chore(deps): update actions/setup-python action to v6.3.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-python	action	minor	v6.2.0 → v6.3.0

---

Release Notes

actions/setup-python (actions/setup-python)

v6.3.0

Compare Source

What's Changed

Enhancement

• Add RHEL support and include Linux distro in cache keys by @​priyagupta108 in #​1323
• Fix pip cache error handling on Windows by @​priyagupta108 in #​1040

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1281
• Upgrade actions dependencies by @​gowridurgad with @​Copilot in #​1303
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1324
• Upgrade dependency versions and test workflow configuration by @​HarithaVattikuti in #​1322

Documentation

• Update advanced-usage.md by @​Dunky-Z in #​811

New Contributors

• @​gowridurgad with @​Copilot made their first contribution in #​1303
• @​jasongin made their first contribution in #​1324
• @​Dunky-Z made their first contribution in #​811

Full Changelog: actions/setup-python@v6...v6.3.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5f03bb8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 7 finding(s)

🔴 7

• 🔴 P0 .github/workflows/_checks.yml:57 CWE-89 — Unpinned action tag (@v1)
  Using a versionless tag (@v1) for the actions/setup-python action can lead to security vulnerabilities if the action is updated in a way that introduces breakin
• 🔴 P0 .github/workflows/python-lint.yml:26 CWE-89 — Unpinned action tag (@v1)
  Using a versionless tag (@v1) for the actions/setup-python action can lead to security vulnerabilities if the action is updated in a way that introduces breakin
• 🔴 P0 .github/workflows/_checks.yml:57 CWE-862 — Unpinned action tag (@v1 vs commit SHA)
  The use of '@v1' for the actions/setup-python action is a known security risk as it can lead to using an outdated version of the action. Using a specific commit
• 🔴 P0 .github/workflows/python-lint.yml:26 CWE-862 — Unpinned action tag (@v1 vs commit SHA)
  The use of '@v1' for the actions/setup-python action is a known security risk as it can lead to using an outdated version of the action. Using a specific commit
• 🔴 P0 .github/workflows/_checks.yml:57 CWE-269 — Overbroad token permissions
  The action/setup-python step does not specify any permissions, which could allow the action to perform actions it shouldn't.
• 🔴 P0 .github/workflows/python-lint.yml:26 CWE-269 — Overbroad token permissions
  The action/setup-python step does not specify any permissions, which could allow the action to perform actions it shouldn't.
• 🔴 P0 .github/workflows/_checks.yml:57 CWE-312 — Secrets echoed to logs
  The action/setup-python step does not specify any secrets, but if it were to use a secret, it could be echoed to logs.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Other workflow still pins setup-python v5.6.0

.github/workflows/_checks.yml:57 still pins actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0, so the repo now uses two different major versions of the action. If this file is excluded from Renovate's scope intentionally, no action needed; otherwise consider aligning the pins so CI environments stay consistent.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a small, bounded GitHub Actions dependency update that preserves the existing lint, test, release, and smoke-install behavior and does not alter SDK runtime code or deployment targets. All modified workflows are owned by the core team, and one related workflow remains on an older setup-python pin, so scope and compatibility should be confirmed by the owners.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

No code changes detected at d90cdee. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

Dismissing prior approval to re-evaluate 8aae3e9

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.