Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

• Use macOS 15 runners for tests @charliermarsh (#1081)

🚀 Enhancements

• Add python-arch support @zanieb (#1079)

🧰 Maintenance

• chore: update known checksums for 0.13.0 @github-actions[bot] (#1089)
• chore: update known checksums for 0.12.24 @github-actions[bot] (#1084)
• chore: update known checksums for 0.12.23 @github-actions[bot] (#1082)
• chore: update known checksums for 0.12.22 @github-actions[bot] (#1080)
• chore: update known checksums for 0.12.21 @github-actions[bot] (#1078)
• chore: update known checksums for 0.12.20 @github-actions[bot] (#1076)
• chore: update known checksums for 0.12.19 @github-actions[bot] (#1068)
• chore: update known checksums for 0.12.18 @github-actions[bot] (#1065)

⬆️ Dependency updates

• chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @dependabot[bot] (#1077)

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

• Disable automatic cache saves for merge queues @eifinger (#1056)

🧰 Maintenance

• chore: update known checksums for 0.12.17 @github-actions[bot] (#1058)
• chore: update known checksums for 0.12.16 @github-actions[bot] (#1057)
• chore: update known checksums for 0.12.15 @github-actions[bot] (#1054)
• chore: update known checksums for 0.12.14 @github-actions[bot] (#1053)
• chore: update known checksums for 0.12.13 @github-actions[bot] (#1045)

📚 Documentation

• docs: update version references to v10.1.0 @github-actions[bot] (#1044)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#1059)

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @mj0nez (#1037)
• Use JSON + a typed wrapper instead of TS codegen @woodruffw (#1025)

🚀 Enhancements

• Expose a Python "identity" output @woodruffw (#1036)
• Verify downloads with astral-sh/versions checksums @zaniebot (#1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @github-actions[bot] (#1041)
• chore: update known checksums for 0.12.10/0.12.11 @github-actions[bot] (#1038)
• chore: update known checksums for 0.12.9 @github-actions[bot] (#1035)
• chore: update known checksums for 0.12.7/0.12.8 @github-actions[bot] (#1031)
• chore: update known checksums for 0.12.6 @github-actions[bot] (#1030)
• chore: update known checksums for 0.12.5 @github-actions[bot] (#1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @woodruffw (#1024)
• Pin one-shot tools @woodruffw (#1022)
• ci: remove obsolete direct push attempts @eifinger (#1019)

📚 Documentation

• docs: update version references to v10.0.1 @github-actions[bot] (#1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @eifinger (#1043)
• Harden npm install defaults @zaniebot (#1026)
• Add dependency cooldowns @woodruffw (#1021)

Changes

Thank you @arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in #984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @eifinger (#992)

🐛 Bug fixes

• Reject paths in .tool-versions @eifinger (#1007)

🚀 Enhancements

• Read Python version from .tool-versions @eifinger (#996)
• Add latest-known version selector @eifinger (#993)

🧰 Maintenance

• Require pull requests for Dependabot rollups @eifinger (#1005)
• ci: pin Alpine container image @eifinger (#995)
• chore: update known checksums for 0.12.3 @github-actions[bot] (#991)
• chore: update known checksums for 0.12.2 @github-actions[bot] (#985)
• chore: update known checksums for 0.12.1 @github-actions[bot] (#982)
• chore: update known checksums for 0.12.0 @github-actions[bot] (#981)
• chore: update known checksums for 0.11.31/0.11.32 @github-actions[bot] (#972)

📚 Documentation

• docs: update version references to v9.0.0 @github-actions[bot] (#971)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#1013)
• chore(deps): roll up Dependabot updates @eifinger (#1004)
• chore(deps): roll up Dependabot updates @eifinger (#994)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @dependabot[bot] (#976)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#980)

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

• Change prune-cache default to false @charliermarsh (#967)

🐛 Bug fixes

• fix: fall back to distribution ID when os-release has no version field @cxzhong (#961)

🚀 Enhancements

• Speed up version client by partial response reads @eifinger (#807)

🧰 Maintenance

• chore: update known checksums for 0.11.30 @github-actions[bot] (#968)
• chore: update known checksums for 0.11.29 @github-actions[bot] (#960)

📚 Documentation

• docs: update version references to v8.3.2 @github-actions[bot] (#949)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#970)
• chore(deps): roll up Dependabot updates @eifinger (#962)

Changes

Just a maintenance release

🧰 Maintenance

• chore: update known checksums for 0.11.28 @github-actions[bot] (#947)

📚 Documentation

• docs: update version references to v8.3.1 @github-actions[bot] (#946)

⬆️ Dependency updates

• chore: roll up Dependabot updates @eifinger (#948)

Changes

Just a maintenance release

🧰 Maintenance

• Change update-docs PR labels from 'update-docs' to 'documentation' @eifinger (#945)
• chore: update known checksums for 0.11.27 @github-actions[bot] (#944)

📚 Documentation

• docs: update version references to v8.3.0 @github-actions[bot] (#939)

Changes

Thanks to @somaz94 you can now use the pinned version of uv itself in uv.lock. It gets picked up automatically.
If you have pinned another version of uv in your uv.lock you can use the inputs version or version-source to override this.

🐛 Bug fixes

• Strip environment markers from detected uv dependency pins @eifinger (#938)
• Fix cache keys for Python version ranges @eifinger (#937)
• fix: use BUILD_ID as backup for determining os version @hgaiser (#912)

🚀 Enhancements

• feat: support uv.lock as a version-file source @somaz94 (#918)

🧰 Maintenance

• ci: call docs update workflow from release @eifinger (#933)
• chore: update known checksums for 0.11.26 @github-actions[bot] (#930)
• chore: update known checksums for 0.11.25 @github-actions[bot] (#929)
• chore: update known checksums for 0.11.24 @github-actions[bot] (#925)
• chore: update known checksums for 0.11.23 @github-actions[bot] (#922)
• chore: update known checksums for 0.11.22 @github-actions[bot] (#921)
• chore: update known checksums for 0.11.21 @github-actions[bot] (#917)
• chore: update known checksums for 0.11.20 @github-actions[bot] (#915)
• chore: update known checksums for 0.11.19 @github-actions[bot] (#909)

📚 Documentation

• docs: update version references to v8.2.0 @KRRT7 (#932)
• Add a threat model for setup-uv @zsol (#923)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @eifinger (#936)
• chore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0 @dependabot[bot] (#924)
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 @dependabot[bot] (#926)

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

• fix: report unexpected cache save failures @eifinger (#896)
• fix: report unexpected setup failures @eifinger (#895)
• fix: add timeout to fetch to prevent silent hangs @eifinger-bot (#883)
• Limit GitHub tokens to github.com download URLs @zsol (#878)
• increase libuv-workaround timeout to 100ms @eifinger (#880)

🚀 Enhancements

• Add quiet input to suppress info-level log output @eifinger (#898)
• feat: add download-from-astral-mirror input @eifinger (#897)

🧰 Maintenance

• docs: update dependabot rollup biome guidance @eifinger (#902)
• chore: update known checksums for 0.11.18 @github-actions[bot] (#899)
• chore: update known checksums for 0.11.17 @github-actions[bot] (#892)
• chore: update known checksums for 0.11.16 @github-actions[bot] (#889)
• chore: update known checksums for 0.11.15 @github-actions[bot] (#885)
• chore: update known checksums for 0.11.14 @github-actions[bot] (#879)
• chore: update known checksums for 0.11.13 @github-actions[bot] (#877)
• chore: update known checksums for 0.11.12 @github-actions[bot] (#876)
• chore: update known checksums for 0.11.11 @github-actions[bot] (#873)
• chore: update known checksums for 0.11.9/0.11.10 @github-actions[bot] (#871)
• chore: update known checksums for 0.11.8 @github-actions[bot] (#867)
• Bump setup-uv references to v8.1.0 SHA in docs @eifinger (#862)
• Add update-docs.yml workflow @eifinger (#861)

⬆️ Dependency updates

• chore(deps): roll up dependabot updates @eifinger (#903)
• chore(deps): roll up dependabot updates @eifinger (#901)
• chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 @dependabot[bot] (#900)
• chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 @dependabot[bot] (#842)
• chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 @dependabot[bot] (#893)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 @dependabot[bot] (#891)
• chore(deps): bump release-drafter/release-drafter from 7.2.0 to 7.3.0 @dependabot[bot] (#884)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 @dependabot[bot] (#888)
• chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 @dependabot[bot] (#881)
• chore(deps): bump github/codeql-action from 4.32.2 to 4.35.3 @dependabot[bot] (#875)
• chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 @dependabot[bot] (#866)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 @dependabot[bot] (#864)
• chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 @dependabot[bot] (#863)