Fix CI caching; bump checkout/setup-python off Node.js 20

[ChristianGeng]

Summary

Two related CI bugs, both caused by stale GitHub Action version pins:

1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob
   keys on uv.lock / requirements*.txt, neither of which exists in this
   repo (no committed lockfile, by design — it tests against latest
   resolvable deps). Caching has therefore silently never worked.

   This repo's setup-uv pin was a SHA (3259c6206f993105e3a61b142c2d97bf4b9ef83d),
   which resolves to tag v7.1.0 — already past the fix that matters here
   (v6.0.0 added pyproject.toml to the default glob, which is committed
   and changes exactly when a dependency does) and past the Node 20 → Node 24
   runtime bump (v7.0.0). So neither bug technically applied to this pin.
   Bumping to v9.0.0 anyway, for consistency with the sibling fixes below
   (matching what was done for audformat's setup-uv pin, which was in the
   same situation).

2. Node.js 20 deprecation: actions/checkout@v4 and
   actions/setup-python@v5 still target the deprecated Node 20 runtime.
   Bumped both to v7. codecov/codecov-action@v4 also bumped to v7;
   its v5 rewrite dropped the singular file: input in favor of files:
   (plural) — renamed accordingly in test.yml so the coverage upload
   doesn't silently no-op. No actions/cache usage exists in this repo's
   workflows.

prune-cache left at its new default (off): audbackend's dependency tree
(audeer, minio, audformat, sphinx, pytest, stream-unzip) has no large
pre-built binary wheels like torch, so pruning would save ~0 disk space
while costing avoidable re-downloads.

Test plan

• All four changed workflow YAML files validated with
  python3 -c "import yaml; yaml.safe_load(open('FILE'))"
• CI passes on this PR (checkout/setup-python/setup-uv/codecov-action
  bumps exercised across the full test matrix)

Part of the same CI cleanup as audeering/audeer#206,
audeering/opensmile-python#132, audeering/audb#591, and
audeering/audformat#539.

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates all CI workflows to use Node 24-compatible GitHub Actions and fixes ineffective uv caching and Codecov configuration.

Flow diagram for updated CI workflow actions and caching

flowchart TD
    subgraph CI_Workflow
        A[Trigger workflow] --> B[actions_checkout_v7]
        B --> C[actions_setup_python_v7]
        C --> D[astral_sh_setup_uv_v9_0_0]
        D --> E[Run_tests_or_docs]
        E --> F[codecov_codecov_action_v7]
    end

    D --> G[Use_pyproject_toml_for_uv_cache]
    F --> H[Upload_coverage_with_files_input]

Loading

File-Level Changes

Change	Details	Files
Bump core GitHub Actions to Node 24-compatible versions across all workflows.	Update actions/checkout from v4 to v7 in test, doc, linter, and publish workflows. Update actions/setup-python from v5 to v7 in all workflows using it.	.github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml .github/workflows/publish.yml
Align uv setup with latest action version and working cache behavior.	Replace astral-sh/setup-uv pinned SHA with tag v9.0.0 across all workflows. Rely on setup-uv’s updated default cache-dependency-glob that includes pyproject.toml for effective caching.	.github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml .github/workflows/publish.yml
Update Codecov action usage to the v7 API and ensure coverage upload works.	Bump codecov/codecov-action from v4 to v7 in the test workflow. Rename Codecov input from file to files to match the new action API and avoid no-op uploads.	.github/workflows/test.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider pinning the updated GitHub Actions (checkout, setup-python, setup-uv, codecov-action) to immutable SHAs or at least major.minor versions rather than floating major tags to avoid unexpected behavior if upstream publishes a breaking change on the same major.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider pinning the updated GitHub Actions (checkout, setup-python, setup-uv, codecov-action) to immutable SHAs or at least major.minor versions rather than floating major tags to avoid unexpected behavior if upstream publishes a breaking change on the same major.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[ChristianGeng]

Re: SHA-pinning suggestion — leaving the floating major tags (checkout/setup-python/codecov-action@v7, setup-uv@v9.0.0) as-is. Same question came up on audformat#539, and the call there was to keep floating tags consistent across this whole rollout (audeer#206, opensmile-python#132, audb#591, audformat#539) rather than SHA-pin some repos and not others — one version-bump PR then updates all of them the same way. Full SHA-pinning would trade that for supply-chain hardening this org hasn't adopted elsewhere.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.0%. Comparing base (07ff03f) to head (2469a99).

Additional details and impacted files

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ChristianGeng]

@hagenw for review — but please merge #309 first, not this one.

This PR is only the action-version bump (checkout/setup-python/setup-uv/codecov-action, plus a per-workflow uv cache suffix). It deliberately no longer contains the MinIO work: that was split out into #309, because dropping the play.min.io dependency is a separate concern from bumping action versions.

The consequence is that this PR cannot go green on its own. Its test job still points at play.min.io, which is unreachable, so the Test workflow hangs until it is cancelled — I cancelled the current run rather than let it burn an hour of runner time. That is not a fault in this diff.

Suggested order:

1. Merge CI: run minio tests on self-hosted MinIO #309 (self-hosted MinIO — green on Linux, Windows and macOS).
2. Merge main into this branch, so it picks up the MinIO fix.
3. This PR's CI then runs against a self-hosted MinIO and can actually go green.
4. Merge this one.

Reviewing the diff here is fine at any point; it is only the merge that needs to wait.