## Summary
This is a little goofy, but it saves us a click: when automation PRs are
opened as drafts, they don't need to be cycled through closed/opened to
force the CI to run. Instead, once undrafted the CI runs.
See #16505 for an example of the closed/opened cycle hack this avoids.
## Test Plan
No functional changes besides CI automation.
Signed-off-by: William Woodruff <william@astral.sh>
## Summary
Continuing to burn these down, one at a time.
This eliminates some implicit credentials, moves a permission block to
its minimum scope of effect, and removes an (unexploitable) template
expansion.
@konstin to answer your earlier question: I tried `permissions:` this
time and got a syntax warning, so I suspect it _needs_ to be an empty
mapping object here 🙂
## Test Plan
I will manually dispatch this workflow once the PR is open.
Edit: Dispatched:
https://github.com/astral-sh/uv/actions/runs/16787049700/job/47540074086
Signed-off-by: William Woodruff <william@astral.sh>
## Summary
In #10939 I added the generated
`crates/uv-python/src/download-metadata-minified.json` file which is a
minified version of `crates/uv-python/download-metadata.json`.
The main reason for this PR is to avoid bloating the git objects as this
is a single-line file.
As a bonus, I also filtered the embed json to include only the versions
for the compiled target. Which should improve the binary size and
performance by a bit.
## Test Plan
<!-- How was it tested? -->
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
action | major | `v5.4.2` -> `v6.0.0` |
---
### Release Notes
<details>
<summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary>
###
[`v6.0.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v6.0.0):
🌈 activate-environment and working-directory
[Compare
Source](https://redirect.github.com/astral-sh/setup-uv/compare/v5.4.2...v6.0.0)
##### Changes
This version contains some breaking changes which have been gathering up
for a while. Lets dive into them:
- [Activate environment](#activate-environment)
- [Working Directory](#working-directory)
- [Default `cache-dependency-glob`](#default-cache-dependency-glob)
- [Use default cache dir on self hosted
runners](#use-default-cache-dir-on-self-hosted-runners)
##### Activate environment
In previous versions using the input `python-version` automatically
activated a venv at the repository root.
This led to some unwanted side-effects, was sometimes unexpected and not
flexible enough.
The venv activation is now explicitly controlled with the new input
`activate-environment` (false by default):
```yaml
- name: Install the latest version of uv and activate the environment
uses: astral-sh/setup-uv@v6
with:
activate-environment: true
- run: uv pip install pip
```
The venv gets created by the [`uv
venv`](https://docs.astral.sh/uv/pip/environments/) command so the
python version is controlled by the `python-version` input or the files
`pyproject.toml`, `uv.toml`, `.python-version` in the
`working-directory`.
##### Working Directory
The new input `working-directory` controls where we look for
`pyproject.toml`, `uv.toml` and `.python-version` files
which are used to determine the version of uv and python to install.
It can also be used to control where the venv gets created.
```yaml
- name: Install uv based on the config files in the working-directory
uses: astral-sh/setup-uv@v6
with:
working-directory: my/subproject/dir
```
> \[!CAUTION]
>
> The inputs `pyproject-file` and `uv-file` have been removed.
##### Default `cache-dependency-glob`
[@​ssbarnea](https://redirect.github.com/ssbarnea) found out that
the default `cache-dependency-glob` was not suitable for a lot of users.
The old default
```yaml
cache-dependency-glob: |
**/requirements*.txt
**/uv.lock
```
is changed and should cover over 99.5% of use cases:
```yaml
cache-dependency-glob: |
**/*(requirements|constraints)*.(txt|in)
**/pyproject.toml
**/uv.lock
```
> \[!NOTE]
>
> This shouldn't be a breaking change. The only thing you may notice is
that your caches get invalidated once.
##### Use default cache dir on self hosted runners
The directory where uv stores its cache was always set to a directory in
`RUNNER_TEMP`. For self-hosted runners this made no sense as this gets
cleaned after every run and led to slower runs than necessary.
On self-hosted runners `UV_CACHE_DIR` is no longer set and the [default
cache
directory](https://docs.astral.sh/uv/concepts/cache/#cache-directory) is
used instead.
##### 🚨 Breaking changes
- Change default cache-dependency-glob
[@​eifinger](https://redirect.github.com/eifinger)
([#​352](https://redirect.github.com/astral-sh/setup-uv/issues/352))
- No default UV_CACHE_DIR on selfhosted runners
[@​eifinger](https://redirect.github.com/eifinger)
([#​380](https://redirect.github.com/astral-sh/setup-uv/issues/380))
- new inputs activate-environment and working-directory
[@​eifinger](https://redirect.github.com/eifinger)
([#​381](https://redirect.github.com/astral-sh/setup-uv/issues/381))
##### 🧰 Maintenance
- chore: update known checksums for 0.6.16
@​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#​378](https://redirect.github.com/astral-sh/setup-uv/issues/378))
- chore: update known checksums for 0.6.15
@​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#​377](https://redirect.github.com/astral-sh/setup-uv/issues/377))
##### 📚 Documentation
- bump to v6 in README
[@​eifinger](https://redirect.github.com/eifinger)
([#​382](https://redirect.github.com/astral-sh/setup-uv/issues/382))
- log info on venv activation
[@​eifinger](https://redirect.github.com/eifinger)
([#​375](https://redirect.github.com/astral-sh/setup-uv/issues/375))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Summary
Add an option to overwrite the list of available Python downloads from a
local JSON file by using the environment variable
`UV_PYTHON_DOWNLOADS_JSON_URL`
as an experimental support for providing custom sources for Python
distribution binaries #8015
related #10203
I probably should make the JSON to be fetched from a remote URL instead
of a local file.
please let me know what you think and I will modify the code
accordingly.
## Test Plan
### normal run
```
root@75c66494ba8b:/# /code/target/release/uv python list
cpython-3.14.0a4+freethreaded-linux-x86_64-gnu <download available>
cpython-3.14.0a4-linux-x86_64-gnu <download available>
cpython-3.13.1+freethreaded-linux-x86_64-gnu <download available>
cpython-3.13.1-linux-x86_64-gnu <download available>
cpython-3.12.8-linux-x86_64-gnu <download available>
cpython-3.11.11-linux-x86_64-gnu <download available>
cpython-3.10.16-linux-x86_64-gnu <download available>
cpython-3.9.21-linux-x86_64-gnu <download available>
cpython-3.8.20-linux-x86_64-gnu <download available>
cpython-3.7.9-linux-x86_64-gnu <download available>
pypy-3.10.14-linux-x86_64-gnu <download available>
pypy-3.9.19-linux-x86_64-gnu <download available>
pypy-3.8.16-linux-x86_64-gnu <download available>
pypy-3.7.13-linux-x86_64-gnu <download available>
```
### empty JSON file
```sh
root@75c66494ba8b:/# export UV_PYTHON_DOWNLOADS_JSON_URL=/code/crates/uv-python/my-download-metadata.json
root@75c66494ba8b:/# cat $UV_PYTHON_DOWNLOADS_JSON_URL
{}
root@75c66494ba8b:/# /code/target/release/uv python list
root@75c66494ba8b:/#
```
### JSON file with valid version
```sh
root@75c66494ba8b:/# export UV_PYTHON_DOWNLOADS_JSON_URL=/code/crates/uv-python/my-download-metadata.json
root@75c66494ba8b:/# cat $UV_PYTHON_DOWNLOADS_JSON_URL
{
"cpython-3.11.9-linux-x86_64-gnu": {
"name": "cpython",
"arch": {
"family": "x86_64",
"variant": null
},
"os": "linux",
"libc": "gnu",
"major": 3,
"minor": 11,
"patch": 9,
"prerelease": "",
"url": "https://github.com/astral-sh/python-build-standalone/releases/download/20240814/cpython-3.11.9%2B20240814-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
"sha256": "daa487c7e73005c4426ac393273117cf0e2dc4ab9b2eeda366e04cd00eea00c9",
"variant": null
}
}
root@75c66494ba8b:/# /code/target/release/uv python list
cpython-3.11.9-linux-x86_64-gnu <download available>
root@75c66494ba8b:/#
```
### Remote Path
```sh
root@75c66494ba8b:/# export UV_PYTHON_DOWNLOADS_JSON_URL=http://a.com/file.json
root@75c66494ba8b:/# /code/target/release/uv python list
error: Remote python downloads JSON is not yet supported, please use a local path (without `file://` prefix)
```
---------
Co-authored-by: Aria Desires <aria.desires@gmail.com>
## Summary
This PR deprecates the `--isolated` flag. The treatment varies across
the APIs:
- For non-preview APIs, we warn but treat it as equivalent to
`--no-config`.
- For preview APIs, we warn and ignore it, with two exceptions...
- For `tool run` and `run` specifically, we don't even warn, because we
can't differentiate the command-specific `--isolated` from the global
`--isolated`.
## Summary
After #5337, `fetch-download-metadata.py` fetches not just from
`python-build-standalone`, so updates the workflow to
`sync-python-releases.yml`.
Also includes `crates/uv-python/download-metadata.json` in `add-paths`.
---------
Co-authored-by: Zanie Blue <contact@zanie.dev>
William Woodruff
renovate[bot]
samypr100
Zanie Blue
Meitar Reihan
Charlie Marsh
Jo