Bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: astral-sh/setup-uv, pypa/cibuildwheel and actions/attest-build-provenance.

Updates astral-sh/setup-uv from 4 to 6

Release notes

Sourced from astral-sh/setup-uv's releases.

v6.0.0 🌈 activate-environment and working-directory

Changes

This version contains some breaking changes which have been gathering up for a while. Lets dive into them:

• Activate environment
• Working Directory
• Default cache-dependency-glob
• Use default cache dir on self hosted runners

Activate environment

In previous versions using the input python-version automatically activated a venv at the repository root. This led to some unwanted side-effects, was sometimes unexpected and not flexible enough.

The venv activation is now explicitly controlled with the new input activate-environment (false by default):

- name: Install the latest version of uv and activate the environment
  uses: astral-sh/setup-uv@v6
  with:
    activate-environment: true
- run: uv pip install pip

The venv gets created by the uv venv command so the python version is controlled by the python-version input or the files pyproject.toml, uv.toml, .python-version in the working-directory.

Working Directory

The new input working-directory controls where we look for pyproject.toml, uv.toml and .python-version files which are used to determine the version of uv and python to install.

It can also be used to control where the venv gets created.

- name: Install uv based on the config files in the working-directory
  uses: astral-sh/setup-uv@v6
  with:
    working-directory: my/subproject/dir

[!CAUTION]

The inputs pyproject-file and uv-file have been removed.

Default cache-dependency-glob

@​ssbarnea found out that the default cache-dependency-glob was not suitable for a lot of users.

The old default

... (truncated)

Commits

• 6b9c606 Bump dependencies (#389)
• ef6bcdf Fix default cache dependency glob (#388)
• 9a31171 chore: update known checksums for 0.6.17 (#384)
• c7f87aa bump to v6 in README (#382)
• aadfaf0 Change default cache-dependency-glob (#352)
• a0f9da6 No default UV_CACHE_DIR on selfhosted runners (#380)
• ec4c691 new inputs activate-environment and working-directory (#381)
• aa12905 chore: update known checksums for 0.6.16 (#378)
• fcaddda chore: update known checksums for 0.6.15 (#377)
• fb3a0a9 log info on venv activation (#375)
• Additional commits viewable in compare view

Updates pypa/cibuildwheel from 2.22 to 2.23

Release notes

Sourced from pypa/cibuildwheel's releases.

v2.23.0

• ✨ Adds official support for the new GitHub Actions Arm runners. In fact these worked out-of-the-box, now we include them in our tests and example configs. (#2135 via #2281)
• ✨ Adds support for building PyPy 3.11 wheels (#2268 via #2281)
• 🛠 Adopts the beta pypa/manylinux image for armv7l builds (#2269 via #2281)
• 🛠 Dependency updates, including Pyodide 0.27 (#2117 and #2281)

Changelog

Sourced from pypa/cibuildwheel's changelog.

---

title: Changelog

Changelog

v2.23.3

26 April 2025

• 🛠 Dependency updates, including Python 3.13.3 (#2371)

v2.23.2

24 March 2025

• 🐛 Workaround an issue with pyodide builds when running cibuildwheel with a Python that was installed via UV (#2328 via #2331)
• 🛠 Dependency updates, including a manylinux update that fixes an 'undefined symbol' error in gcc-toolset (#2334)

v2.23.1

15 March 2025

• ⚠️ Added warnings when the shorthand values manylinux1, manylinux2010, manylinux_2_24, and musllinux_1_1 are used to specify the images in linux builds. The shorthand to these (unmaintainted) images will be removed in v3.0. If you want to keep using these images, explicitly opt-in using the full image URL, which can be found in this file. (#2312)
• 🛠 Dependency updates, including a manylinux update which fixes an issue with rustup. (#2315)

v2.23.0

1 March 2025

• ✨ Adds official support for the new GitHub Actions Arm runners. In fact these worked out-of-the-box, now we include them in our tests and example configs. (#2135 via #2281)
• ✨ Adds support for building PyPy 3.11 wheels (#2268 via #2281)
• 🛠 Adopts the beta pypa/manylinux image for armv7l builds (#2269 via #2281)
• 🛠 Dependency updates, including Pyodide 0.27 (#2117 and #2281)

v2.22.0

23 November 2024

• 🌟 Added a new CIBW_ENABLE/enable feature that replaces CIBW_FREETHREADED_SUPPORT/free-threaded-support and CIBW_PRERELEASE_PYTHONS with a system that supports both. In cibuildwheel 3, this will also include a PyPy setting and the deprecated options will be removed. (#2048)
• 🌟 Dependency groups are now supported for tests. Use CIBW_TEST_GROUPS/test-groups to specify groups in [dependency-groups] for testing. (#2063)
• 🌟 Support for the experimental Ubuntu-based ARMv7l manylinux image (#2052)
• ✨ Show a warning when cibuildwheel is run from Python 3.10 or older; cibuildwheel 3.0 will require Python 3.11 or newer as host (#2050)
• 🐛 Fix issue with stderr interfering with checking the docker version (#2074)
• 🛠 Python 3.9 is now used in CIBW_BEFORE_ALL/before-all on linux, replacing 3.8, which is now EoL (#2043)
• 🛠 Error messages for producing a pure-Python wheel are slightly more informative (#2044)
• 🛠 Better error when uname -m fails on ARM (#2049)
• 🛠 Better error when repair fails and docs for abi3audit on Windows (#2058)
• 🛠 Better error when manylinux-interpreters ensure fails (#2066)
• 🛠 Update Pyodide to 0.26.4, and adapt to the unbundled pyodide-build (now 0.29) (#2090)

... (truncated)

Commits

• faf86a6 Bump version: v2.23.3
• 4241f37 [2.x] Update dependencies (#2371)
• d04cacb Bump version: v2.23.2
• 5f4e019 [2.x] Update dependencies (#2334)
• 2efa648 fix: always resolve --python argument (#2328) (#2331)
• 42728e8 Bump version: v2.23.1
• 6e1527b Fix unit test when other warnings are present
• c25fe60 fix: image deprecation warning (#2314)
• a880bf5 fix: warn on deprecated images being set (#2312)
• c087d85 Update dependencies
• Additional commits viewable in compare view

Updates actions/attest-build-provenance from 1.4.4 to 2.3.0

Release notes

Sourced from actions/attest-build-provenance's releases.

v2.3.0

What's Changed

• Bump actions/attest from 2.2.1 to 2.3.0 by @​bdehamer in actions/attest-build-provenance#615
  • Updates @sigstore/oci from 0.4.0 to 0.5.0

Full Changelog: actions/attest-build-provenance@v2.2.3...v2.3.0

v2.2.3

What's Changed

• Pin actions/attest reference by commit SHA by @​bdehamer in actions/attest-build-provenance#493

Full Changelog: actions/attest-build-provenance@v2.2.2...v2.2.3

v2.2.2

What's Changed

• Bump predicate action from 1.1.4 to 1.1.5 by @​bdehamer in actions/attest-build-provenance#485
  • Bump @​actions/attest from 1.5.0 to 1.6.0 by @​bdehamer in actions/attest-build-provenance#484
    • Update buildSLSAProvenancePredicate to populate workflow.ref field from the ref claim in the OIDC token (actions/toolkit#1969)

Full Changelog: actions/attest-build-provenance@v2.2.1...v2.2.2

v2.2.1

What's Changed

• Bump undici from 5.28.4 to 5.28.5 by @​dependabot in actions/attest-build-provenance#457
• Bump @​octokit/request-error from 5.0.1 to 5.1.1 by @​dependabot in actions/attest-build-provenance#469
• Bump @​octokit/request from 8.2.0 to 8.4.1 by @​dependabot in actions/attest-build-provenance#478
• Bump actions/attest from 2.2.0 to 2.2.1 by @​bdehamer in actions/attest-build-provenance#481
  • Includes @actions/attest v1.6.0

Full Changelog: actions/attest-build-provenance@v2.2.0...v2.2.1

v2.2.0

What's Changed

• Bump actions/attest from v2.1.0 to v2.2.0 by @​bdehamer in actions/attest-build-provenance#449
  • Includes support for now subject-checksums input parameter

Full Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0

v2.1.0

What's Changed

• Update README w/ note about GH plans supporting attestations by @​bdehamer in actions/attest-build-provenance#414
• Add attestation-id and attestation-url outputs by @​bdehamer in actions/attest-build-provenance#415

Full Changelog: actions/attest-build-provenance@v2.0.1...v2.1.0

v2.0.1

... (truncated)

Commits

• db473fd bump actions/attest from 2.2.1 to 2.3.0 (#615)
• d3b713a Bump the actions-minor group with 2 updates (#566)
• e042adb Bump the npm-development group with 4 updates (#567)
• 9d3beef Bump the npm-development group with 4 updates (#554)
• 877f50d Bump typescript-eslint in the npm-development group (#516)
• b7ab740 Bump the npm-development group across 1 directory with 6 updates (#506)
• c074443 pin actions/attest reference by commit sha (#493)
• bd77c07 bump predicate from 1.1.4 to 1.1.5 (#485)
• 1176ef5 bump @​actions/attest from 1.5.0 to 1.6.0 (#484)
• f9eaf23 Bump actions/attest from 2.2.0 to 2.2.1 (#481)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions