Bump the actions-version group with 4 updates

[dependabot]

Bumps the actions-version group with 4 updates: glotzerlab/workflows, actions/upload-artifact, pypa/gh-action-pypi-publish and peter-evans/create-pull-request.

Updates glotzerlab/workflows from 7737fdd1befca3bcfa2bb17160cece5b13276d5f to 0e6e5b8b8e1bdb40740c8aa69d528add26417ecc

Commits

• 0e6e5b8 Merge pull request #23 from glotzerlab/refactor-setup-uv
• 591ec55 Use newer uv version in test.
• 3902368 Switch from curl to the official astral setup-uv.
• 945182d Bump copyright year.
• ad597de Merge pull request #22 from glotzerlab/dependabot-github_actions-trunk-action...
• 0c63e95 Bump the actions-version group with 3 updates
• a36a971 Use mdbook 0.4.43
• cd6c090 Merge pull request #21 from glotzerlab/dependabot-github_actions-trunk-action...
• fd1bc8c Bump mamba-org/setup-micromamba in the actions-version group
• See full diff in compare view

Updates actions/upload-artifact from 4.4.3 to 4.6.0

Release notes

Sourced from actions/upload-artifact's releases.

v4.6.0

What's Changed

• Expose env vars to control concurrency and timeout by @​yacaovsnc in actions/upload-artifact#662

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

What's Changed

• fix: deprecated Node.js version in action by @​hamirmahal in actions/upload-artifact#578
• Add new artifact-digest output by @​bdehamer in actions/upload-artifact#656

New Contributors

• @​hamirmahal made their first contribution in actions/upload-artifact#578
• @​bdehamer made their first contribution in actions/upload-artifact#656

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

Commits

• 65c4c4a Merge pull request #662 from actions/yacaovsnc/add_variable_for_concurrency_a...
• 0207619 move files back to satisfy licensed ci
• 1ecca81 licensed cache updates
• 9742269 Expose env vars to controll concurrency and timeout
• 6f51ac0 Merge pull request #656 from bdehamer/bdehamer/artifact-digest
• c40c16d add new artifact-digest output
• 735efb4 bump @​actions/artifact from 2.1.11 to 2.2.0
• 184d73b Merge pull request #578 from hamirmahal/fix/deprecated-nodejs-usage-in-action
• b4a0a98 Merge branch 'main' into fix/deprecated-nodejs-usage-in-action
• See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.12.2 to 1.12.4

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.12.4

✨ What's Changed

The main theme of this patch release that the support for uploading PEP 639 licensing metadata to PyPI has been fixed in #327.

🛠️ Internal Updates

A few smaller updates include the attestation existence being checked earlier in the process now, listing all the violating files together, not just one (PR #315). And the lock file with the software available in runtime has been re-pinned in #329. Additionally, the CI now runs the smoke-tests against both Ubuntu 22.04 and 24.04 explicitly via da900af96347cc027433720ad4f122117645459d.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.12.3...v1.12.4

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​dnicolodi💰 and @​woodruffw💰 for releasing the license metadata support fix in Twine!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

v1.12.3

✨ What's Improved

With the updates by @​woodruffw💰 and @​webknjaz💰 via #309 and #313, it is now possible to publish [distribution packages] that include [core metadata v2.4], like those built using [maturin]. This is done by bumping Twine to v6.0.1 and pkginfo to v1.12.0.

📝 Docs

We've made an attempt to clarify the runtime and workflow shape that are expected to be supported for calling this action in: https://github.com/marketplace/actions/pypi-publish#Non-goals.

[!TIP] Please, let us know in the release discussion if anything still remains unclear. TL;DR always call [pypi-publish] once per job; don't invoke it in reusable workflows; physically move building the dists into separate jobs having restricted permissions and storing the dists as GitHub Actions artifacts; when using self-hosted runners, make sure to still use [pypi-publish] on a GitHub-provided infra with runs-on: ubuntu-latest, while building and testing may remain self-hosted; don't perform any other actions in the publishing job; don't call [pypi-publish] from composite actions.

🛠️ Internal Updates

@​br3ndonland💰 improved the container image generation automation to include Git SHA in #301. And @​woodruffw💰 added the workflow_ref context to Trusted Publishing debug logging in #305, helping us diagnose misconfigurations faster. #313 also extends the smoke test in the CI to check against the [maturin]-made dists. Additionally, jeepney and secretstorage transitive deps have been added to the pip constraint-based lock file, as Dependabot seems to have missed those earlier.

... (truncated)

Commits

• 76f52bc Merge pull request #329 from webknjaz/maintenance/runtime-lockfile-24-02-2025
• 72de13b 📌 Mass-upgrade transitive dependency pins
• 1995f2e Merge pull request #327 from webknjaz/maintenance/twine-6.1-pep639
• 29f40bd 📦 Enable metadata 2.4 support in Twine
• 10df67d 📦 Enable support for PEP 639 metadata
• e0449d2 🧪 Integrate a unified alls-green GHA status
• cebc64f 🧪 Bump setuptools in smoke test to v75.8.0
• da900af 🧪 Run smoke tests against Ubuntu 24 and 22
• 8cafb5c 💰 Sync the funding config
• 916e576 Merge pull request #315 from webknjaz/refactoring/attestations-exist-bundle
• Additional commits viewable in compare view

Updates peter-evans/create-pull-request from 7.0.5 to 7.0.6

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v7.0.6

⚙️ Fixes an issue with commit signing where unicode characters in file paths were not preserved.

What's Changed

• build(deps-dev): bump @​vercel/ncc from 0.38.1 to 0.38.2 by @​dependabot in peter-evans/create-pull-request#3365
• Update distribution by @​actions-bot in peter-evans/create-pull-request#3370
• build(deps): bump @​octokit/plugin-rest-endpoint-methods from 13.2.4 to 13.2.5 by @​dependabot in peter-evans/create-pull-request#3375
• build(deps-dev): bump @​types/node from 18.19.50 to 18.19.54 by @​dependabot in peter-evans/create-pull-request#3376
• build(deps): bump @​octokit/plugin-paginate-rest from 11.3.3 to 11.3.5 by @​dependabot in peter-evans/create-pull-request#3377
• Update distribution by @​actions-bot in peter-evans/create-pull-request#3388
• build(deps-dev): bump @​types/node from 18.19.54 to 18.19.55 by @​dependabot in peter-evans/create-pull-request#3400
• build(deps): bump @​actions/core from 1.10.1 to 1.11.1 by @​dependabot in peter-evans/create-pull-request#3401
• build(deps): bump @​octokit/plugin-rest-endpoint-methods from 13.2.5 to 13.2.6 by @​dependabot in peter-evans/create-pull-request#3403
• build(deps-dev): bump eslint-plugin-import from 2.30.0 to 2.31.0 by @​dependabot in peter-evans/create-pull-request#3402
• build(deps): bump @​octokit/plugin-throttling from 9.3.1 to 9.3.2 by @​dependabot in peter-evans/create-pull-request#3404
• Update distribution by @​actions-bot in peter-evans/create-pull-request#3423
• build(deps-dev): bump typescript from 5.6.2 to 5.6.3 by @​dependabot in peter-evans/create-pull-request#3441
• build(deps): bump undici from 6.19.8 to 6.20.1 by @​dependabot in peter-evans/create-pull-request#3442
• Update distribution by @​actions-bot in peter-evans/create-pull-request#3451
• build(deps-dev): bump @​types/node from 18.19.55 to 18.19.58 by @​dependabot in peter-evans/create-pull-request#3457
• build(deps-dev): bump @​types/jest from 29.5.13 to 29.5.14 by @​dependabot in peter-evans/create-pull-request#3462
• build(deps-dev): bump @​types/node from 18.19.58 to 18.19.60 by @​dependabot in peter-evans/create-pull-request#3463
• chore: don't bundle undici by @​benmccann in peter-evans/create-pull-request#3475
• Update distribution by @​actions-bot in peter-evans/create-pull-request#3478
• chore: use node-fetch-native support for proxy env vars by @​peter-evans in peter-evans/create-pull-request#3483
• build(deps-dev): bump @​types/node from 18.19.60 to 18.19.64 by @​dependabot in peter-evans/create-pull-request#3488
• build(deps-dev): bump undici from 6.20.1 to 6.21.0 by @​dependabot in peter-evans/create-pull-request#3499
• build(deps-dev): bump @​vercel/ncc from 0.38.2 to 0.38.3 by @​dependabot in peter-evans/create-pull-request#3500
• docs: note push-to-repo classic PAT workflow scope requirement by @​scop in peter-evans/create-pull-request#3511
• docs: spelling fixes by @​scop in peter-evans/create-pull-request#3512
• build(deps-dev): bump typescript from 5.6.3 to 5.7.2 by @​dependabot in peter-evans/create-pull-request#3516
• build(deps-dev): bump prettier from 3.3.3 to 3.4.0 by @​dependabot in peter-evans/create-pull-request#3517
• build(deps-dev): bump @​types/node from 18.19.64 to 18.19.66 by @​dependabot in peter-evans/create-pull-request#3518
• docs(README): clarify that an existing open PR is managed by @​caugner in peter-evans/create-pull-request#3498
• Update distribution by @​actions-bot in peter-evans/create-pull-request#3529
• build(deps): bump @​octokit/plugin-paginate-rest from 11.3.5 to 11.3.6 by @​dependabot in peter-evans/create-pull-request#3542
• build(deps-dev): bump @​types/node from 18.19.66 to 18.19.67 by @​dependabot in peter-evans/create-pull-request#3543
• build(deps-dev): bump prettier from 3.4.0 to 3.4.1 by @​dependabot in peter-evans/create-pull-request#3544
• build(deps-dev): bump eslint-import-resolver-typescript from 3.6.3 to 3.7.0 by @​dependabot in peter-evans/create-pull-request#3559
• build(deps-dev): bump prettier from 3.4.1 to 3.4.2 by @​dependabot in peter-evans/create-pull-request#3560
• build(deps-dev): bump @​types/node from 18.19.67 to 18.19.68 by @​dependabot in peter-evans/create-pull-request#3570
• build(deps): bump p-limit from 6.1.0 to 6.2.0 by @​dependabot in peter-evans/create-pull-request#3578
• Update distribution by @​actions-bot in peter-evans/create-pull-request#3583
• fix: preserve unicode in filepaths when commit signing by @​peter-evans in peter-evans/create-pull-request#3588

New Contributors

• @​benmccann made their first contribution in peter-evans/create-pull-request#3475
• @​scop made their first contribution in peter-evans/create-pull-request#3511
• @​caugner made their first contribution in peter-evans/create-pull-request#3498

... (truncated)

Commits

• 67ccf78 fix: preserve unicode in filepaths when commit signing (#3588)
• bb88e27 build: update distribution (#3583)
• b378ed5 build(deps): bump p-limit from 6.1.0 to 6.2.0 (#3578)
• fa9200e build(deps-dev): bump @​types/node from 18.19.67 to 18.19.68 (#3570)
• 16e0059 build(deps-dev): bump prettier from 3.4.1 to 3.4.2 (#3560)
• 5bffd5a build(deps-dev): bump eslint-import-resolver-typescript (#3559)
• a22a0dd build(deps-dev): bump prettier from 3.4.0 to 3.4.1 (#3544)
• b27ce37 build(deps-dev): bump @​types/node from 18.19.66 to 18.19.67 (#3543)
• 4e0cc19 build(deps): bump @​octokit/plugin-paginate-rest from 11.3.5 to 11.3.6 (#3542)
• 25b6871 docs: update scopes for push-to-fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions