ci: bump setup-uv to v8.2.0 for Node 24 runtime#345
Conversation
setup-uv v6 runs on Node 20, which GitHub forces onto Node 24 from June 16th 2026 and removes from runners in September 2026. v7+ runs node24 natively. Pinned to the exact v8.2.0 tag because setup-uv stopped publishing floating major/minor tags in v8 (supply-chain hardening), so @v8 does not resolve. The v7/v8 breaking changes (server-url and old manifest-file format removal) don't apply — both usages install uv with no inputs. All other actions in this repo are already on node24 majors.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughThe PR updates the ChangesCI Workflow Dependencies
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 144: Replace the mutable GitHub Actions tag "astral-sh/setup-uv@v8.2.0"
with the immutable commit SHA
"astral-sh/setup-uv@fac544c06283516518a20d2d3a778c1837943d2c" wherever it
appears (e.g., the "uses: astral-sh/setup-uv@v8.2.0" entries in the CI and
nightly-chaos workflow files); update both occurrences to ensure the action is
pinned to the provided commit SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2ef7d0f0-df80-490b-9731-8454bdfc16f3
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/nightly-chaos.yml
| python-version: "3.12" | ||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v6 | ||
| uses: astral-sh/setup-uv@v8.2.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "astral-sh/setup-uv@" .github/workflows || true
echo "---- ci.yml context ----"
nl -ba .github/workflows/ci.yml | sed -n '120,170p'
echo "---- nightly-chaos.yml context ----"
nl -ba .github/workflows/nightly-chaos.yml | sed -n '340,410p'Repository: hardbyte/awa
Length of output: 291
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== all setup-uv uses =="
rg -n "uses:\s*astral-sh/setup-uv@" .github/workflows
echo
echo "== ci.yml around line 144 =="
sed -n '135,155p' .github/workflows/ci.yml
echo
echo "== nightly-chaos.yml around line 373 =="
sed -n '360,390p' .github/workflows/nightly-chaos.ymlRepository: hardbyte/awa
Length of output: 2249
🌐 Web query:
astral-sh/setup-uv v8.2.0 commit sha
💡 Result:
The commit SHA for astral-sh/setup-uv version v8.2.0 is fac544c06283516518a20d2d3a778c1837943d2c [1][2]. This SHA corresponds to the commit titled "chore(deps): roll up dependabot updates" (PR #903), which is the commit associated with the v8.2.0 release [1][2].
Citations:
- 1: https://github.com/astral-sh/setup-uv/releases/tag/v8.2.0
- 2: chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 evalops/maestro#776
Pin astral-sh/setup-uv to an immutable commit SHA
Both .github/workflows/ci.yml (line 144) and .github/workflows/nightly-chaos.yml (line 373) use the mutable tag astral-sh/setup-uv@v8.2.0. Replace both entries with astral-sh/setup-uv@fac544c06283516518a20d2d3a778c1837943d2c.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 144-144: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 144, Replace the mutable GitHub Actions tag
"astral-sh/setup-uv@v8.2.0" with the immutable commit SHA
"astral-sh/setup-uv@fac544c06283516518a20d2d3a778c1837943d2c" wherever it
appears (e.g., the "uses: astral-sh/setup-uv@v8.2.0" entries in the CI and
nightly-chaos workflow files); update both occurrences to ensure the action is
pinned to the provided commit SHA.
Source: Linters/SAST tools
1 participant
GitHub forces Node.js 20 actions to run on Node 24 starting June 16th, 2026 and removes Node 20 from runners in September 2026. Everything in this repo is already on node24 majors except
astral-sh/setup-uv@v6(node20) inci.ymlandnightly-chaos.yml.Two notes:
v8.2.0rather than@v8: setup-uv stopped publishing floating major/minor tags in v8 as supply-chain hardening, so@v8doesn't resolve.server-urland the oldmanifest-fileformat) don't apply — both usages install uv with no inputs.Same sweep as thepartly/reflectapi#172.
Summary by CodeRabbit