Skip to content

Bump the actions group with 2 updates - #544

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-80eac0b5f4
Open

Bump the actions group with 2 updates#544
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-80eac0b5f4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 2 updates: actions/setup-python and hynek/build-and-inspect-python-package.

Updates actions/setup-python from 6 to 6.3.0

Release notes

Sourced from actions/setup-python's releases.

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

Full Changelog: actions/setup-python@v6...v6.2.0

v6.1.0

What's Changed

Enhancements:

Dependency and Documentation updates:

New Contributors

Full Changelog: actions/setup-python@v6...v6.1.0

Commits

Updates hynek/build-and-inspect-python-package from 2 to 2.18.0

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v2.18.0

Added

  • New input: skip-sdist to skip building the source distribution. #228

v2.17.0

Fixed

  • The action now passes Zizmor in pedantic mode. #212

v2.16.0

Added

  • New include-free-threaded input. When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

v2.15.0

Added

  • The Python version used to build the package can now be configured using the python-version input. #191

v2.14.0

Changed

  • Update tools such that they work on Python 3.14 (which is now 3.x on GitHub Actions). #182

  • The action now ignores UV_PYTHON coming from the outside. #184

v2.13.0

Added

  • New output: package_name is the name of the built package as stored in metadata. #162

  • The package name is now part of the action summary which is helpful when you build more than one package from a repository. #169

Changed

  • All GitHub actions are now pinned to exact hashes for better reproducibility and mild security improvements.

    Since chosen prefix SHA-1 hash collision attacks exist, this is but security theater against serious attackers.

v2.12.0

This release only updates our dependencies to support packaging metadata v2.4 (as created, for example, by recent Hatchling releases).

[!NOTE] To upload packages with metadata v2.4 (which is required for PEP 639 license metadata) using the official pypi-publish GitHub Action, you must make sure to use its v1.12.4 or later.

v2.11.0

... (truncated)

Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

3.0.1 - 2026-07-30

Fixed

  • To avoid uv configuration interference with the project that is being built, the installation of our own tools is now ran in a different directory. Additionally, UV_EXCLUDE_NEWER is unset. #240

3.0.0 - 2026-07-30

Security

  • Given the increase and supply-chain attacks and advancements in tooling (for example, pinact or GitHub's Dependabot), this action will stop force-tagging minor and micro releases. This means, there will be no @v3 or @v3.0 tag that gets updated and force-pushed with each update. Always tag with the full version and commit hash; use Zizmor to secure your actions if you can.

Changed

2.18.0 - 2026-05-11

Added

  • New input: skip-sdist to skip building the source distribution. #228

2.17.0 - 2026-03-27

Fixed

  • The action now passes Zizmor in pedantic mode. #212

2.16.0 - 2026-03-26

Added

  • New input: include-free-threaded When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

2.15.0 - 2026-03-19

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 2 updates: [actions/setup-python](https://github.com/actions/setup-python) and [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package).


Updates `actions/setup-python` from 6 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v6.3.0)

Updates `hynek/build-and-inspect-python-package` from 2 to 2.18.0
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@v2...v2.18.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: hynek/build-and-inspect-python-package
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 1, 2026
@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.63%. Comparing base (ec19a33) to head (3cea127).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #544   +/-   ##
=======================================
  Coverage   88.63%   88.63%           
=======================================
  Files          64       64           
  Lines        7266     7266           
=======================================
  Hits         6440     6440           
  Misses        826      826           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@read-the-docs-community

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant