questrail / applyaf / 33462726506
100%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 2
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0% (+5.9%) from 94.118%
33462726506

push

github

matthewrankin 
Upgrade setup-uv to v10.0.1 and stop caching in the release job

Three majors, one of which matters here.

v8 dropped the manifest-file format this project never used and stopped
publishing major and minor tags at all, for the same reason the pins in
this repository exist: a moving tag is a supply chain risk. v9 changed the
prune-cache default to false to ease the load on PyPI, and the caches that
grows are small enough here to take the new default as it comes.

v10 is the one with a consequence. It stops caching by default on the
events where a poisoned cache reaches furthest, and the action's own input
description names tag pushes among them, which the release notes do not.
This workflow runs on a tag push and can mint a PyPI credential, and it was
passing enable-cache: true, which overrode exactly that protection.

So the release job no longer caches. It is set to false rather than left on
auto, so the answer does not change if that heuristic ever does. Almost
nothing is lost: since lint and test moved to the CI job, nothing in the
release syncs the dev environment, and only the build backend and the wheel
under test are downloaded.

ci.yml keeps its cache. Those jobs install numpy and the dev tools four
times over, they run with contents: read, and none of them can publish
anything. The release job builds on its own runner, so what CI caches never
reaches the distributions that go out.

68 of 68 relevant lines covered (100.0%)

1.0 hits per line

Jobs
ID Job ID Ran Files Coverage
1 33462726506.1 2
100.0
 GitHub Action Run
Source Files on build 33462726506