bump deps (#569 )

Bump github/codeql-action from 3.29.11 to 3.30.3 (#566 )
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.11 to 3.30.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v3.30.3</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.3 - 10 Sep 2025</h2> <p>No user facing changes.</p> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.3/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v3.30.2</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.2 - 09 Sep 2025</h2> <ul> <li>Fixed a bug which could cause language autodetection to fail. <a href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li> <li>Experimental: The <code>quality-queries</code> input that was added in <code>3.29.2</code> as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new <code>analysis-kinds</code> input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.2/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v3.30.1</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.1 - 05 Sep 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.0. <a href="https://redirect.github.com/github/codeql-action/pull/3077">#3077</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.1/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v3.30.0</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.0 - 01 Sep 2025</h2> <ul> <li>Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. <a href="https://redirect.github.com/github/codeql-action/pull/3054">#3054</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.0/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>3.30.3 - 10 Sep 2025</h2> <p>No user facing changes.</p> <h2>3.30.2 - 09 Sep 2025</h2> <ul> <li>Fixed a bug which could cause language autodetection to fail. <a href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li> <li>Experimental: The <code>quality-queries</code> input that was added in <code>3.29.2</code> as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new <code>analysis-kinds</code> input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li> </ul> <h2>3.30.1 - 05 Sep 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.0. <a href="https://redirect.github.com/github/codeql-action/pull/3077">#3077</a></li> </ul> <h2>3.30.0 - 01 Sep 2025</h2> <ul> <li>Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. <a href="https://redirect.github.com/github/codeql-action/pull/3054">#3054</a></li> </ul> <h2>3.29.11 - 21 Aug 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.22.4. <a href="https://redirect.github.com/github/codeql-action/pull/3044">#3044</a></li> </ul> <h2>3.29.10 - 18 Aug 2025</h2> <p>No user facing changes.</p> <h2>3.29.9 - 12 Aug 2025</h2> <p>No user facing changes.</p> <h2>3.29.8 - 08 Aug 2025</h2> <ul> <li>Fix an issue where the Action would autodetect unsupported languages such as HTML. <a href="https://redirect.github.com/github/codeql-action/pull/3015">#3015</a></li> </ul> <h2>3.29.7 - 07 Aug 2025</h2> <p>This release rolls back 3.29.6 to address issues with language autodetection. It is identical to 3.29.5.</p> <h2>3.29.6 - 07 Aug 2025</h2> <ul> <li>The <code>cleanup-level</code> input to the <code>analyze</code> Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup. <a href="https://redirect.github.com/github/codeql-action/pull/2999">#2999</a></li> <li>Update default CodeQL bundle version to 2.22.3. <a href="https://redirect.github.com/github/codeql-action/pull/3000">#3000</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="192325c861"><code>192325c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3104">#3104</a> from github/update-v3.30.3-b660efdcf</li> <li><a href="e68956d90b"><code>e68956d</code></a> Update changelog for v3.30.3</li> <li><a href="b660efdcfd"><code>b660efd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3103">#3103</a> from github/mbg/fix/category-check</li> <li><a href="e49458befe"><code>e49458b</code></a> Fix <code>runInterpretResultsFor</code> using the wrong <code>AnalysisConfig</code> for <code>category</code> fix</li> <li><a href="f374a62c8b"><code>f374a62</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3098">#3098</a> from github/kaspersv/increase-overlay-base-size-limit</li> <li><a href="5efa438e92"><code>5efa438</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3101">#3101</a> from github/mbg/public-repo-notice-in-pr-template</li> <li><a href="8a84a62542"><code>8a84a62</code></a> Overlay: Increase size limit for cached overlay base database</li> <li><a href="eb50a881d8"><code>eb50a88</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3097">#3097</a> from github/redsun82/only-dump-sarif</li> <li><a href="4c534612bf"><code>4c53461</code></a> Tweak sarif dump log</li> <li><a href="dae3742b0a"><code>dae3742</code></a> Dump soon to be uploaded SARIF on request</li> <li>Additional commits viewable in <a href="3c3833e0f8...192325c861">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.29.11&new-version=3.30.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-15 11:07:14 +00:00 · 2025-09-14 13:04:41 +00:00 · 2025-09-14 14:58:58 +02:00 · 2025-09-14 14:57:21 +02:00 · 2025-09-14 14:55:08 +02:00 · 2025-09-11 09:12:35 +00:00
24 changed files with 11599 additions and 4158 deletions
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -21,6 +21,8 @@ on:
    branches:
      - main

+permissions: {}
+
 jobs:
  analyze:
    name: Analyze
@@ -39,11 +41,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
        with:
          languages: ${{ matrix.language }}
          source-root: src
@@ -55,7 +59,7 @@ jobs:
      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 https://git.io/JvXDl
@@ -69,4 +73,4 @@ jobs:
      #   make release

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -8,6 +8,8 @@ on:
    branches:
      - main

+permissions: {}
+
 jobs:
  update_release_draft:
    name: ✏️ Draft release
@@ -17,6 +19,6 @@ jobs:
      pull-requests: read
    steps:
      - name: 🚀 Run Release Drafter
-        uses: release-drafter/release-drafter@v6.1.0
+        uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,11 +18,17 @@ permissions:
 jobs:
  lint:
    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # for zizmor
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Actionlint
        uses: eifinger/actionlint-action@23c85443d840cd73bbecb9cddfc933cc21649a38  # v1.9.1
-      - uses: actions/setup-node@v4
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5ca5fc7a4779c5263a3ffa0e1f693009994446d1 # v0.1.2
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
          node-version: "20"
      - run: |
@@ -44,7 +50,9 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, macos-14, windows-latest]
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install latest version
        id: setup-uv
        uses: ./
@@ -52,9 +60,17 @@ jobs:
        working-directory: __tests__/fixtures/uv-project
        shell: bash
      - name: Check uv-path is set
-        run: ${{ steps.setup-uv.outputs.uv-path }} --version
+        run: |
+          "${UV_PATH}" --version
+        shell: bash
+        env:
+          UV_PATH: ${{ steps.setup-uv.outputs.uv-path }}
      - name: Check uvx-path is set
-        run: ${{ steps.setup-uv.outputs.uvx-path }} --version
+        run: |
+          "${UVX_PATH}" --version
+        shell: bash
+        env:
+          UVX_PATH: ${{ steps.setup-uv.outputs.uvx-path }}

  test-specific-version:
    runs-on: ubuntu-latest
@@ -62,7 +78,9 @@ jobs:
      matrix:
        uv-version: ["0.3.0", "0.3.2", "0.3", "0.3.x", ">=0.3.0"]
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install version ${{ matrix.uv-version }}
        uses: ./
        with:
@@ -76,7 +94,9 @@ jobs:
        os: [ ubuntu-latest, selfhosted-ubuntu-arm64 ]
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install version 0.3
        id: setup-uv
        uses: ./
@@ -99,7 +119,9 @@ jobs:
  test-pep440-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install version 0.4.30
        id: setup-uv
        uses: ./
@@ -115,7 +137,9 @@ jobs:
  test-pyproject-file-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install version 0.5.14
        id: setup-uv
        uses: ./
@@ -131,7 +155,9 @@ jobs:
  test-malformed-pyproject-file-fallback:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install using malformed pyproject.toml
        id: setup-uv
        uses: ./
@@ -142,7 +168,9 @@ jobs:
  test-uv-file-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install version 0.5.15
        id: setup-uv
        uses: ./
@@ -158,7 +186,9 @@ jobs:
  test-version-file-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install from requirements file
        id: setup-uv
        uses: ./
@@ -174,7 +204,9 @@ jobs:
  test-version-file-hash-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install from requirements file
        id: setup-uv
        uses: ./
@@ -187,6 +219,24 @@ jobs:
            exit 1
          fi

+  test-tool-versions-file-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Install from .tools-versions file
+        id: setup-uv
+        uses: ./
+        with:
+          version-file: "__tests__/fixtures/.tool-versions"
+      - name: Correct version gets installed
+        run: |
+          if [ "$(uv --version)" != "uv 0.5.15" ]; then
+            echo "Wrong uv version: $(uv --version)"
+            exit 1
+          fi
+
  test-checksum:
    runs-on: ${{ matrix.inputs.os }}
    strategy:
@@ -197,7 +247,9 @@ jobs:
          - os: macos-latest
            checksum: "a70cbfbf3bb5c08b2f84963b4f12c94e08fbb2468ba418a3bfe1066fbe9e7218"
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Checksum matches expected
        uses: ./
        with:
@@ -209,7 +261,9 @@ jobs:
  test-with-explicit-token:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install default version
        uses: ./
        with:
@@ -220,7 +274,9 @@ jobs:
  test-uvx:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install default version
        uses: ./
      - run: uvx ruff --version
@@ -237,7 +293,9 @@ jobs:
            windows-latest,
          ]
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install default version
        uses: ./
      - run: uv tool install ruff
@@ -246,7 +304,9 @@ jobs:
  test-tilde-expansion-tool-dirs:
    runs-on: selfhosted-ubuntu-arm64
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Setup with cache
        uses: ./
        with:
@@ -269,7 +329,9 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install latest version
        uses: ./
        with:
@@ -290,7 +352,9 @@ jobs:
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install latest version
        uses: ./
        with:
@@ -311,7 +375,9 @@ jobs:
    runs-on: ubuntu-latest
    container: alpine
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install latest version
        uses: ./
      - run: uv sync
@@ -324,7 +390,9 @@ jobs:
        enable-cache: [ "true", "false", "auto" ]
        os: [ "ubuntu-latest", "selfhosted-ubuntu-arm64", "windows-latest" ]
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Setup with cache
        uses: ./
        with:
@@ -341,7 +409,9 @@ jobs:
        os: [ "ubuntu-latest", "selfhosted-ubuntu-arm64", "windows-latest" ]
    needs: test-setup-cache
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Restore with cache
        id: restore
        uses: ./
@@ -373,7 +443,9 @@ jobs:
  test-setup-cache-requirements-txt:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Setup with cache
        uses: ./
        with:
@@ -385,9 +457,11 @@ jobs:
        working-directory: __tests__/fixtures/requirements-txt-project
  test-restore-cache-requirements-txt:
    runs-on: ubuntu-latest
-    needs: test-setup-cache
+    needs: test-setup-cache-requirements-txt
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Restore with cache
        id: restore
        uses: ./
@@ -409,7 +483,9 @@ jobs:
  test-setup-cache-dependency-glob:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Setup with cache
        uses: ./
        with:
@@ -424,7 +500,9 @@ jobs:
    runs-on: ubuntu-latest
    needs: test-setup-cache-dependency-glob
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Change pyproject.toml
        run: |
          echo '[tool.uv]' >> __tests__/fixtures/uv-project/pyproject.toml
@@ -447,6 +525,78 @@ jobs:
        env:
          CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}

+  test-setup-cache-save-cache-false:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Setup with cache
+        uses: ./
+        with:
+          enable-cache: true
+          save-cache: false
+          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-save-cache-false
+      - run: uv sync
+        working-directory: __tests__/fixtures/uv-project
+        shell: bash
+  test-restore-cache-save-cache-false:
+    runs-on: ubuntu-latest
+    needs: test-setup-cache-save-cache-false
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Restore with cache
+        id: restore
+        uses: ./
+        with:
+          enable-cache: true
+          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-save-cache-false
+      - name: Cache was not hit
+        run: |
+          if [ "$CACHE_HIT" == "true" ]; then
+            exit 1
+          fi
+        env:
+          CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
+
+  test-setup-cache-restore-cache-false:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Setup with cache
+        uses: ./
+        with:
+          enable-cache: true
+          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-restore-cache-false
+      - run: uv sync
+        working-directory: __tests__/fixtures/uv-project
+        shell: bash
+  test-restore-cache-restore-cache-false:
+    runs-on: ubuntu-latest
+    needs: test-setup-cache-restore-cache-false
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Restore with cache
+        id: restore
+        uses: ./
+        with:
+          enable-cache: true
+          restore-cache: false
+          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-restore-cache-false
+      - name: Cache was not hit
+        run: |
+          if [ "$CACHE_HIT" == "true" ]; then
+            exit 1
+          fi
+        env:
+          CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
+
  test-cache-local:
    strategy:
      matrix:
@@ -459,7 +609,9 @@ jobs:
            expected-cache-dir: "/home/ubuntu/.cache/uv"
    runs-on: ${{ matrix.inputs.os }}
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Setup with cache
        uses: ./
        with:
@@ -474,7 +626,9 @@ jobs:
  test-setup-cache-local:
    runs-on: selfhosted-ubuntu-arm64
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Setup with cache
        uses: ./
        with:
@@ -487,7 +641,9 @@ jobs:
    runs-on: selfhosted-ubuntu-arm64
    needs: test-setup-cache-local
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Restore with cache
        id: restore
        uses: ./
@@ -508,7 +664,9 @@ jobs:
  test-tilde-expansion-cache-local-path:
    runs-on: selfhosted-ubuntu-arm64
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Create cache directory
        run: mkdir -p ~/uv-cache
        shell: bash
@@ -522,7 +680,9 @@ jobs:
  test-tilde-expansion-cache-dependency-glob:
    runs-on: selfhosted-ubuntu-arm64
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Create cache directory
        run: mkdir -p ~/uv-cache
        shell: bash
@@ -555,7 +715,9 @@ jobs:
  test-no-python-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Fake pyproject.toml at root
        run: cp __tests__/fixtures/old-python-constraint-project/pyproject.toml pyproject.toml
      - name: Setup with cache
@@ -568,7 +730,9 @@ jobs:
  test-custom-manifest-file:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Install from custom manifest file
        uses: ./
        with:
@@ -585,7 +749,9 @@ jobs:
  test-absolute-path:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: Create requirements.txt
        run: echo "uv==0.6.17" > /tmp/setup-uv-requirements.txt
      - name: Install from requirements file
@@ -603,7 +769,9 @@ jobs:
  test-relative-path:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
      - name: mkdir
        run: mkdir -p /tmp/setup-uv-test-relative-path
      - name: Create requirements.txt
@@ -635,6 +803,7 @@ jobs:
      - test-uv-file-version
      - test-version-file-version
      - test-version-file-hash-version
+      - test-tool-versions-file-version
      - test-checksum
      - test-with-explicit-token
      - test-uvx
@@ -650,6 +819,10 @@ jobs:
      - test-restore-cache-requirements-txt
      - test-setup-cache-dependency-glob
      - test-restore-cache-dependency-glob
+      - test-setup-cache-save-cache-false
+      - test-restore-cache-save-cache-false
+      - test-setup-cache-restore-cache-false
+      - test-restore-cache-restore-cache-false
      - test-setup-cache-local
      - test-restore-cache-local
      - test-tilde-expansion-cache-local-path
--- a/.github/workflows/update-known-versions.yml
+++ b/.github/workflows/update-known-versions.yml
@@ -3,16 +3,21 @@ on:
  workflow_dispatch:
  schedule:
    - cron: "0 4 * * *" # Run every day at 4am UTC
+  repository_dispatch:
+    types: [ pypi_release ]
+
+permissions: {}

 jobs:
  build:
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: write
-      pull-requests: write
    steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
          node-version: "20"
      - name: Update known versions
@@ -22,18 +27,25 @@ jobs:
          src/download/checksum/known-checksums.ts
          version-manifest.json
          ${{ secrets.GITHUB_TOKEN }}
-      - run: npm install && npm run all
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
-        with:
-          commit-message: "chore: update known versions"
-          title:
-            "chore: update known versions for ${{
-            steps.update-known-versions.outputs.latest-version }}"
-          body:
-            "chore: update known versions for ${{
-            steps.update-known-versions.outputs.latest-version }}"
-          base: main
-          labels: "automated-pr,update-known-versions"
-          branch: update-known-versions-pr
-          delete-branch: true
+      - name: Check for changes
+        id: changes_exist
+        run: |
+          git status --porcelain
+          if [ -n "$(git status --porcelain)" ]; then
+              echo "changes_exist=true" >> "$GITHUB_OUTPUT"
+          else
+              echo "changes_exist=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Compile changes
+        if: ${{ steps.changes_exist.outputs.changes_exist == 'true' }}
+        run: npm ci && npm run all
+      - name: Commit and push changes
+        if: ${{ steps.changes_exist.outputs.changes_exist == 'true' }}
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+          git add .
+          git commit -m "chore: update known versions for $LATEST_VERSION"
+          git push origin HEAD:refs/heads/main
+        env:
+          LATEST_VERSION: ${{ steps.update-known-versions.outputs.latest-version }}
--- a/.github/workflows/update-major-minor-tags.yml
+++ b/.github/workflows/update-major-minor-tags.yml
@@ -8,6 +8,8 @@ on:
    tags:
      - "v*.*.*"

+permissions: {}
+
 jobs:
  update_major_minor_tags:
    name: Make sure major and minor tags are up to date on a patch release
@@ -15,7 +17,9 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: true # needed for git push below
      - name: Update Major Minor Tags
        run: |
          set -x
--- a/README.md
+++ b/README.md
@@ -22,6 +22,8 @@ Set up your GitHub Actions workflow with a specific version of [uv](https://docs
  - [Validate checksum](#validate-checksum)
  - [Enable Caching](#enable-caching)
    - [Cache dependency glob](#cache-dependency-glob)
+    - [Restore cache](#restore-cache)
+    - [Save cache](#save-cache)
  - [Local cache path](#local-cache-path)
  - [Disable cache pruning](#disable-cache-pruning)
  - [Ignore nothing to cache](#ignore-nothing-to-cache)
@@ -100,6 +102,8 @@ You can use the `version-file` input to specify a file that contains the version
 This can either be a `pyproject.toml` or `uv.toml` file which defines a `required-version` or
 uv defined as a dependency in `pyproject.toml` or `requirements.txt`.

+[asdf](https://asdf-vm.com/) `.tool-versions` is also supported, but without the `ref` syntax.
+
 ```yaml
 - name: Install uv based on the version defined in pyproject.toml
  uses: astral-sh/setup-uv@v6
@@ -282,6 +286,33 @@ changes. If you use relative paths, they are relative to the repository root.
    cache-dependency-glob: ""
 ```

+#### Restore cache
+
+Restoring an existing cache can be enabled or disabled with the `restore-cache` input.
+By default, the cache will be restored.
+
+```yaml
+- name: Don't restore an existing cache
+  uses: astral-sh/setup-uv@v6
+  with:
+    enable-cache: true
+    restore-cache: false
+```
+
+#### Save cache
+
+You can also disable saving the cache after the run with the `save-cache` input.
+This can be useful to save cache storage when you know you will not use the cache of the run again.
+By default, the cache will be saved.
+
+```yaml
+- name: Don't save the cache after the run
+  uses: astral-sh/setup-uv@v6
+  with:
+    enable-cache: true
+    save-cache: false
+```
+
 ### Local cache path

 This action controls where uv stores its cache on the runner's filesystem by setting `UV_CACHE_DIR`.
--- a/tests/fixtures/.tool-versions
+++ b/tests/fixtures/.tool-versions
@@ -0,0 +1 @@
+uv 0.5.15
--- a/tests/utils/inputs.test.ts
+++ b/tests/utils/inputs.test.ts
@@ -0,0 +1,86 @@
+jest.mock("@actions/core", () => {
+  return {
+    debug: jest.fn(),
+    getBooleanInput: jest.fn(
+      (name: string) => (mockInputs[name] ?? "") === "true",
+    ),
+    getInput: jest.fn((name: string) => mockInputs[name] ?? ""),
+  };
+});
+
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+
+// Will be mutated per test before (re-)importing the module under test
+let mockInputs: Record<string, string> = {};
+const ORIGINAL_HOME = process.env.HOME;
+
+describe("cacheDependencyGlob", () => {
+  beforeEach(() => {
+    jest.resetModules();
+    mockInputs = {};
+    process.env.HOME = "/home/testuser";
+  });
+
+  afterEach(() => {
+    process.env.HOME = ORIGINAL_HOME;
+  });
+
+  it("returns empty string when input not provided", async () => {
+    mockInputs["working-directory"] = "/workspace";
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
+    expect(cacheDependencyGlob).toBe("");
+  });
+
+  it("resolves a single relative path", async () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["cache-dependency-glob"] = "requirements.txt";
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
+    expect(cacheDependencyGlob).toBe("/workspace/requirements.txt");
+  });
+
+  it("strips leading ./ from relative path", async () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["cache-dependency-glob"] = "./uv.lock";
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
+    expect(cacheDependencyGlob).toBe("/workspace/uv.lock");
+  });
+
+  it("handles multiple lines, trimming whitespace, tilde expansion and absolute paths", async () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["cache-dependency-glob"] =
+      "  ~/.cache/file1\n ./rel/file2  \nfile3.txt";
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
+    expect(cacheDependencyGlob).toBe(
+      [
+        "/home/testuser/.cache/file1", // expanded tilde, absolute path unchanged
+        "/workspace/rel/file2", // ./ stripped and resolved
+        "/workspace/file3.txt", // relative path resolved
+      ].join("\n"),
+    );
+  });
+
+  it("keeps absolute path unchanged in multiline input", async () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["cache-dependency-glob"] = "/abs/path.lock\nrelative.lock";
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
+    expect(cacheDependencyGlob).toBe(
+      ["/abs/path.lock", "/workspace/relative.lock"].join("\n"),
+    );
+  });
+
+  it("handles exclusions in relative paths correct", async () => {
+    mockInputs["working-directory"] = "/workspace";
+    mockInputs["cache-dependency-glob"] = "!/abs/path.lock\n!relative.lock";
+    const { cacheDependencyGlob } = await import("../../src/utils/inputs");
+    expect(cacheDependencyGlob).toBe(
+      ["!/abs/path.lock", "!/workspace/relative.lock"].join("\n"),
+    );
+  });
+});
--- a/tests/version/tool-versions-file.test.ts
+++ b/tests/version/tool-versions-file.test.ts
@@ -0,0 +1,115 @@
+jest.mock("node:fs");
+jest.mock("@actions/core", () => ({
+  warning: jest.fn(),
+}));
+
+import fs from "node:fs";
+import * as core from "@actions/core";
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { getUvVersionFromToolVersions } from "../../src/version/tool-versions-file";
+
+const mockedFs = fs as jest.Mocked<typeof fs>;
+const mockedCore = core as jest.Mocked<typeof core>;
+
+describe("getUvVersionFromToolVersions", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("should return undefined for non-.tool-versions files", () => {
+    const result = getUvVersionFromToolVersions("package.json");
+    expect(result).toBeUndefined();
+    expect(mockedFs.readFileSync).not.toHaveBeenCalled();
+  });
+
+  it("should return version for valid uv entry", () => {
+    const fileContent = "python 3.11.0\nuv 0.1.0\nnodejs 18.0.0";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBe("0.1.0");
+    expect(mockedFs.readFileSync).toHaveBeenCalledWith(
+      ".tool-versions",
+      "utf8",
+    );
+  });
+
+  it("should return version for uv entry with v prefix", () => {
+    const fileContent = "uv v0.2.0";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBe("0.2.0");
+  });
+
+  it("should handle whitespace around uv entry", () => {
+    const fileContent = "  uv   0.3.0  ";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBe("0.3.0");
+  });
+
+  it("should skip commented lines", () => {
+    const fileContent = "# uv 0.1.0\npython 3.11.0\nuv 0.2.0";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBe("0.2.0");
+  });
+
+  it("should return first matching uv version", () => {
+    const fileContent = "uv 0.1.0\npython 3.11.0\nuv 0.2.0";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBe("0.1.0");
+  });
+
+  it("should return undefined when no uv entry found", () => {
+    const fileContent = "python 3.11.0\nnodejs 18.0.0";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBeUndefined();
+  });
+
+  it("should return undefined for empty file", () => {
+    mockedFs.readFileSync.mockReturnValue("");
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBeUndefined();
+  });
+
+  it("should warn and return undefined for ref syntax", () => {
+    const fileContent = "uv ref:main";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions(".tool-versions");
+
+    expect(result).toBeUndefined();
+    expect(mockedCore.warning).toHaveBeenCalledWith(
+      "The ref syntax of .tool-versions is not supported. Please use a released version instead.",
+    );
+  });
+
+  it("should handle file path with .tool-versions extension", () => {
+    const fileContent = "uv 0.1.0";
+    mockedFs.readFileSync.mockReturnValue(fileContent);
+
+    const result = getUvVersionFromToolVersions("path/to/.tool-versions");
+
+    expect(result).toBe("0.1.0");
+    expect(mockedFs.readFileSync).toHaveBeenCalledWith(
+      "path/to/.tool-versions",
+      "utf8",
+    );
+  });
+});
--- a/action.yml
+++ b/action.yml
@@ -44,6 +44,12 @@ inputs:
      **/*constraints*.in
      **/pyproject.toml
      **/uv.lock
+  restore-cache:
+    description: "Whether to restore the cache if found."
+    default: "true"
+  save-cache:
+    description: "Whether to save the cache after the run."
+    default: "true"
  cache-suffix:
    description: "Suffix for the cache key"
    required: false
--- a/biome.json
+++ b/biome.json
@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.1.4/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.2.4/schema.json",
  "assist": {
    "actions": {
      "source": {
--- a/dist/save-cache/index.js
+++ b/dist/save-cache/index.js
@@ -48,6 +48,7 @@ const cacheTwirpClient = __importStar(__nccwpck_require__(6819));
 const config_1 = __nccwpck_require__(7606);
 const tar_1 = __nccwpck_require__(5321);
 const constants_1 = __nccwpck_require__(8287);
+const http_client_1 = __nccwpck_require__(4844);
 class ValidationError extends Error {
    constructor(message) {
        super(message);
@@ -84,7 +85,17 @@ function checkKey(key) {
 * @returns boolean return true if Actions cache service feature is available, otherwise false
 */
 function isFeatureAvailable() {
-    return !!process.env['ACTIONS_CACHE_URL'];
+    const cacheServiceVersion = (0, config_1.getCacheServiceVersion)();
+    // Check availability based on cache service version
+    switch (cacheServiceVersion) {
+        case 'v2':
+            // For v2, we need ACTIONS_RESULTS_URL
+            return !!process.env['ACTIONS_RESULTS_URL'];
+        case 'v1':
+        default:
+            // For v1, we only need ACTIONS_CACHE_URL
+            return !!process.env['ACTIONS_CACHE_URL'];
+    }
 }
 exports.isFeatureAvailable = isFeatureAvailable;
 /**
@@ -169,8 +180,16 @@ function restoreCacheV1(paths, primaryKey, restoreKeys, options, enableCrossOsAr
                throw error;
            }
            else {
-                // Supress all non-validation cache related errors because caching should be optional
-                core.warning(`Failed to restore: ${error.message}`);
+                // warn on cache restore failure and continue build
+                // Log server errors (5xx) as errors, all other errors as warnings
+                if (typedError instanceof http_client_1.HttpClientError &&
+                    typeof typedError.statusCode === 'number' &&
+                    typedError.statusCode >= 500) {
+                    core.error(`Failed to restore: ${error.message}`);
+                }
+                else {
+                    core.warning(`Failed to restore: ${error.message}`);
+                }
            }
        }
        finally {
@@ -223,7 +242,13 @@ function restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsAr
                core.debug(`Cache not found for version ${request.version} of keys: ${keys.join(', ')}`);
                return undefined;
            }
-            core.info(`Cache hit for: ${request.key}`);
+            const isRestoreKeyMatch = request.key !== response.matchedKey;
+            if (isRestoreKeyMatch) {
+                core.info(`Cache hit for restore-key: ${response.matchedKey}`);
+            }
+            else {
+                core.info(`Cache hit for: ${response.matchedKey}`);
+            }
            if (options === null || options === void 0 ? void 0 : options.lookupOnly) {
                core.info('Lookup only - skipping download');
                return response.matchedKey;
@@ -248,7 +273,15 @@ function restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsAr
            }
            else {
                // Supress all non-validation cache related errors because caching should be optional
-                core.warning(`Failed to restore: ${error.message}`);
+                // Log server errors (5xx) as errors, all other errors as warnings
+                if (typedError instanceof http_client_1.HttpClientError &&
+                    typeof typedError.statusCode === 'number' &&
+                    typedError.statusCode >= 500) {
+                    core.error(`Failed to restore: ${error.message}`);
+                }
+                else {
+                    core.warning(`Failed to restore: ${error.message}`);
+                }
            }
        }
        finally {
@@ -351,7 +384,15 @@ function saveCacheV1(paths, key, options, enableCrossOsArchive = false) {
                core.info(`Failed to save: ${typedError.message}`);
            }
            else {
-                core.warning(`Failed to save: ${typedError.message}`);
+                // Log server errors (5xx) as errors, all other errors as warnings
+                if (typedError instanceof http_client_1.HttpClientError &&
+                    typeof typedError.statusCode === 'number' &&
+                    typedError.statusCode >= 500) {
+                    core.error(`Failed to save: ${typedError.message}`);
+                }
+                else {
+                    core.warning(`Failed to save: ${typedError.message}`);
+                }
            }
        }
        finally {
@@ -447,7 +488,15 @@ function saveCacheV2(paths, key, options, enableCrossOsArchive = false) {
                core.info(`Failed to save: ${typedError.message}`);
            }
            else {
-                core.warning(`Failed to save: ${typedError.message}`);
+                // Log server errors (5xx) as errors, all other errors as warnings
+                if (typedError instanceof http_client_1.HttpClientError &&
+                    typeof typedError.statusCode === 'number' &&
+                    typedError.statusCode >= 500) {
+                    core.error(`Failed to save: ${typedError.message}`);
+                }
+                else {
+                    core.warning(`Failed to save: ${typedError.message}`);
+                }
            }
        }
        finally {
@@ -71331,6 +71380,10 @@ class RpcOutputStreamController {
            cmp: [],
        };
        this._closed = false;
+        // --- RpcOutputStream async iterator API
+        // iterator state.
+        // is undefined when no iterator has been acquired yet.
+        this._itState = { q: [] };
    }
    // --- RpcOutputStream callback API
    onNext(callback) {
@@ -71430,10 +71483,6 @@ class RpcOutputStreamController {
     *   messages are queued.
     */
    [Symbol.asyncIterator]() {
-        // init the iterator state, enabling pushIt()
-        if (!this._itState) {
-            this._itState = { q: [] };
-        }
        // if we are closed, we are definitely not receiving any more messages.
        // but we can't let the iterator get stuck. we want to either:
        // a) finish the new iterator immediately, because we are completed
@@ -71466,8 +71515,6 @@ class RpcOutputStreamController {
    // this either resolves a pending promise, or enqueues the result.
    pushIt(result) {
        let state = this._itState;
-        if (!state)
-            return;
        // is the consumer waiting for us?
        if (state.p) {
            // yes, consumer is waiting for this promise.
@@ -73379,6 +73426,7 @@ const reflection_equals_1 = __nccwpck_require__(4827);
 const binary_writer_1 = __nccwpck_require__(3957);
 const binary_reader_1 = __nccwpck_require__(2889);
 const baseDescriptors = Object.getOwnPropertyDescriptors(Object.getPrototypeOf({}));
+const messageTypeDescriptor = baseDescriptors[message_type_contract_1.MESSAGE_TYPE] = {};
 /**
 * This standard message type provides reflection-based
 * operations to work with a message.
@@ -73389,7 +73437,8 @@ class MessageType {
        this.typeName = name;
        this.fields = fields.map(reflection_info_1.normalizeFieldInfo);
        this.options = options !== null && options !== void 0 ? options : {};
-        this.messagePrototype = Object.create(null, Object.assign(Object.assign({}, baseDescriptors), { [message_type_contract_1.MESSAGE_TYPE]: { value: this } }));
+        messageTypeDescriptor.value = this;
+        this.messagePrototype = Object.create(null, baseDescriptors);
        this.refTypeCheck = new reflection_type_check_1.ReflectionTypeCheck(this);
        this.refJsonReader = new reflection_json_reader_1.ReflectionJsonReader(this);
        this.refJsonWriter = new reflection_json_writer_1.ReflectionJsonWriter(this);
@@ -74906,12 +74955,16 @@ class ReflectionJsonReader {
                        target[localName] = field.T().internalJsonRead(jsonValue, options, target[localName]);
                        break;
                    case "enum":
+                        if (jsonValue === null)
+                            continue;
                        let val = this.enum(field.T(), jsonValue, field.name, options.ignoreUnknownFields);
                        if (val === false)
                            continue;
                        target[localName] = val;
                        break;
                    case "scalar":
+                        if (jsonValue === null)
+                            continue;
                        target[localName] = this.scalar(jsonValue, field.T, field.L, field.name);
                        break;
                }
@@ -89756,6 +89809,11 @@ exports.STATE_CACHE_MATCHED_KEY = "cache-matched-key";
 const CACHE_VERSION = "1";
 async function restoreCache() {
    const cacheKey = await computeKeys();
+    core.saveState(exports.STATE_CACHE_KEY, cacheKey);
+    if (!inputs_1.restoreCache) {
+        core.info("restore-cache is false. Skipping restore cache step.");
+        return;
+    }
    let matchedKey;
    core.info(`Trying to restore uv cache from GitHub Actions cache with key: ${cacheKey}`);
    try {
@@ -89767,7 +89825,6 @@ async function restoreCache() {
        core.setOutput("cache-hit", false);
        return;
    }
-    core.saveState(exports.STATE_CACHE_KEY, cacheKey);
    handleMatchResult(matchedKey, cacheKey);
 }
 async function computeKeys() {
@@ -89966,7 +90023,12 @@ const inputs_1 = __nccwpck_require__(9612);
 async function run() {
    try {
        if (inputs_1.enableCache) {
-            await saveCache();
+            if (inputs_1.saveCache) {
+                await saveCache();
+            }
+            else {
+                core.info("save-cache is false. Skipping save cache step.");
+            }
            // node will stay alive if any promises are not resolved,
            // which is a possibility if HTTP requests are dangling
            // due to retries or timeouts. We know that if we got here
@@ -90068,7 +90130,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.addProblemMatchers = exports.manifestFile = exports.githubToken = exports.serverUrl = exports.toolDir = exports.toolBinDir = exports.ignoreEmptyWorkdir = exports.ignoreNothingToCache = exports.pruneCache = exports.cacheDependencyGlob = exports.cacheLocalPath = exports.cacheSuffix = exports.enableCache = exports.checkSum = exports.activateEnvironment = exports.pythonVersion = exports.versionFile = exports.version = exports.workingDirectory = void 0;
+exports.addProblemMatchers = exports.manifestFile = exports.githubToken = exports.serverUrl = exports.toolDir = exports.toolBinDir = exports.ignoreEmptyWorkdir = exports.ignoreNothingToCache = exports.pruneCache = exports.cacheDependencyGlob = exports.cacheLocalPath = exports.cacheSuffix = exports.saveCache = exports.restoreCache = exports.enableCache = exports.checkSum = exports.activateEnvironment = exports.pythonVersion = exports.versionFile = exports.version = exports.workingDirectory = void 0;
 const node_path_1 = __importDefault(__nccwpck_require__(6760));
 const core = __importStar(__nccwpck_require__(7484));
 exports.workingDirectory = core.getInput("working-directory");
@@ -90078,6 +90140,8 @@ exports.pythonVersion = core.getInput("python-version");
 exports.activateEnvironment = core.getBooleanInput("activate-environment");
 exports.checkSum = core.getInput("checksum");
 exports.enableCache = getEnableCache();
+exports.restoreCache = core.getInput("restore-cache") === "true";
+exports.saveCache = core.getInput("save-cache") === "true";
 exports.cacheSuffix = core.getInput("cache-suffix") || "";
 exports.cacheLocalPath = getCacheLocalPath();
 exports.cacheDependencyGlob = getCacheDependencyGlob();
@@ -90169,16 +90233,11 @@ function expandTilde(input) {
    return input;
 }
 function resolveRelativePath(inputPath) {
-    if (node_path_1.default.isAbsolute(inputPath)) {
-        return inputPath;
-    }
-    let absolutePath = inputPath;
-    if (absolutePath.startsWith("./")) {
-        absolutePath = absolutePath.substring(2);
-    }
-    absolutePath = `${exports.workingDirectory}${node_path_1.default.sep}${absolutePath}`;
-    core.debug(`Resolving relative path ${inputPath} to ${absolutePath}`);
-    return absolutePath;
+    const hasNegation = inputPath.startsWith("!");
+    const pathWithoutNegation = hasNegation ? inputPath.substring(1) : inputPath;
+    const resolvedPath = node_path_1.default.resolve(exports.workingDirectory, pathWithoutNegation);
+    core.debug(`Resolving relative path ${inputPath} to ${hasNegation ? "!" : ""}${resolvedPath}`);
+    return hasNegation ? `!${resolvedPath}` : resolvedPath;
 }
 function getManifestFile() {
    const manifestFileInput = core.getInput("manifest-file");
@@ -92202,7 +92261,7 @@ module.exports = parseParams
 /***/ ((module) => {

 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"4.0.3","preview":true,"description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","main":"lib/cache.js","types":"lib/cache.d.ts","directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^1.11.1","@actions/exec":"^1.0.1","@actions/glob":"^0.1.0","@actions/http-client":"^2.1.1","@actions/io":"^1.0.1","@azure/abort-controller":"^1.1.0","@azure/ms-rest-js":"^2.6.0","@azure/storage-blob":"^12.13.0","@protobuf-ts/plugin":"^2.9.4","semver":"^6.3.1"},"devDependencies":{"@types/node":"^22.13.9","@types/semver":"^6.0.0","typescript":"^5.2.2"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"4.0.5","preview":true,"description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","main":"lib/cache.js","types":"lib/cache.d.ts","directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^1.11.1","@actions/exec":"^1.0.1","@actions/glob":"^0.1.0","@protobuf-ts/runtime-rpc":"^2.11.1","@actions/http-client":"^2.1.1","@actions/io":"^1.0.1","@azure/abort-controller":"^1.1.0","@azure/ms-rest-js":"^2.6.0","@azure/storage-blob":"^12.13.0","semver":"^6.3.1"},"devDependencies":{"@types/node":"^22.13.9","@types/semver":"^6.0.0","@protobuf-ts/plugin":"^2.9.4","typescript":"^5.2.2"}}');

 /***/ }),

--- a/dist/setup/index.js
+++ b/dist/setup/index.js
--- a/dist/update-known-versions/index.js
+++ b/dist/update-known-versions/index.js
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
  "author": "@eifinger",
  "license": "MIT",
  "dependencies": {
-    "@actions/cache": "^4.0.3",
+    "@actions/cache": "^4.0.5",
    "@actions/core": "^1.11.1",
    "@actions/exec": "^1.1.1",
    "@actions/glob": "^0.5.0",
@@ -30,19 +30,19 @@
    "@octokit/core": "^7.0.3",
    "@octokit/plugin-paginate-rest": "^13.1.1",
    "@octokit/plugin-rest-endpoint-methods": "^16.0.0",
-    "@renovatebot/pep440": "^4.1.0",
-    "smol-toml": "^1.3.4",
-    "undici": "^7.10.0"
+    "@renovatebot/pep440": "^4.2.0",
+    "smol-toml": "^1.4.2",
+    "undici": "^7.16.0"
  },
  "devDependencies": {
-    "@biomejs/biome": "2.1.4",
+    "@biomejs/biome": "2.2.4",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^24.0.14",
-    "@types/semver": "^7.7.0",
+    "@types/node": "^24.3.1",
+    "@types/semver": "^7.7.1",
    "@vercel/ncc": "^0.38.3",
-    "jest": "^30.0.5",
+    "jest": "^30.1.3",
    "js-yaml": "^4.1.0",
    "ts-jest": "^29.4.1",
-    "typescript": "^5.8.3"
+    "typescript": "^5.9.2"
  }
 }
--- a/src/cache/restore-cache.ts
+++ b/src/cache/restore-cache.ts
@@ -8,6 +8,7 @@ import {
  cacheSuffix,
  pruneCache,
  pythonVersion as pythonVersionInput,
+  restoreCache as shouldRestoreCache,
  workingDirectory,
 } from "../utils/inputs";
 import { getArch, getPlatform } from "../utils/platforms";
@@ -18,6 +19,12 @@ const CACHE_VERSION = "1";

 export async function restoreCache(): Promise<void> {
  const cacheKey = await computeKeys();
+  core.saveState(STATE_CACHE_KEY, cacheKey);
+
+  if (!shouldRestoreCache) {
+    core.info("restore-cache is false. Skipping restore cache step.");
+    return;
+  }

  let matchedKey: string | undefined;
  core.info(
@@ -32,8 +39,6 @@ export async function restoreCache(): Promise<void> {
    return;
  }

-  core.saveState(STATE_CACHE_KEY, cacheKey);
-
  handleMatchResult(matchedKey, cacheKey);
 }

--- a/src/download/checksum/known-checksums.ts
+++ b/src/download/checksum/known-checksums.ts
@@ -1,5 +1,297 @@
 // AUTOGENERATED_DO_NOT_EDIT
 export const KNOWN_CHECKSUMS: { [key: string]: string } = {
+  "aarch64-apple-darwin-0.8.17":
+    "e4d4859d7726298daa4c12e114f269ff282b2cfc2b415dc0b2ca44ae2dbd358e",
+  "aarch64-pc-windows-msvc-0.8.17":
+    "2396749de576e45a40efa35fe94b3f953c3224c21f75c05772593e085d78e77d",
+  "aarch64-unknown-linux-gnu-0.8.17":
+    "9a20d65b110770bbaa2ee89ed76eb963d8c6a480b9ebef584ea9df2ae85b4f0f",
+  "aarch64-unknown-linux-musl-0.8.17":
+    "bd141b7e263935d14f5725f2a5c1c942fd89642e37683cb904f1984ce7e365f4",
+  "arm-unknown-linux-musleabihf-0.8.17":
+    "9d4ffb6751d65a52f8daf3fd88e331ab989d490a6e336d6a96cac668fce17a65",
+  "armv7-unknown-linux-gnueabihf-0.8.17":
+    "014afffa5621986aefbe8a6d71597eb45b8cd3d4e94f825f34ec49ba4cd0c382",
+  "armv7-unknown-linux-musleabihf-0.8.17":
+    "fb976e7482c4550f38c51c5c23b9dae0322c3173f56436bf9a81252e4b74fcfb",
+  "i686-pc-windows-msvc-0.8.17":
+    "f528893452ca512b555b63267292977d237bd6fbdd967c9be6941a65ebf256f4",
+  "i686-unknown-linux-gnu-0.8.17":
+    "d52438a1588ea7c2332dc4aa8c93eedae344fc435c95491037237c7b4b36eae4",
+  "i686-unknown-linux-musl-0.8.17":
+    "9e10f4c57034e6e98dea48b0f4250a7eff983f1b2947d99ed6605a4eb0ec8d22",
+  "loongarch64-unknown-linux-gnu-0.8.17":
+    "1d02e45dbbcbbaa867afe59fd62b294cba47abf1a76e151e19db03b5dbf1c9c8",
+  "powerpc64-unknown-linux-gnu-0.8.17":
+    "6f448735dfd72e2d5c3e3bb541b388c58cdfcf3a562128d5ac1a5f2be47f95d6",
+  "powerpc64le-unknown-linux-gnu-0.8.17":
+    "e4b28cab21eb990e2bea768bc9f43b61e4fd554552cea8868c855027decef69d",
+  "riscv64gc-unknown-linux-gnu-0.8.17":
+    "f653caa34479d405d290b825a2fe782bb26c55a7bfaa870911b4e18792312d45",
+  "s390x-unknown-linux-gnu-0.8.17":
+    "8fae8182704b4b11316c87d897c3e64f2d3f55ac8c58c482d9bbef9ad611f90c",
+  "x86_64-apple-darwin-0.8.17":
+    "31ed353cfd8e6c962e7c60617bd8a9d6b97b704c1ecb5b5eceaff8c6121b54ac",
+  "x86_64-pc-windows-msvc-0.8.17":
+    "0d051779fbcb173b183efeae1c3e96148764fd82709bbbf0966df3efe48b67c5",
+  "x86_64-unknown-linux-gnu-0.8.17":
+    "920cbcaad514cc185634f6f0dcd71df5e8f4ee4456d440a22e0f8c0f142a8203",
+  "x86_64-unknown-linux-musl-0.8.17":
+    "4057052999a210fe78d93599d2165da9e24c8bbb23370cdd26b66a98ab479203",
+  "aarch64-apple-darwin-0.8.16":
+    "87e4b51b735e8445f6c445c7b4c0398273e40d34cd192bad8158736653600cd6",
+  "aarch64-pc-windows-msvc-0.8.16":
+    "392acca957d8d7cccafbb68ce6c4ba29b2ff00c8b0d4744a2136918d3a7bf765",
+  "aarch64-unknown-linux-gnu-0.8.16":
+    "22a3cbaf87776b73c2657ba5d63f8565c1235b65eaf57dffda66061f7a09913b",
+  "aarch64-unknown-linux-musl-0.8.16":
+    "6bd6a11c384f07353c3c7eec9bde094f89b92a12dc09caea9df40c424afebea5",
+  "arm-unknown-linux-musleabihf-0.8.16":
+    "53c31a6559dc4fb22ce8c56640b00a8404b7e4d55f68b6bb3aa188864e2c3084",
+  "armv7-unknown-linux-gnueabihf-0.8.16":
+    "ada6f393d5e5d9cba5445832ba61e8222859e915e5d77a37f5dd35979f3f18e4",
+  "armv7-unknown-linux-musleabihf-0.8.16":
+    "55690f70f9c61963c0069558e205acda9ff0604a44028226b9a0ec3b847c9125",
+  "i686-pc-windows-msvc-0.8.16":
+    "1e727b8af6c0781bc6eb9a2c34e7ee704070b7a2f122544443418e8be13019ee",
+  "i686-unknown-linux-gnu-0.8.16":
+    "4eaf39134663ef184f684be6f6aa83e971fb36ef7d1c67a5f2196268b61c0579",
+  "i686-unknown-linux-musl-0.8.16":
+    "a179ceba9f2fcca7b46a86b12715e28fb3429ff8193ae839700d534e35e95a45",
+  "loongarch64-unknown-linux-gnu-0.8.16":
+    "600a8be6d2621d654b6665d9a8df9370f4af9c0b6ceb851d1ae0d4b895e8e546",
+  "powerpc64-unknown-linux-gnu-0.8.16":
+    "c86008ef8a3e3730b0e58a168542331960c90a3b043e3853c1941457748595f3",
+  "powerpc64le-unknown-linux-gnu-0.8.16":
+    "91645092447a14c23b47d0f434a787a9555b29e061607d9e60d2d556b831f5aa",
+  "riscv64gc-unknown-linux-gnu-0.8.16":
+    "dbaeff3f0baad73c264c35abd937a231fb6b9d1201b6763d82e39e7516358115",
+  "s390x-unknown-linux-gnu-0.8.16":
+    "e29c330a8956c13acb0f2af7aa650dd5d9ebba6aefdceaea77f689953d140780",
+  "x86_64-apple-darwin-0.8.16":
+    "07491a998fd741090501df9bbfe538f85568901a3a66c9e0368636509158727a",
+  "x86_64-pc-windows-msvc-0.8.16":
+    "97fb93678eca3b4f731ea3879ae2e78787976e03f38c9c6fb744ab28bc3aec1b",
+  "x86_64-unknown-linux-gnu-0.8.16":
+    "fc94e50e8ef93a97d723b83faa42888e7710c4443a5b8a1af3aac2cda5390f3a",
+  "x86_64-unknown-linux-musl-0.8.16":
+    "ee220f112b91b23f641d169ba7a3652c6ab7104e7c666d26104ebd6a2f76be43",
+  "aarch64-apple-darwin-0.8.15":
+    "103367962c5cb00bf7370d84cbaa3fec5a9807be9cc833ea9d8eea400c119fa2",
+  "aarch64-pc-windows-msvc-0.8.15":
+    "16d92f21508c5dbd3374466c2cdad2909959a6d3bd06672b9db023f2a5d7a014",
+  "aarch64-unknown-linux-gnu-0.8.15":
+    "6ede0fefa7db7be3d5d9eda8784a8e43b1cf5410720eb3da60ab1d2f66678e82",
+  "aarch64-unknown-linux-musl-0.8.15":
+    "23ea21a05c62c4c307ce691f29bff2f15c94c4f07f2b83d9b356f0664bc8b3a2",
+  "arm-unknown-linux-musleabihf-0.8.15":
+    "deeac755224244b535c9f654b29aad8a165c94840a520d41e5c697235edd0576",
+  "armv7-unknown-linux-gnueabihf-0.8.15":
+    "07ad33bc28ed276944d069eb714322b24167bfe106b4bded01e272fe245934ba",
+  "armv7-unknown-linux-musleabihf-0.8.15":
+    "0b4f73e084a04828f2431c887c2e3eea590ff06a1dc279e473dd1d94cdc8f25d",
+  "i686-pc-windows-msvc-0.8.15":
+    "34425e7dc7323b98fc844d9223596e9a1d2347e6f85a512221428a455dcbea78",
+  "i686-unknown-linux-gnu-0.8.15":
+    "16230e9b785fccb628e920d0fa1ca59b50b0515b838b2bb80f997bcb7a35f2bb",
+  "i686-unknown-linux-musl-0.8.15":
+    "43d554953beac56a8d8ba23aeb2b0e0e5c43020b074071c15df5d492e46a81f3",
+  "powerpc64-unknown-linux-gnu-0.8.15":
+    "71465b1d08e0a4cb3fcfe02e127104400a85ed00c30ec5f53f8705e71567fb6a",
+  "powerpc64le-unknown-linux-gnu-0.8.15":
+    "54157ee5e01b02b8c89131391d62228787750b556bbdb7d3428a3cdfd1698102",
+  "riscv64gc-unknown-linux-gnu-0.8.15":
+    "faa4a470a26ad0db0dbefc510fac91fa0da4d9cd06ca4f229933f7aac21e46b2",
+  "s390x-unknown-linux-gnu-0.8.15":
+    "0bb022274375745352a748b8332bb170941fe01915a1670c2c6d06d182783437",
+  "x86_64-apple-darwin-0.8.15":
+    "2bbef70982e97dfc36454de173f35ec1a5e83ae11e3885df6a50db3fd76171cb",
+  "x86_64-pc-windows-msvc-0.8.15":
+    "459d95892a5cc5c21779532f4f41b9238594b79e312a5142da2148ecfa10e705",
+  "x86_64-unknown-linux-gnu-0.8.15":
+    "be9878e9d08ebcb621a683aba52e7fb8bbf92b2532e0d759026ffcc067673042",
+  "x86_64-unknown-linux-musl-0.8.15":
+    "d0fec58f3124e05e0a1af0f6541abfce4333253cdaf23c7b6bb2e6128bf138ea",
+  "aarch64-apple-darwin-0.8.14":
+    "281ea18a5778099f7edeee0a7b20671d14918782de153604c939486f2b8a2791",
+  "aarch64-pc-windows-msvc-0.8.14":
+    "d7fef1d1d0b0f8e0aa94391376fe5fb95f0e213ef7ee1c498c287fe0ea76f886",
+  "aarch64-unknown-linux-gnu-0.8.14":
+    "69616218470b2ad053617efb9e7027b1518ea38918d933c2791e113d99cec507",
+  "aarch64-unknown-linux-musl-0.8.14":
+    "d492d433d8ea87a4051c3f071ed04f13f8f001aa782e2e8192eaa5143e9a6f39",
+  "arm-unknown-linux-musleabihf-0.8.14":
+    "ef6a51cc1808de75969e2719420464d494bb5932d18ebf3ac07df7a5ab27b16a",
+  "armv7-unknown-linux-gnueabihf-0.8.14":
+    "75c77b40c39dd526f88f5119d686e44d95c10cece436e4306f0db32b94d91716",
+  "armv7-unknown-linux-musleabihf-0.8.14":
+    "33a15d40d407323a516edabdc4eb33bbefc04e17d40769a04bfc15605d2eee1e",
+  "i686-pc-windows-msvc-0.8.14":
+    "b43c5703cdfb15c019b04cad2ef19034a91e8a0872ae2d674d366dfc0a755124",
+  "i686-unknown-linux-gnu-0.8.14":
+    "d49a796d569b010d43eeb8d9259f1a12fa910176b076c04c13609648973f428e",
+  "i686-unknown-linux-musl-0.8.14":
+    "cee58d8fe55f59a0869039f83875ee44a4a12b3b3f1f1f5a2bdc68968e449f54",
+  "powerpc64-unknown-linux-gnu-0.8.14":
+    "f118e642a7e360384a0277980986cea4857cc2d90364d58865d941c6b8abfcd1",
+  "powerpc64le-unknown-linux-gnu-0.8.14":
+    "c411e63edd125283641420bb4be830872be269451756de2095aebc3ca8b0277a",
+  "riscv64gc-unknown-linux-gnu-0.8.14":
+    "1bb13f9d1a3e55dcea09f3b99b35ec0fbd3428276311b068268b07cd07c5b067",
+  "s390x-unknown-linux-gnu-0.8.14":
+    "8643d6ab3513ab4adc3ffb56c39813651725d047ee6af5de3ae1fd0e4975c364",
+  "x86_64-apple-darwin-0.8.14":
+    "567d98b0c541a68df8aaa2c3214242c4070068b2edaea1be376a4c0fa348bdf1",
+  "x86_64-pc-windows-msvc-0.8.14":
+    "3f68ab95d2856e6b238e0e3f4255a723ccdc2cf1d4b8e53f5a4f5a47b645dc72",
+  "x86_64-unknown-linux-gnu-0.8.14":
+    "954add045f29f93191523175e4aea066996840e86c1b6339dee25f48b15b5ddb",
+  "x86_64-unknown-linux-musl-0.8.14":
+    "e018287fb321c3c633df2b622c2cf53042caa5c4c43a4ca6431bcb38e0685fa4",
+  "aarch64-apple-darwin-0.8.13":
+    "c3eddc0e314abb8588f1cdf312f0b060d79e1906eff8f43b64a05ff5e2727872",
+  "aarch64-pc-windows-msvc-0.8.13":
+    "5b3a80d385d26fb9f63579a0712d020ec413ada38a6900e88fdfd41b58795b7e",
+  "aarch64-unknown-linux-gnu-0.8.13":
+    "3bb77b764618f65a969da063d1c4a507d8de5360ca2858f771cab109fa879a4d",
+  "aarch64-unknown-linux-musl-0.8.13":
+    "40ba6e62de35820e8460eacee2b5b8f4add70a834d3859f7a60cdfc6b19ab599",
+  "arm-unknown-linux-musleabihf-0.8.13":
+    "f108a49a17b0700d7121b0215575f96c46a203774ed80ef40544005d7af74a67",
+  "armv7-unknown-linux-gnueabihf-0.8.13":
+    "730d8ef57f221ecc572d47b227ecbd8261be08157efb351311f7bc1f6c1c944a",
+  "armv7-unknown-linux-musleabihf-0.8.13":
+    "b78dacab7c2fb352301d8997c0c705c3959a4e44d7b3afe670aee2397a2c9ab3",
+  "i686-pc-windows-msvc-0.8.13":
+    "08482edef8b077e12e73f76e6b4bb0300c054b8009cfac5cc354297f47d24623",
+  "i686-unknown-linux-gnu-0.8.13":
+    "0ce384911d4af9007576ceba2557c5d474a953ced34602ee4e09bd888cee13c0",
+  "i686-unknown-linux-musl-0.8.13":
+    "b6462dc8190c7a1eafa74287d8ff213764baa49e098aeeb522fa479d29e1c0bf",
+  "powerpc64-unknown-linux-gnu-0.8.13":
+    "9a8e8a8927df9fa39af79214ab1acfc227dba9d9e690a424cef1dc17296161a8",
+  "powerpc64le-unknown-linux-gnu-0.8.13":
+    "4880a8e2ba5086e7ed4bd3aecfdae5e353da569ddaac02cd3db598b4c8e77193",
+  "riscv64gc-unknown-linux-gnu-0.8.13":
+    "0cd68055cedbc5b1194e7e7ab2b35ac7aa1d835c586fb3778c7acb0e8a8ac822",
+  "s390x-unknown-linux-gnu-0.8.13":
+    "8cc2e70bee35c9e437c2308f130b79acc0d7c43e710296990ed76e702e220912",
+  "x86_64-apple-darwin-0.8.13":
+    "b799253441726351bc60c2e91254a821001e5e2e22a0e2b077d8983f583e8139",
+  "x86_64-pc-windows-msvc-0.8.13":
+    "60870fa18d438737088e533ed06617549e42531c522cc9a8fe4455d8e745dc29",
+  "x86_64-unknown-linux-gnu-0.8.13":
+    "8ca3db7b2a3199171cfc0870be1f819cb853ddcec29a5fa28dae30278922b7ba",
+  "x86_64-unknown-linux-musl-0.8.13":
+    "38ade73396b48fce89d9d1cb8a7e8f02b6e18a2d87467525ee8fb7e09899f70d",
+  "aarch64-apple-darwin-0.8.12":
+    "a3f78d20465c6d18f7072f118ce1c61b164b98698fdc37357e72958c7d1b68fd",
+  "aarch64-pc-windows-msvc-0.8.12":
+    "eb0c7e47411d11cbc3990eef51a5e10215a1fc9d5f5058fd8e952da94be16512",
+  "aarch64-unknown-linux-gnu-0.8.12":
+    "9a8a53df515bd64d423c85ace7ddca08fb9a91d8a115934c4495b5cf74c60ea6",
+  "aarch64-unknown-linux-musl-0.8.12":
+    "de85bafc3e238a4fce87eb6a4e584c9c04721475abb9e5f6fe186bdce650763f",
+  "arm-unknown-linux-musleabihf-0.8.12":
+    "5fe2f13d8c62d410278fbd69b0c1f03be5bd2c40168a98dc8fc82bca64c2eaad",
+  "armv7-unknown-linux-gnueabihf-0.8.12":
+    "6ddde49d5fcc04a90855f31b5cb500146dac23f31d16f6d7fa7da1ae481eab1e",
+  "armv7-unknown-linux-musleabihf-0.8.12":
+    "39b626f438c22a3122546445d581fe02b6fc449649b4890f44791af4f3d3c18b",
+  "i686-pc-windows-msvc-0.8.12":
+    "97e0e04648e48cccdd25210f5eaf6fb2d46f1a198983b7de10613faf1629663d",
+  "i686-unknown-linux-gnu-0.8.12":
+    "74484899512bb91ed4bd64d117284c20912c39c600cc775d6ef1bf278d6c2a94",
+  "i686-unknown-linux-musl-0.8.12":
+    "b1e303c231068a3a419b12d3ba4dc852931740ab3ad691c7a87309327eac732f",
+  "powerpc64-unknown-linux-gnu-0.8.12":
+    "455bd841952724bff1f45dad91555ce2a33c837cc8d734ca39afaa0ac3c8385d",
+  "powerpc64le-unknown-linux-gnu-0.8.12":
+    "30f1191e997d8d2845b27f57ce30e8d3643994161b7d099caf81fde22d723fa6",
+  "riscv64gc-unknown-linux-gnu-0.8.12":
+    "1e9e7ca966999161ef5174d28a18777d2a143c081a63d455f5b7fd5a1513d2e7",
+  "s390x-unknown-linux-gnu-0.8.12":
+    "55ec25ef06c1e0c095f2baa1a12ce38879db8db99a4b046286a9573dd3c605d5",
+  "x86_64-apple-darwin-0.8.12":
+    "467b462e854bc750fcad8e3ad35e2aca0d301c9287f2365afad8c17b7672b6a8",
+  "x86_64-pc-windows-msvc-0.8.12":
+    "3fb92ce0860db7cb094ddeeb1ac521532fdd3e61d0a130f7bbc6be54caca7c2e",
+  "x86_64-unknown-linux-gnu-0.8.12":
+    "f976ebdc612e71209f46664ab6c0325fa0090059b4474e047edd39eb9395373b",
+  "x86_64-unknown-linux-musl-0.8.12":
+    "fa682c444b8a57a0984129d0989801fb0406f9238a57df76fdde063c6b2339c2",
+  "aarch64-apple-darwin-0.8.11":
+    "c9e74f779a65798057bca2ff328d5c9952f458391e220c3d3216d7a03a338d9f",
+  "aarch64-pc-windows-msvc-0.8.11":
+    "09c6cc8c511d166dc12c9e56ce06c92de928a2e5bad14fc079654901dc8ea114",
+  "aarch64-unknown-linux-gnu-0.8.11":
+    "472dbebd1369049e58d3bbeaae663b212e691676cfd15d799e4faca616d37264",
+  "aarch64-unknown-linux-musl-0.8.11":
+    "1c6045bec4d5ca17777dd271401a0407c5acad79f74fd38f35c31ca64c689808",
+  "arm-unknown-linux-musleabihf-0.8.11":
+    "84da6bfdf9ee693c7278770e1d16d0d5e3ba5ea8f913d7fed13e9854aad95e31",
+  "armv7-unknown-linux-gnueabihf-0.8.11":
+    "a27bb0ae23d0584f1a6a7f851362cb52687bbd22ecce37cc80f3eeca0925dac4",
+  "armv7-unknown-linux-musleabihf-0.8.11":
+    "29605e9724eb7c68bc67892b4d8bcc28d03c1cb1125cb3dd783e81dd61cc15b5",
+  "i686-pc-windows-msvc-0.8.11":
+    "17e45a6afa19443a9749668540a033e9fedd3d6bec1ad8952d10da1f40ed9e92",
+  "i686-unknown-linux-gnu-0.8.11":
+    "85fb818676480ac0cc0f7219e4fd96667d851790c4dd054dc84f304128d88817",
+  "i686-unknown-linux-musl-0.8.11":
+    "194bc103af40c2a15b0a2e86e5eaad53a5219243df8e296d98e9c6269f67e0b3",
+  "powerpc64-unknown-linux-gnu-0.8.11":
+    "fde3e344ee3ef3eabc4803a27a05f06b082819d09153ec126b09f93882e54082",
+  "powerpc64le-unknown-linux-gnu-0.8.11":
+    "a1de2c76674c5566e27f8a5b8868b4f416ec659ad657aa87ccc2d17f9cfeaac5",
+  "riscv64gc-unknown-linux-gnu-0.8.11":
+    "c068fe0b27b7b91d79c3505fcca16ea8dc2df499e6420877bd5cf75b26f5304f",
+  "s390x-unknown-linux-gnu-0.8.11":
+    "e4d8ee92b9e20a7713cf7a9f7d7b288d9d726e7e96d874aaa20e3acc1d408287",
+  "x86_64-apple-darwin-0.8.11":
+    "7ed76b0cc314fa0cb6dd7ae99379efd3cf8fc14d71af8d71b0b5238582c7958d",
+  "x86_64-pc-windows-msvc-0.8.11":
+    "3e802b69307b10f228c8f1d096bd5721ac37a133bf33672f9fcc46a58dd5c920",
+  "x86_64-unknown-linux-gnu-0.8.11":
+    "0c6078318332c100d7d9988ea99144b534e40adef2958aa314a9f7c7b8516ed7",
+  "x86_64-unknown-linux-musl-0.8.11":
+    "0c66f4d06a4f933bddf75d4ad64e0e2d717f015ba1876c51e32ff293c84f57d5",
+  "aarch64-apple-darwin-0.8.10":
+    "5200278ae00b5c0822a7db7a99376b2167e8e9391b29c3de22f9e4fdebc9c0e8",
+  "aarch64-pc-windows-msvc-0.8.10":
+    "c51b02188c312baef71187273afa625576101e5680739eab83b1b09ca5d2f3a8",
+  "aarch64-unknown-linux-gnu-0.8.10":
+    "de60f5e3d69b54e6196fb8937fef4feb15e239f0fd14278e77e44dbb353214ae",
+  "aarch64-unknown-linux-musl-0.8.10":
+    "704f202ca92386eaa095706ec7e26c4f052f7e17721767d4ee18c676565c51b1",
+  "arm-unknown-linux-musleabihf-0.8.10":
+    "51d1244dd7f23d8aa021fa4d2a662a3727b27241e0ceb6f11820cb495611965f",
+  "armv7-unknown-linux-gnueabihf-0.8.10":
+    "ce22ffada0356570f63ad0aae096226f1c45c3d561023b3fb2b1f0936f2b804c",
+  "armv7-unknown-linux-musleabihf-0.8.10":
+    "9ee0a14ec4fa263095bae4da329602f7735d914db4ad59079b47d714bfb95409",
+  "i686-pc-windows-msvc-0.8.10":
+    "e62a2549135b4b9474c18e7bc9f0937837012dd9039f6b4b2c109a1cf99ad925",
+  "i686-unknown-linux-gnu-0.8.10":
+    "cdd36af87ca53ec6b8cc4507e85c9ca54c40fd77613633a1095a1a2f317a0563",
+  "i686-unknown-linux-musl-0.8.10":
+    "658f14b093e3bf4ffcad645fe27d7aa2f8f18a6f625a22a246288c6368a4d88f",
+  "powerpc64-unknown-linux-gnu-0.8.10":
+    "f16d77cfca0dfca2bcef7cc556e0316ba5fdc61b1c3387d60b7c40e12f6617dd",
+  "powerpc64le-unknown-linux-gnu-0.8.10":
+    "00bc1b47078520c588dbd383700d35c786ac2fa3e53c9fca51c5410581f8c87e",
+  "riscv64gc-unknown-linux-gnu-0.8.10":
+    "db605bb442563f0494c174be639b9d80fcc4e27e360a31ad2675005ea1a1e3ab",
+  "s390x-unknown-linux-gnu-0.8.10":
+    "83ca774828d652ce9dd1d6e2619e66c471e2cb236754783019b9ae0f4da72718",
+  "x86_64-apple-darwin-0.8.10":
+    "3b935381af9124a5d5da48235e149f5f0662f2717e75782d1b843d39d9265d6d",
+  "x86_64-pc-windows-msvc-0.8.10":
+    "37fcd011fd22b2a569f7e583a924af2d624d99445f669752923a2fd3841f8e3d",
+  "x86_64-unknown-linux-gnu-0.8.10":
+    "2c4392591fe9469d006452ef22f32712f35087d87fb1764ec03e23544eb8770d",
+  "x86_64-unknown-linux-musl-0.8.10":
+    "4031c6f7ac3890f29c72e0ea655add58b8fa1c678d20afcf57efa51e57751732",
  "aarch64-apple-darwin-0.8.9":
    "c233bee389c15fdef09a6028db61cc54a12e6171f27d6d9c018eedca5bbbd011",
  "aarch64-pc-windows-msvc-0.8.9":
--- a/src/download/download-version.ts
+++ b/src/download/download-version.ts
@@ -160,6 +160,7 @@ export async function resolveVersion(
 }

 async function getAvailableVersions(githubToken: string): Promise<string[]> {
+  core.info("Getting available versions from GitHub API...");
  try {
    const octokit = new Octokit({
      auth: githubToken,
@@ -194,7 +195,7 @@ async function getReleaseTagNames(
 }

 async function getLatestVersion(githubToken: string) {
-  core.debug("Getting latest version...");
+  core.info("Getting latest version from GitHub API...");
  const octokit = new Octokit({
    auth: githubToken,
  });
--- a/src/save-cache.ts
+++ b/src/save-cache.ts
@@ -11,12 +11,17 @@ import {
  enableCache,
  ignoreNothingToCache,
  pruneCache as shouldPruneCache,
+  saveCache as shouldSaveCache,
 } from "./utils/inputs";

 export async function run(): Promise<void> {
  try {
    if (enableCache) {
-      await saveCache();
+      if (shouldSaveCache) {
+        await saveCache();
+      } else {
+        core.info("save-cache is false. Skipping save cache step.");
+      }
      // node will stay alive if any promises are not resolved,
      // which is a possibility if HTTP requests are dangling
      // due to retries or timeouts. We know that if we got here
--- a/src/utils/inputs.ts
+++ b/src/utils/inputs.ts
@@ -8,6 +8,8 @@ export const pythonVersion = core.getInput("python-version");
 export const activateEnvironment = core.getBooleanInput("activate-environment");
 export const checkSum = core.getInput("checksum");
 export const enableCache = getEnableCache();
+export const restoreCache = core.getInput("restore-cache") === "true";
+export const saveCache = core.getInput("save-cache") === "true";
 export const cacheSuffix = core.getInput("cache-suffix") || "";
 export const cacheLocalPath = getCacheLocalPath();
 export const cacheDependencyGlob = getCacheDependencyGlob();
@@ -116,16 +118,15 @@ function expandTilde(input: string): string {
 }

 function resolveRelativePath(inputPath: string): string {
-  if (path.isAbsolute(inputPath)) {
-    return inputPath;
-  }
-  let absolutePath = inputPath;
-  if (absolutePath.startsWith("./")) {
-    absolutePath = absolutePath.substring(2);
-  }
-  absolutePath = `${workingDirectory}${path.sep}${absolutePath}`;
-  core.debug(`Resolving relative path ${inputPath} to ${absolutePath}`);
-  return absolutePath;
+  const hasNegation = inputPath.startsWith("!");
+  const pathWithoutNegation = hasNegation ? inputPath.substring(1) : inputPath;
+
+  const resolvedPath = path.resolve(workingDirectory, pathWithoutNegation);
+
+  core.debug(
+    `Resolving relative path ${inputPath} to ${hasNegation ? "!" : ""}${resolvedPath}`,
+  );
+  return hasNegation ? `!${resolvedPath}` : resolvedPath;
 }

 function getManifestFile(): string | undefined {
--- a/src/version/resolve.ts
+++ b/src/version/resolve.ts
@@ -2,6 +2,7 @@ import fs from "node:fs";
 import * as core from "@actions/core";
 import { getRequiredVersionFromConfigFile } from "./config-file";
 import { getUvVersionFromRequirementsFile } from "./requirements-file";
+import { getUvVersionFromToolVersions } from "./tool-versions-file";

 export function getUvVersionFromFile(filePath: string): string | undefined {
  core.info(`Trying to find version for uv in: ${filePath}`);
@@ -11,7 +12,10 @@ export function getUvVersionFromFile(filePath: string): string | undefined {
  }
  let uvVersion: string | undefined;
  try {
-    uvVersion = getRequiredVersionFromConfigFile(filePath);
+    uvVersion = getUvVersionFromToolVersions(filePath);
+    if (uvVersion === undefined) {
+      uvVersion = getRequiredVersionFromConfigFile(filePath);
+    }
    if (uvVersion === undefined) {
      uvVersion = getUvVersionFromRequirementsFile(filePath);
    }
--- a/src/version/tool-versions-file.ts
+++ b/src/version/tool-versions-file.ts
@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import * as core from "@actions/core";
+
+export function getUvVersionFromToolVersions(
+  filePath: string,
+): string | undefined {
+  if (!filePath.endsWith(".tool-versions")) {
+    return undefined;
+  }
+  const fileContents = fs.readFileSync(filePath, "utf8");
+  const lines = fileContents.split("\n");
+
+  for (const line of lines) {
+    // Skip commented lines
+    if (line.trim().startsWith("#")) {
+      continue;
+    }
+    const match = line.match(/^\s*uv\s*v?\s*(?<version>[^\s]+)\s*$/);
+    if (match) {
+      const matchedVersion = match.groups?.version.trim();
+      if (matchedVersion?.startsWith("ref")) {
+        core.warning(
+          "The ref syntax of .tool-versions is not supported. Please use a released version instead.",
+        );
+        return undefined;
+      }
+      return matchedVersion;
+    }
+  }
+  return undefined;
+}
--- a/version-manifest.json
+++ b/version-manifest.json
Author	SHA1	Message	Date
Kevin Stillhammer	b75a909f75	bump deps (#569 )	2025-09-14 13:04:41 +00:00
dependabot[bot]	ffff8aa2b5	Bump github/codeql-action from 3.29.11 to 3.30.3 (#566 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.11 to 3.30.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v3.30.3</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.3 - 10 Sep 2025</h2> <p>No user facing changes.</p> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.3/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v3.30.2</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.2 - 09 Sep 2025</h2> <ul> <li>Fixed a bug which could cause language autodetection to fail. <a href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li> <li>Experimental: The <code>quality-queries</code> input that was added in <code>3.29.2</code> as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new <code>analysis-kinds</code> input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.2/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v3.30.1</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.1 - 05 Sep 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.0. <a href="https://redirect.github.com/github/codeql-action/pull/3077">#3077</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.1/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v3.30.0</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>3.30.0 - 01 Sep 2025</h2> <ul> <li>Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. <a href="https://redirect.github.com/github/codeql-action/pull/3054">#3054</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v3.30.0/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>3.30.3 - 10 Sep 2025</h2> <p>No user facing changes.</p> <h2>3.30.2 - 09 Sep 2025</h2> <ul> <li>Fixed a bug which could cause language autodetection to fail. <a href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li> <li>Experimental: The <code>quality-queries</code> input that was added in <code>3.29.2</code> as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new <code>analysis-kinds</code> input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li> </ul> <h2>3.30.1 - 05 Sep 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.0. <a href="https://redirect.github.com/github/codeql-action/pull/3077">#3077</a></li> </ul> <h2>3.30.0 - 01 Sep 2025</h2> <ul> <li>Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. <a href="https://redirect.github.com/github/codeql-action/pull/3054">#3054</a></li> </ul> <h2>3.29.11 - 21 Aug 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.22.4. <a href="https://redirect.github.com/github/codeql-action/pull/3044">#3044</a></li> </ul> <h2>3.29.10 - 18 Aug 2025</h2> <p>No user facing changes.</p> <h2>3.29.9 - 12 Aug 2025</h2> <p>No user facing changes.</p> <h2>3.29.8 - 08 Aug 2025</h2> <ul> <li>Fix an issue where the Action would autodetect unsupported languages such as HTML. <a href="https://redirect.github.com/github/codeql-action/pull/3015">#3015</a></li> </ul> <h2>3.29.7 - 07 Aug 2025</h2> <p>This release rolls back 3.29.6 to address issues with language autodetection. It is identical to 3.29.5.</p> <h2>3.29.6 - 07 Aug 2025</h2> <ul> <li>The <code>cleanup-level</code> input to the <code>analyze</code> Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup. <a href="https://redirect.github.com/github/codeql-action/pull/2999">#2999</a></li> <li>Update default CodeQL bundle version to 2.22.3. <a href="https://redirect.github.com/github/codeql-action/pull/3000">#3000</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="`192325c861`"><code>192325c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3104">#3104</a> from github/update-v3.30.3-b660efdcf</li> <li><a href="`e68956d90b`"><code>e68956d</code></a> Update changelog for v3.30.3</li> <li><a href="`b660efdcfd`"><code>b660efd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3103">#3103</a> from github/mbg/fix/category-check</li> <li><a href="`e49458befe`"><code>e49458b</code></a> Fix <code>runInterpretResultsFor</code> using the wrong <code>AnalysisConfig</code> for <code>category</code> fix</li> <li><a href="`f374a62c8b`"><code>f374a62</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3098">#3098</a> from github/kaspersv/increase-overlay-base-size-limit</li> <li><a href="`5efa438e92`"><code>5efa438</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3101">#3101</a> from github/mbg/public-repo-notice-in-pr-template</li> <li><a href="`8a84a62542`"><code>8a84a62</code></a> Overlay: Increase size limit for cached overlay base database</li> <li><a href="`eb50a881d8`"><code>eb50a88</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3097">#3097</a> from github/redsun82/only-dump-sarif</li> <li><a href="`4c534612bf`"><code>4c53461</code></a> Tweak sarif dump log</li> <li><a href="`dae3742b0a`"><code>dae3742</code></a> Dump soon to be uploaded SARIF on request</li> <li>Additional commits viewable in <a href="`3c3833e0f8...192325c861`">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.29.11&new-version=3.30.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-09-14 14:58:58 +02:00
dependabot[bot]	95d0e233fa	Bump actions/setup-node from 4.4.0 to 5.0.0 (#551 ) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 5.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <h2>What's Changed</h2> <h3>Breaking Changes</h3> <ul> <li>Upgrade action to use node24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1325">actions/setup-node#1325</a></li> </ul> <p>Make sure your runner is updated to this version or newer to use this release. v2.327.1 <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Release Notes</a></p> <h3>Dependency Upgrades</h3> <ul> <li>Upgrade <code>@octokit/request-error</code> and <code>@actions/github</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-node/pull/1227">actions/setup-node#1227</a></li> <li>Upgrade uuid from 9.0.1 to 11.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-node/pull/1273">actions/setup-node#1273</a></li> <li>Upgrade undici from 5.28.5 to 5.29.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-node/pull/1295">actions/setup-node#1295</a></li> <li>Upgrade form-data to bring in fix for critical vulnerability by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1332">actions/setup-node#1332</a></li> <li>Upgrade actions/checkout from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-node/pull/1345">actions/setup-node#1345</a></li> </ul> <h3>Enhancement:</h3> <ul> <li>Enhance caching in setup-node with automatic package manager detection by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1348">actions/setup-node#1348</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1348">actions/setup-node#1348</a></li> <li><a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1325">actions/setup-node#1325</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v4...v5.0.0">https://github.com/actions/setup-node/compare/v4...v5.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="`a0853c2454`"><code>a0853c2</code></a> Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/actions/setup-node/issues/1345">#1345</a>)</li> <li><a href="`b7234cc9fe`"><code>b7234cc</code></a> Upgrade action to use node24 (<a href="https://redirect.github.com/actions/setup-node/issues/1325">#1325</a>)</li> <li><a href="`d7a11313b5`"><code>d7a1131</code></a> Enhance caching in setup-node with automatic package manager detection (<a href="https://redirect.github.com/actions/setup-node/issues/1348">#1348</a>)</li> <li><a href="`5e2628c959`"><code>5e2628c</code></a> Bumps form-data (<a href="https://redirect.github.com/actions/setup-node/issues/1332">#1332</a>)</li> <li><a href="`65beceff8e`"><code>65becef</code></a> Bump undici from 5.28.5 to 5.29.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1295">#1295</a>)</li> <li><a href="`7e24a656e1`"><code>7e24a65</code></a> Bump uuid from 9.0.1 to 11.1.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1273">#1273</a>)</li> <li><a href="`08f58d1471`"><code>08f58d1</code></a> Bump <code>@octokit/request-error</code> and <code>@actions/github</code> (<a href="https://redirect.github.com/actions/setup-node/issues/1227">#1227</a>)</li> <li>See full diff in <a href="`49933ea528...a0853c2454`">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-node&package-manager=github_actions&previous-version=4.4.0&new-version=5.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-09-14 14:57:21 +02:00
Kevin Stillhammer	dc724a12b6	Add inputs restore-cache and save-cache (#568 ) Closes: #555	2025-09-14 14:55:08 +02:00
Kevin Stillhammer	f67343ac2e	Automatically push updated known versions (#565 )	2025-09-11 09:12:35 +00:00
github-actions[bot]	4dd9f52a47	chore: update known versions for 0.8.16/0.8.17 (#562 ) chore: update known versions for 0.8.17 Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com>	2025-09-11 05:31:10 +00:00
github-actions[bot]	e1e6fe7910	chore: update known versions for 0.8.15 (#550 ) chore: update known versions for 0.8.15 Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com>	2025-09-04 05:53:47 +00:00
William Woodruff	b1836110f7	chore(ci): address CI lint findings (#545 ) This addresses all of zizmor's non-pedantic findings, and adds a workflow to proactively flag any more that come in. Key changes: * I've hash-pinned all actions references. Dependabot will continue to keep these updated and will update the hash comments as well. * I've marked every `actions/checkout` with `persist-credentials: false` except for one that actually needs persisted credentials (which I've explicitly enabled with an explanatory comment) * I've dropped some workflow-level permissions in favor of job-level permissions that were already provisioned. * I fixed two small template injections caused by expanding output contexts. I think these were not exploitable in practice, but fixing them is good for defense in depth (and makes spellcheck work nicely on these steps). --------- Signed-off-by: William Woodruff <william@astral.sh>	2025-09-02 13:29:06 +00:00
Kevin Stillhammer	557e51de59	Bump dependencies (#547 )	2025-09-01 14:18:46 +00:00
Kevin Stillhammer	1b46e13ec8	Fix exclusions in cache-dependency-glob (#546 ) Fixes: #537	2025-09-01 16:12:49 +02:00
github-actions[bot]	26cf676705	chore: update known versions for 0.8.14 (#543 ) chore: update known versions for 0.8.14 Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com>	2025-08-29 06:12:40 +00:00
github-actions[bot]	4e1e303f7d	chore: update known versions for 0.8.13 (#536 ) chore: update known versions for 0.8.13 Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com>	2025-08-22 06:43:16 +00:00
Kevin Stillhammer	4959332f0f	Bump dependencies (#532 )	2025-08-21 09:22:03 +00:00
Kevin Stillhammer	adeb28643f	Add support for .tools-versions (#531 ) Closes: #504	2025-08-21 11:15:28 +02:00
Kevin Stillhammer	fce199e243	Add log message before long API calls to GitHub (#530 ) Fixes: #457	2025-08-21 08:06:33 +00:00
github-actions[bot]	f758a4a1eb	chore: update known versions for 0.8.12 (#529 ) chore: update known versions for 0.8.12 Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com>	2025-08-19 22:07:30 +00:00
github-actions[bot]	c0e7e93474	chore: update known versions for 0.8.11 (#526 ) chore: update known versions for 0.8.11 Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com>	2025-08-14 20:07:29 +00:00
github-actions[bot]	fda2399cb3	chore: update known versions for 0.8.10 (#525 ) chore: update known versions for 0.8.10 Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com>	2025-08-14 07:07:10 +00:00