chore(deps): bump actions/setup-python from 6 to 7#995
Conversation
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
github_actions
burtenshaw
added
enhancement
Cursor
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Scope: dependabot bump of actions/setup-python v6 -> v7 across 6 workflow files (deploy-hf-env.yml, manage-hf-collection.yml, package-ci.yml, publish-pypi.yml, publish-testpypi.yml, test.yml). No Python, library, or lockfile code is touched.
Automated Checks
- Lint: PASS (not applicable to this PR's scope — 0
.pyfiles changed).ruff check src/ tests/passes cleanly;ruff format --checkonly flags ~20 long-standingenvs/files (jupyter_env, opencode_env, repl_env, terminus_env, textarena_env) — pre-existing drift, none in this diff. - Debug code: CLEAN (not applicable to this PR's scope).
check-debug.shscanssrc/only; its hits (console.printCLI output + oldcli/TODOs) are pre-existing and unrelated — this PR changes no Python.
Open RFCs Context
rfcs/: 000-005 In Review, 010 Draft. None cover CI, GitHub Actions, or the Python toolchain, so no RFC surface is touched by a CI runner action version bump.
Tier 1: Fixes Required
None. Verification performed:
v7is real & current —actions/setup-python@v7resolves to commit5fda3b9;v7.0.0was published 2026-07-20 and is the latest release.- No breaking changes — v7 is an internal ESM migration with no changes to inputs/outputs/behavior (release notes). The only removed input,
pip-install, is not used by any of these workflows (each passes onlypython-version, pinned to 3.11/3.12). - No new runner requirement — the node24 / runner
v2.327.1+requirement landed in v6 (already in use here), not v7; GitHub-hosted runners are unaffected. - Uniform bump — all 6
setup-pythoncall sites moved to@v7; no@v6stragglers remain. - Clean merge —
git merge-tree origin/main <head>reports no conflict (clean 1-commit fast-forward overmain@20f8b8bb).
Tier 2: Alignment Discussion
Principle Conflicts
None identified. A CI runner Python-setup version bump doesn't touch any runtime boundary (Gym/MCP APIs, rewards-in-environment, client-server separation, container/credential isolation, Pydantic wire types).
RFC Conflicts
None identified.
Non-blocking note (FYI @burtenshaw, github-actions dependabot updater owner): first-party actions here are pinned by floating major tag (@v7), unlike the SHA-pinned huggingface/doc-builder reusable workflows. That is the existing repo convention (maintained by dependabot) and is not changed by this PR — noting the supply-chain trade-off vs. full-SHA pinning only for awareness, not as a blocker.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts
Clean, low-risk first-party CI action bump.
Sent by Cursor Automation: Pre-review
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
There was a problem hiding this comment.
Clean bump: this job pins python-version: "3.12" and passes no other inputs, so v7's removal of the pip-install input doesn't apply. v7 is an internal ESM migration (no input/output/behavior change vs v6).
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
There was a problem hiding this comment.
Same clean bump; pins python-version: '3.12' (single-quoted here vs double-quoted elsewhere — cosmetic, valid YAML, pre-existing). No removed inputs used.
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
There was a problem hiding this comment.
Clean bump; pins python-version: "3.11". Runs after a checkout with persist-credentials: false; v7 changes nothing here.
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
There was a problem hiding this comment.
Clean bump; pins python-version: "3.11" for the PyPI publish job. No removed inputs used; the node24 runner requirement predates v7 (introduced in v6).
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
There was a problem hiding this comment.
Clean bump; pins python-version: "3.11". Same shape as the pypi publish workflow — behavior-compatible with v6.
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
There was a problem hiding this comment.
Clean bump; pins python-version: "3.11". This is the main CI/lint/test job; setup-python v7 is behavior-compatible with v6.
1 participant
Bumps actions/setup-python from 6 to 7.
Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Routine Dependabot action bump with no application or secrets logic changes; only the Python setup action version changes.
Overview
Bumps
actions/setup-pythonfrom v6 to v7 on the “Set up Python” step in six GitHub Actions workflows: Hugging Face deploy/collection sync, package CI, PyPI and TestPyPI publish, and thecheck-env-docsjob in the test workflow.Python versions and install steps are unchanged (still 3.11/3.12 as before); workflows continue to install dependencies with explicit
pip/python -m pipcommands rather than the removedpip-installaction input.Reviewed by Cursor Bugbot for commit 34b133c. Bugbot is set up for automated code reviews on this repo. Configure here.