build(deps): Bump astral-sh/setup-uv from 5 to 7

[dependabot]

Bumps astral-sh/setup-uv from 5 to 7.

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.2.1 🌈 update known checksums up to 0.9.28

Changes

🧰 Maintenance

• chore: update known checksums for 0.9.28 @github-actions[bot] (#744)
• chore: update known checksums for 0.9.27 @github-actions[bot] (#742)
• chore: update known checksums for 0.9.26 @github-actions[bot] (#734)
• chore: update known checksums for 0.9.25 @github-actions[bot] (#733)
• chore: update known checksums for 0.9.24 @github-actions[bot] (#730)

📚 Documentation

• Clarify impact of using actions/setup-python @​eifinger (#732)

⬆️ Dependency updates

• Bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1 @dependabot[bot] (#741)

v7.0.0 🌈 node24 and a lot of bugfixes

Changes

This release comes with a load of bug fixes and a speed up. Because of switching from node20 to node24 it is also a breaking change. If you are running on GitHub hosted runners this will just work, if you are using self-hosted runners make sure, that your runners are up to date. If you followed the normal installation instructions your self-hosted runner will keep itself updated.

This release also removes the deprecated input server-url which was used to download uv releases from a different server. The manifest-file input supersedes that functionality by adding a flexible way to define available versions and where they should be downloaded from.

Fixes

• The action now respects when the environment variable UV_CACHE_DIR is already set and does not overwrite it. It now also finds cache-dir settings in config files if you set them.
• Some users encountered problems that cache pruning took forever because they had some uv processes running in the background. Starting with uv version 0.8.24 this action uses uv cache prune --ci --force to ignore the running processes
• If you just want to install uv but not have it available in path, this action now respects UV_NO_MODIFY_PATH
• Some other actions also set the env var UV_CACHE_DIR. This action can now deal with that but as this could lead to unwanted behavior in some edgecases a warning is now displayed.

Improvements

If you are using minimum version specifiers for the version of uv to install for example

[tool.uv]
required-version = ">=0.8.17"

This action now detects that and directly uses the latest version. Previously it would download all available releases from the uv repo to determine the highest matching candidate for the version specifier, which took much more time.

If you are using other specifiers like 0.8.x this action still needs to download all available releases because the specifier defines an upper bound (not 0.9.0 or later) and "latest" would possibly not satisfy that.

🚨 Breaking changes

... (truncated)

Commits

• 37802ad Fetch uv from Astral's mirror by default (#809)
• 9f00d18 chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#808)
• fd8f376 Switch to ESM for source and test, use CommonJS for dist (#806)
• f9070de Bump deps (#805)
• cadb67b chore: update known checksums for 0.10.10 (#804)
• e06108d Use astral-sh/versions as primary version provider (#802)
• 0f6ec07 docs: replace copilot instructions with AGENTS.md (#794)
• 821e5c9 docs: add cross-client dependabot rollup skill (#793)
• 6ee6290 chore(deps): bump versions (#792)
• 9f332a1 Add riscv64 architecture support to platform detection (#791)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • Updated CI workflow to a newer setup version.
  • Separated type checking into its own CI step for clearer reporting.
  • Streamlined the security step to focus on environment sync and a vulnerability scan.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e218eba-9070-43a1-93f2-984b066e3063

📥 Commits

Reviewing files that changed from the base of the PR and between ff85ab1 and 0b41090.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

Update CI workflow: switch astral-sh/setup-uv to v7 in lint, type-check, security, and test jobs; move uv run mypy src/medcheck from the security job into the type-check job; security now runs uv sync --all-extras and bandit only.

Changes

CI Workflow Updates

Layer / File(s)	Summary
Setup-uv version upgrade in lint and test jobs .github/workflows/ci.yml	astral-sh/setup-uv action updated from v5 to v7 in the lint and test jobs.
Type-check and security job reorganization .github/workflows/ci.yml	astral-sh/setup-uv updated to v7 in type-check and security; uv run mypy src/medcheck moved to type-check; security now runs uv sync --all-extras and bandit only.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

A rabbit hops through CI's lane,
Upgrading actions, swift and keen,
Mypy moved where types convene,
Bandit watches, tidy scene,
🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is largely incomplete; it lacks the structured format required by the template, missing Summary (with issue link), Changes section, Testing checklist, and Additional Notes.	Fill in the required template sections: add a Summary with linked issue, list key Changes, complete the Testing checklist items, and add any Additional Notes about breaking changes or deployment considerations.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: bumping the astral-sh/setup-uv GitHub Action from version 5 to 7, which matches the raw summary and actual changes made in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/astral-sh/setup-uv-7

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Liohtml]

Closing: merge conflicts after PR #2 merge. Dependabot will re-create.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.