From e44692a084818a7a3f93a79d9f2194f86d27f7f2 Mon Sep 17 00:00:00 2001 From: Harish Seshadri Date: Mon, 3 Aug 2026 07:04:29 -0700 Subject: [PATCH] fix(ci): the composite consumers execute runs setup-uv v9, not v8.3.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #12 bumped astral-sh/setup-uv 8.3.2 -> 9.0.0 but touched only .github/workflows/ci.yml — this repo's own self-test. The file consumers actually execute, .github/actions/setup-python-uv/action.yml, stayed on v8.3.2, so the bump reached nobody downstream. The split was already visible in the field: edge-proc and edgeproc-core run v9.0.0 directly in their own ci.yml while calling this composite on their publish path — v9 on test, v8.3.2 on publish, same repo, same PR. c771a70e6277c0a99b617c7a806ffedaca235ff9 is v9.0.0, confirmed against `gh api repos/astral-sh/setup-uv/tags` (v8.3.2 there is the outgoing 11f9893b), and is the same SHA #12 and both consumers already run. The version comment names v9.0.0 exactly. #13 just removed five floating-major comments for this reason: zizmor's ref-version-mismatch resolves the comment against upstream, so `# v9` turns main red the moment astral-sh cuts a patch. No floating major tag exists upstream anyway — `v9` and `v8` both 404. Claim touched: "consumers of this composite run a pinned, immutable, auditable setup-uv." It was true about immutability and false about which version — the audited pin and the executed pin were different files. Evidence: - GH_TOKEN=... uvx zizmor@1.26.1 . -> exit 0, "No findings to report" - actionlint -> clean; shellcheck -x + bash -n -> clean - tests/security-policy.sh -> exit 0 - tests/lint-examples.sh -> exit 0, 173 refs resolved, 0 MISSING Still on the old SHA after this change: nothing executable. README.md:422 and CHANGELOG.md:273,401 mention v8.3.2 as prose; README.md:197 shows v8.1.0 in a sample. Reported, not edited — no gate reads them. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx --- .github/actions/setup-python-uv/action.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/actions/setup-python-uv/action.yml b/.github/actions/setup-python-uv/action.yml index babe1b0..e3ef4a0 100644 --- a/.github/actions/setup-python-uv/action.yml +++ b/.github/actions/setup-python-uv/action.yml @@ -49,9 +49,12 @@ inputs: runs: using: composite steps: - # setup-uv publishes no floating major tag (only v8.x.y). The full commit SHA - # and readable release comment keep execution immutable and updates reviewable. - - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + # setup-uv publishes no floating major tag (only vX.Y.Z — `v9` 404s upstream). + # The full commit SHA and readable release comment keep execution immutable and + # updates reviewable. The comment must name the exact version, never `# v9`: + # zizmor's ref-version-mismatch resolves it upstream and a float turns red on + # the next patch release. + - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: enable-cache: true - name: Pin Python