv and jdx/mise-action.

Updates astral-sh/setup-uv from 10.2.0 to 10.3.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

Commits

Updates jdx/mise-action from 5.1.1 to 5.1.2

Release notes

Sourced from jdx/mise-action's releases.

v5.1.2: mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

  • mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#672 by @​jdx, fixes #668) 
    - uses: jdx/mise-action@v5
  with:
    mise_dir: ${{ runner.tool_cache }}/mise/data
  • auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#665 by @​jdx, fixes #664)

Documentation

  • The README explains how to use mise's MISE_ENABLE_TOOLS setting as a job-level allowlist. Unlike install_args, the allowlist applies to the action's install and to later mise commands. If jobs use different allowlists, add the value to a custom cache_key. (#667 by @​zeitlinger)
  • The Rust cache section is updated for mise 2026.9.2 and later, where mise install repairs a restored toolchain instead of leaving rustfmt missing. Swatinem/rust-cache now works alongside mise-managed Rust. (#670 by @​jdx)

Full Changelog: jdx/mise-action@v5.1.1...v5.1.2

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

5.2.2 - 2026-10-21

🐛 Bug Fixes

New Contributors

5.2.1 - 2026-10-19

🐛 Bug Fixes

  • require the signed packslip for mise 2026.9.3 and later (#695) by @​jdx in #695

5.2.0 - 2026-10-16

🚀 Features

  • (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
  • (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
  • verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

  • export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

📚 Documentation

⚙️ Miscellaneous Tasks

... (truncated)

Commits
  • 08ae2a0 chore: release v5.1.2 (#660)
  • 4c1c6f9 chore(ci): switch to jactionlint v2 and drop zizmor (#674)
  • 58185d8 chore(ci): lint workflows with jactionlint (#673)
  • 0e078e4 fix: export mise_dir as MISE_DATA_DIR so mise installs tools there (#672)
  • 64b792f docs: update the Rust cache section for mise 2026.9.2 (#670)
  • d7c6373 ci: fix the upload-artifact version comment (#671)
  • 3df3d8b docs: explain MISE_ENABLE_TOOLS in GitHub Actions (#667)
  • 1ea734b chore(deps): update jdx/renovate-config action to v1.0.2 (#666)
  • 6a90a24 fix: continue with the existing mise when auto-update cannot replace it (#665)
  • b3d6388 chore(deps): update github/codeql-action action to v4.38.2 (#662)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the github-actions group with 2 updates
8a03c04 
Bumps the github-actions group with 2 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) and [jdx/mise-action](https://github.com/jdx/mise-action).


Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c18668a...1c37ad0)

Updates `jdx/mise-action` from 5.1.1 to 5.1.2
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@2d8d4ca...08ae2a0)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: jdx/mise-action
  dependency-version: 5.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@hironow hironow mentioned this pull request Oct 21, 2026
Merged
hironow added a commit that referenced this pull request Oct 21, 2026
@hironow
build(deps): roll up reviewed uv-group and CI action updates (#82)
8e1d2d4 
## Scope

One rollup for the four open Dependabot PRs (#78 aiohttp 3.14.4, #79
hypothesis 6.169.1, #80 ty 0.0.87, #81 github-actions group). No
eMudhra-related pin changes are needed here (this repository's locks
carry no stale certifi). No unrelated fixes.

- Workflow files (ci/benchmark/release) are byte-identical to #81; both
action pins were verified against official tag APIs (setup-uv v10.3.0,
mise-action v5.1.2).
- `pyproject.toml` is byte-identical to #80 (ty 0.0.87 in the lint
group; ty is already exempt from this repo's 7-day cooldown by its own
policy).
- The lock was re-resolved natively with the CI-pinned uv **0.11.17**
and targeted upgrades. Result exactly matches the union of the three
lock bots plus one constraint-forced transitive: aiohttp **3.14.4**
(requires `yarl>=1.25.1`, matching #78's own lock), hypothesis
**6.169.1**, ty **0.0.87**, yarl **1.25.1**. Package set unchanged (56
records, none added/removed).
- `packages/tablecodec-docling/uv.lock` gained one mechanical line: bot
#80's root `ty` specifier change is embedded in the bridge lock's
local-package metadata (`requires-dev`), and the first CI run failed the
`docling bridge` job on exactly that drift. Verified at base (check
passes) vs this head (fails) before the one-line regeneration; after it,
`uv lock --check` (uv 0.11.17) and `just docling-ci` (30 tests) pass
locally. Package set unchanged (41 records).
- Full re-resolution regenerated two transitive dependency-marker lines
(`anyio`, `httpcore2` gain `sys_platform != 'emscripten'` exclusions) —
an artifact of the pinned uv's current resolver; versions and artifacts
are unchanged, and the repo's own `uv lock --check` accepts the result.

## Verification

- PASS: uv 0.11.17 `uv lock --check` and CI-parity `uv sync --locked
--group lint --extra dev --extra cli --extra teds`.
- PASS: `just ci` on the final tree — ruff lint/format, ty, pytest **349
passed** (2 benchmark deselected by design), semgrep (0 findings), rule
fixtures 3/3, docs-check regenerated tables identical. (An earlier local
failure was an invocation mismatch — dev/cli are extras, not groups; no
repo change was needed.)
- PASS: independent Codex static review for PR publication (not merge
approval) covered the original five-file diff — no deployment on main
push (benchmarks only), release tag-only, zero-dependency core and
cooldown policy intact, lock contains exactly the intended versions; the
sixth file (bridge lock metadata line) is a mechanical consequence
proven by the base-vs-head check above.

## Merge boundary

All related checks on the final head must succeed. Recheck base/head and
all workflow paths, then use a SHA-matched squash merge only if no
main-triggered deployment risk exists (`benchmark.yaml` runs benchmarks
on main push; `release.yaml` is `v*`-tag-only). No tag/release/publish
is authorized. Close #78–#81 only after merged main is verified to
contain their changes.
@hironow

hironow commented Oct 21, 2026

Copy link
Copy Markdown
Owner

Included in reviewed rollup #82. All ruleset-required final-head checks passed (8 test matrix legs, pytest-benchmark, semgrep, pip install -e ., plus docling bridge after the bridge-lock metadata line was regenerated). Merged main was verified tree-identical to the tested head.

@hironow hironow closed this Oct 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hironow