build(deps): bump astral-sh/setup-uv from 5 to 7

[dependabot]

Bumps astral-sh/setup-uv from 5 to 7.

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.0.0 🌈 node24 and a lot of bugfixes

Changes

This release comes with a load of bug fixes and a speed up. Because of switching from node20 to node24 it is also a breaking change. If you are running on GitHub hosted runners this will just work, if you are using self-hosted runners make sure, that your runners are up to date. If you followed the normal installation instructions your self-hosted runner will keep itself updated.

This release also removes the deprecated input server-url which was used to download uv releases from a different server. The manifest-file input supersedes that functionality by adding a flexible way to define available versions and where they should be downloaded from.

Fixes

• The action now respects when the environment variable UV_CACHE_DIR is already set and does not overwrite it. It now also finds cache-dir settings in config files if you set them.
• Some users encountered problems that cache pruning took forever because they had some uv processes running in the background. Starting with uv version 0.8.24 this action uses uv cache prune --ci --force to ignore the running processes
• If you just want to install uv but not have it available in path, this action now respects UV_NO_MODIFY_PATH
• Some other actions also set the env var UV_CACHE_DIR. This action can now deal with that but as this could lead to unwanted behavior in some edgecases a warning is now displayed.

Improvements

If you are using minimum version specifiers for the version of uv to install for example

[tool.uv]
required-version = ">=0.8.17"

This action now detects that and directly uses the latest version. Previously it would download all available releases from the uv repo to determine the highest matching candidate for the version specifier, which took much more time.

If you are using other specifiers like 0.8.x this action still needs to download all available releases because the specifier defines an upper bound (not 0.9.0 or later) and "latest" would possibly not satisfy that.

🚨 Breaking changes

• Use node24 instead of node20 @​eifinger (#608)
• Remove deprecated input server-url @​eifinger (#607)

🐛 Bug fixes

• Respect UV_CACHE_DIR and cache-dir @​eifinger (#612)
• Use --force when pruning cache @​eifinger (#611)
• Respect UV_NO_MODIFY_PATH @​eifinger (#603)
• Warn when UV_CACHE_DIR has changed @​jamesbraza (#601)

🚀 Enhancements

• Shortcut to latest version for minimum version specifier @​eifinger (#598)

🧰 Maintenance

• Bump dependencies @​eifinger (#613)
• Fix test-uv-no-modify-path @​eifinger (#604)

... (truncated)

Commits

• 37802ad Fetch uv from Astral's mirror by default (#809)
• 9f00d18 chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#808)
• fd8f376 Switch to ESM for source and test, use CommonJS for dist (#806)
• f9070de Bump deps (#805)
• cadb67b chore: update known checksums for 0.10.10 (#804)
• e06108d Use astral-sh/versions as primary version provider (#802)
• 0f6ec07 docs: replace copilot instructions with AGENTS.md (#794)
• 821e5c9 docs: add cross-client dependabot rollup skill (#793)
• 6ee6290 chore(deps): bump versions (#792)
• 9f332a1 Add riscv64 architecture support to platform detection (#791)
• Additional commits viewable in compare view

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Bumps setup-uv from v5 to v7 in the safety-lint and tools-check workflows.

Worth a look

• Third-party GitHub Action is not pinned to an immutable commit — .github/workflows/safety-lint.yml:25 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 4 functions depend on the 4 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 4 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit df2d0d5, 1 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 4 function(s) in the blast radius were not formally verified this run

[claude]

LGTM — straightforward CI dependency bump.

What was reviewed: confirmed the diff is limited to two lines, astral-sh/setup-uv@ v5 → @ v7 in .github/workflows/safety-lint.yml and .github/workflows/tools-check.yml. Checked no other steps, inputs, or permissions in either workflow were touched. No application, firmware, or docs/safety/ content is affected — this is CI-only tooling (Class A per the repo's classification).

Extended reasoning...

Overview

The diff touches only .github/workflows/safety-lint.yml and .github/workflows/tools-check.yml, each with a single-line change bumping the pinned astral-sh/setup-uv action from v5 to v7. Both usages are the "Install uv" step feeding a subsequent uv sync/lint run in tooling-only CI jobs. No workflow permissions, triggers, secrets handling, or job structure changed.

Security risks

None material. This is a version bump of a well-known, widely-used third-party action pinned to a tag (not a mutable branch or SHA-less reference, consistent with prior pinning style). The action's own release notes (from the PR description, treated as untrusted claims) describe bug fixes and a node20→node24 runtime bump — nothing that changes what the workflow does functionally. There's no new secret exposure, no new network call added beyond what the action itself already performs (installing the uv tool), and no change to what commands run once uv is installed.

Level of scrutiny

Low. Per the repo's CLAUDE.md §3 classification, changes limited to .github/workflows/ are Class A (non-shipped tooling, no safety impact) requiring one authorizer and targeted tests + pre-commit — not Class C. Nothing in pstop_c/, firmware/, machn/, host/, ros2/, common/, or docs/safety/ is touched, so none of the Class C triggers apply. This is exactly the kind of mechanical, well-specified, low-blast-radius change suited for quick approval.

Other factors

Dependabot-authored PRs of this shape (single pinned-action version bump, tag-to-tag) are routine and low-risk; the bug-hunting pass reported no findings, and my own read of the diff confirms it is a pure two-line version bump with no other changes hiding in the same commit. No CODEOWNERS conflict is apparent for .github/workflows/, and no prior review or objection exists on this PR to weigh against approval.

[iliabaranov]

@davidt315 on you if you want / need to do this

[claude]

Looks good, straightforward dependency version bump.

What was reviewed: both changes are identical one-line edits bumping astral-sh/setup-uv from @ v5 to @ v7 in the "Install uv" step of two workflow files; no other workflow content, permissions, or trigger conditions changed. Checked that the action reference format and surrounding steps are otherwise untouched in both files.

Extended reasoning...

The diff is a mechanical dependabot version bump of astral-sh/setup-uv from v5 to v7 across two GitHub Actions workflow files, with no other content changed. It touches no application code or security-sensitive logic beyond trusting a well-known third-party action's new major version, which is standard for dependabot action bumps. The change is small, self-contained, and the bug hunting system reported no findings after a full run (dry_streak), so this is a clear case for approval.