fix(ci): pin setup-uv to v7 in release workflow (v8 does not exist)

[Liohtml]

What happened

The v0.2.0 release run failed (run 27357593997) at the very first job:

##[error]Unable to resolve action `astral-sh/setup-uv@v8`, unable to find version `v8`

release.yml pinned astral-sh/setup-uv@v8, which is not a published version. The build job aborted in ~10s, and since pypi and docker both needs: build, neither ran — so nothing was published to PyPI or GHCR. Clean slate to retry.

(Note: the repo-health bot in #40 suggested v7 → v8, but v8 doesn't exist; ci.yml correctly uses @v7 and runs green.)

Fix

release.yml: astral-sh/setup-uv@v8 → @v7, matching ci.yml.

After merge — re-trigger the release

The v0.2.0 tag points at the old commit. Once this is on main, the tag/release must be re-pointed at the new commit to re-run publishing. I'll guide that step.

Validation

One-line workflow fix; no code change. CI will confirm the workflows still parse/run.

https://claude.ai/code/session_01KYcUxCGAHaTPrRHTzJCWQz

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated release workflow toolchain configuration.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow's uv setup step is updated to use version 7 of the astral-sh setup-uv action instead of version 8. This one-line change affects the toolchain initialization in the build and verify package job that precedes package artifact generation and PyPI/Docker registry publishing.

Changes

Release Workflow Toolchain

Layer / File(s)	Summary
UV toolchain action version update .github/workflows/release.yml	The release workflow's uv setup action is pinned to astral-sh/setup-uv@v7 instead of v8.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A rabbit once versioned with care,
From eight down to seven so fair,
The workflow runs true,
With UV anew,
CI builds beyond compare! 🚀

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description provides context on the issue, the fix applied, and post-merge actions, but does not follow the repository's template structure with Summary, Changes, Testing, and Additional Notes sections.	Restructure the description to match the template: add a Summary section with issue link, a Changes list, Testing checklist, and Additional Notes for deployment considerations.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically identifies the main change: pinning setup-uv to v7 in the release workflow and explains the reason (v8 does not exist).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/repo-issues-features-3ZLdb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)

31-31: ⚖️ Poor tradeoff

Consider pinning to commit SHA for supply-chain security (optional).

As per static analysis, GitHub Actions best practices recommend pinning to full commit SHAs instead of tags (e.g., astral-sh/setup-uv@<commit-sha>) to prevent tag-rewriting attacks. This applies to all actions in the workflow, not just setup-uv.

This is an optional hardening measure and not required to fix the immediate v8→v7 issue.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 31, The workflow currently references
the third‑party action as "astral-sh/setup-uv@v7"; to harden supply‑chain
security replace the tag with a full commit SHA for that action (e.g.,
"astral-sh/setup-uv@<commit-sha>") by locating the desired commit in the
action's repository and updating the reference, and apply the same pinning
approach to any other action entries in the workflow so all uses are fixed to
immutable commit SHAs rather than mutable tags.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release.yml:
- Line 31: The workflow currently references the third‑party action as
"astral-sh/setup-uv@v7"; to harden supply‑chain security replace the tag with a
full commit SHA for that action (e.g., "astral-sh/setup-uv@<commit-sha>") by
locating the desired commit in the action's repository and updating the
reference, and apply the same pinning approach to any other action entries in
the workflow so all uses are fixed to immutable commit SHAs rather than mutable
tags.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 82eafce0-b209-4748-b409-7babec75627d

📥 Commits

Reviewing files that changed from the base of the PR and between 7fdb4a0 and b59dcb0.

📒 Files selected for processing (1)

• .github/workflows/release.yml