Repository navigation
chore: sync with upstream v10.3.0 - #157
Merged
Merged
Conversation
Collaborator
Author
|
📦 Target Release Version: |
Contributor
🔍 Cherry-Pick Verification Report📦 Upstream Changes: 📋 File-by-File Analysis:
|
Contributor
PR ReviewAction TypeNode-based action ( ✅ Passed Checks
❌ Failed ChecksNone.
|
Contributor
🔍 Cherry-Pick Verification Report📦 Upstream Changes: 📋 File-by-File Analysis:
|
Contributor
PR ReviewAction TypeNode-based — runs on ✅ Passed Checks
❌ Failed ChecksNone.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| const selected = await queryPythonArch(uvPath, pythonArch); | ||
| if (selected.exitCode !== 0) { | ||
| throw new Error( |
Contributor
There was a problem hiding this comment.
The probe-based approach is clever — using an intentionally invalid arch value to confirm that UV_PYTHON_ARCH is recognised by this version of uv before committing to a real value. However, the probe string "setup-uv-probe" is checked by string-matching against stderr, which makes this fragile if uv ever changes its error message format. Consider adding a comment explaining the detection strategy so future maintainers understand why this specific string is used.
| ["--no-config", "cache", "dir"], | ||
| { | ||
| encoding: "utf8", | ||
| env: { ...process.env, NO_COLOR: "1", UV_PYTHON_ARCH: pythonArch }, |
Contributor
There was a problem hiding this comment.
Spreading the full process.env into the subprocess env is correct here (the uv binary needs PATH etc.), but note this also propagates any sensitive runner env vars (tokens, secrets). This is consistent with the rest of the action's subprocess calls, so it is acceptable — worth flagging for awareness in any future security audit.
Collaborator
Author
Sync verificationWarning 1 item needs review: 1 file to check.
Review these
✅ 9 files: exactly upstream's version✅ 4 files: upstream's changes alongside StepSecurity's✅ 2 files: StepSecurity-specific changes only👀 1 file: upstream and StepSecurity changed the same lines✅ 3 files: build output or lockfiles, rebuilt from source✅ 1 file: checked field by field✅ config.json checks
✅ Build checks
✅ Integrity checks
|
Contributor
🔍 Cherry-Pick Verification Report📦 Upstream Changes: 📋 File-by-File Analysis:
|
Contributor
PR ReviewAction TypeNode-based action (TypeScript compiled to CommonJS, distributed via ✅ Passed Checks
❌ Failed ChecksNo failed checks.
|
| !probe.stderr.includes( | ||
| `environment variable \`UV_PYTHON_ARCH\` with invalid value \`${PROBE_ARCH}\``, | ||
| ) | ||
| ) { |
Contributor
There was a problem hiding this comment.
Consider also matching on a broader pattern (e.g. checking exitCode === 2 AND stderr mentions UV_PYTHON_ARCH) so a minor rephrasing doesn't obscure the root cause.
| { | ||
| "name": "setup-uv", | ||
| "name": "@step-security/setup-uv", | ||
| "version": "1.0.0", |
Contributor
There was a problem hiding this comment.
build script only type-checks: "build": "tsc --noEmit" runs the TypeScript compiler in check-only mode — it produces no output files. The actual bundling is done by "package": "node scripts/build-dist.mjs". A developer running npm run build expecting to regenerate dist/ will get no output and no error, which is surprising. Consider renaming this to "typecheck" or "lint:types" and pointing "build" at the real packaging step.
anurag-stepsecurity
approved these changes
Oct 19, 2026
Raj-StepSecurity
enabled auto-merge
October 21, 2026 06:01
Contributor
🔍 Cherry-Pick Verification Report📦 Upstream Changes: 📋 File-by-File Analysis:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
astral-sh/setup-uv@v10.2.0...v10.3.0