CI: update checkout, setup-python, setup-uv by ChristianGeng · Pull Request #206 · audeering/audeer

ChristianGeng · 2026-08-04T13:27:27Z

setup-uv's cache defaults to keying on a uv.lock/requirements*.txt glob. uv.lock is gitignored in this repo (a library tests against a range of dependency versions, not one pinned set), so with the pinned astral-sh/setup-uv@v5 the cache could never invalidate — every CI run printed:

No file matched to [**/uv.lock,**/requirements*.txt]. The cache will never get invalidated.

First attempt just disabled caching outright. Better fix, per @hagenw's question on whether caching could still help without a lockfile: bump the pinned action version instead. v5's default cache-dependency-glob is literally **/uv.lock + **/requirements*.txt (confirmed from the v5 tag's own action.yml) — neither exists here. v6.0.0 added **/pyproject.toml to the default glob specifically for this case. pyproject.toml is committed and changes exactly when a dependency actually changes, so bumping to a current version gives real caching — cache hit when nothing changed, correct invalidation when it does — with no lockfile required. Verified end to end on the actual CI run: first run reports a cache miss (expected, new key) and saves a fresh cache; the log shows the real glob used, including pyproject.toml.

Checked every breaking change from v6 through v9 against how these 4 workflows actually use the action (no python-version/working-directory/manifest-file passed to the setup-uv step, no self-hosted runners) — none apply.

Pinned to the exact v9.0.0 tag, not a floating v9 — confirmed via git ls-remote --tags that astral-sh/setup-uv doesn't publish a floating major-version tag (first push to this branch failed everything with "Unable to resolve action... unable to find version v9" before this was caught and fixed).

Side note, corrected: this does not fix the separate Node.js 20 deprecation warning. It removes astral-sh/setup-uv from that warning's list of flagged actions (that part of the fix genuinely is a v7 change), but the warning itself still fires because actions/checkout@v4 and actions/setup-python@v5 are unrelated to this PR and still target Node 20.

🤖 Generated with Claude Code

setup-uv's cache defaults to keying on a uv.lock/requirements*.txt glob, but uv.lock is gitignored here (a library tests against a range of dependency versions, not one pinned set), so the cache can never invalidate: "No file matched... The cache will never get invalidated." Disabling it outright is more honest than leaving a cache that can silently never refresh.

sourcery-ai · 2026-08-04T13:27:38Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Disable uv caching in all GitHub Actions workflows by explicitly turning off the cache on astral-sh/setup-uv@v5 steps, avoiding misleading cache messages when there is no lockfile to key on.

File-Level Changes

Change	Details	Files
Disable uv cache usage in CI where no lockfile or requirements file exists to key invalidation.	Add a with: block to each astral-sh/setup-uv@v5 step in CI workflows Set enable-cache: false so uv does not attempt to use or configure caching in these jobs Rely on fresh uv environment setup each run instead of a misconfigured cache	`.github/workflows/doc.yml` `.github/workflows/linter.yml` `.github/workflows/publish.yml` `.github/workflows/test.yml`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

Copilot

Pull request overview

Disables astral-sh/setup-uv@v5 caching in CI workflows to avoid an always-stale cache configuration when no lockfile (or other cache key material) exists in the repository.

Changes:

Disable setup-uv caching in test.yml.
Disable setup-uv caching in doc.yml and linter.yml.
Disable setup-uv caching in publish.yml.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/test.yml	Disables `setup-uv` cache to avoid never-invalidating cache behavior during test runs.
.github/workflows/publish.yml	Disables `setup-uv` cache for build/publish workflow consistency and to prevent stale dependency environments.
.github/workflows/linter.yml	Disables `setup-uv` cache to avoid stale environments when installing/running hooks.
.github/workflows/doc.yml	Disables `setup-uv` cache for doc builds to prevent reusing non-invalidating cached environments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

hagenw · 2026-08-04T13:37:13Z

Ok, so the solution is to not cache at all as caching seems to work only if we commit the uv.lock file (which I'm not a fan of as we want to include always the latest packages in tests). I thought that it would still be faster with caching if we don't have new versions for some package, but you say this is not supported, correct?

v5's pinned default cache-dependency-glob is literally uv.lock + requirements*.txt (confirmed from the v5 tag's own action.yml), neither of which exists here -- exactly why the cache never invalidated. v6.0.0 added pyproject.toml to the default glob for precisely this case: it's committed and changes whenever a dependency actually changes, so the cache now hits when nothing changed and correctly invalidates when it does, with no lockfile needed. Checked every breaking change from v6 through v9 against how these 4 workflows use the action (no python-version/ working-directory/manifest-file on the setup-uv step, no self-hosted runners) -- none apply. Also fixes the Node.js 20 deprecation warning as a side effect (a v7 change).

astral-sh/setup-uv doesn't publish a floating v9 tag, only exact version tags -- confirmed the hard way, the first push failed all jobs immediately with "Unable to resolve action ... unable to find version v9". Checked available tags directly: v9.0.0 is the one that exists.

ChristianGeng · 2026-08-04T14:12:26Z

Ok, so the solution is to not cache at all as caching seems to work only if we commit the uv.lock file (which I'm not a fan of as we want to include always the latest packages in tests). I thought that it would still be faster with caching if we don't have new versions for some package, but you say this is not supported, correct?

Yes, this is supported, I was wrong.

@v5's pinned default cache-dependency-glob is literally **/uv.lock +
**/requirements*.txt (confirmed straight from the v5 tag's action.yml),
neither of which exists here:

v6.0.0

This added **/pyproject.toml to the default glob specifically to fix this class
of complaint. pyproject.toml is committed and changes exactly when
dependencies change, so bumping the action version gives real caching:

cache hit when nothing changed,
correct invalidation when it does

Both v4/v5 target Node.js 20, deprecated on GitHub-hosted runners. checkout@v5 and setup-python@v6 are the versions that actually move to Node 24; went straight to v7 for both since it's already what was verified for setup-uv above. Checked every breaking change along the way against this repo's actual usage: - checkout v5: Node 24 (the fix). Runner requirement v2.327.1+, already satisfied (GitHub-hosted runners report 2.336.0) - checkout v6: persists git credentials to a separate file -- internal implementation detail, not observable here - checkout v7: blocks checking out fork PRs for pull_request_target/workflow_run -- none of these 5 workflows use those trigger types (push/pull_request only) - setup-python v6: Node 24 (the fix), same runner requirement - setup-python v7: removes the pip-install input (unused everywhere here -- every call site only passes python-version) Together with the earlier setup-uv bump, this clears the Node.js 20 deprecation warning entirely (was flagging 3 actions, now 0).

v4 was the last remaining action still targeting Node 20 after the checkout/setup-python/setup-uv bumps. v6.0.0 is where this action moves to Node 24; went to v7 (current latest) since its only further change is removing an internal CI workflow, nothing that affects usage here. v5.0.0 rewrote the action around the Codecov CLI wrapper and, in the process, dropped the singular `file` input this workflow used (`file: ./coverage.xml`) -- confirmed by diffing action.yml across v4/v5/v6. Only `files` (plural, comma-separated) exists from v5 onward. Renamed the input accordingly so the explicit coverage.xml path keeps being passed, rather than silently falling back to the action's own auto-discovery.

hagenw · 2026-08-04T14:30:07Z

v6.0.0

This added **/pyproject.toml to the default glob specifically to fix this class of complaint. pyproject.toml is committed and changes exactly when dependencies change, so bumping the action version gives real caching:

cache hit when nothing changed,

correct invalidation when it does

But this also means it will only check for new packages when we update pyproject.toml? Not sure if this is really what we want.

v9.0.0 changed prune-cache's default from true to false, so the entire uv cache (including pre-built wheels, cheap to re-download) now persists unbounded instead of shrinking back to just source-built wheels after each run. Setting it explicitly keeps that bound while still getting v9's other fixes.

ChristianGeng · 2026-08-05T07:27:49Z

But this also means it will only check for new packages when we update pyproject.toml? Not sure if this is really what we want.

I think what happens is this: the cache only stores already-downloaded packages, not a decision about which version to use - uv sync still checks PyPI fresh every run regardless of cache state, so a new release gets picked up immediately either way. So it will pick up an upgrade.

The only behavior change is that v9
changed prune-cache's default from true to false, so the cache
would otherwise grow unbounded instead of shrinking back down after
each run.

I have set prune-cache: true explicitly to restore the old default — pushed.
So we should now have the identical configuration but without the warnings.

hagenw · 2026-08-05T07:38:14Z

Thanks, sounds fine.

When reading astral-sh/setup-uv#967, it seems to me that prune-cache: true only makes sense for projects that download big pre-build packages like torch. As we don't have this in audeer, I think we can just go with the default setting.

This reverts commit 1d16748.

ChristianGeng · 2026-08-05T08:28:28Z

Good point, checked the actual benchmark data in astral-sh/setup-uv#967 — for a tiny dependency tree like audeer's (just tqdm + optional pyyaml), pruning saves 0 MB while costing 2 extra re-downloads per run that would otherwise be free cache hits. Undid 1d16748 via revert in 0d57e11 — back to the plain v9 default.

hagenw

Cool, thanks for solving the deprecation issues. Now we (Claude) just need to apply this to other repos as well.

* Fix CI caching; bump checkout/setup-python off Node.js 20 Two related CI bugs, both caused by stale GitHub Action version pins: 1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob keys on uv.lock/requirements*.txt, neither of which exists here (no committed lockfile, by design), so caching never actually worked. Bumped astral-sh/setup-uv to v9.0.0: v6.0.0 added pyproject.toml to the default glob, which is committed and changes exactly when a dependency does, so caching now works with no lockfile needed. 2. Node.js 20 deprecation: actions/checkout and actions/setup-python bumped to v7, clearing the "Node.js 20 is deprecated" warning. codecov/codecov-action bumped to v7; its v5 rewrite dropped the singular `file:` input in favor of `files:`, renamed accordingly. actions/cache (where used, for test-data caching) bumped to v6 for the same reason. Left `prune-cache` at its new default (off): no large pre-built binary wheels like torch in this repo's dependency tree, so pruning would save ~0 disk space while costing avoidable re-downloads. Part of the same CI cleanup as audeering/audeer#206, audeering/opensmile-python#132, audeering/audb#591, audeering/audformat#539, audeering/audbackend#307, and audeering/audresample#83. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Give each workflow its own uv cache to stop reservation races Documentation, Linter, Test, and Publish jobs sometimes land on an identical setup-uv cache key (same OS + Python version + dependency-file hash), so whichever job finishes first saves the cache and the others get "Failed to save: Unable to reserve cache with key ..., another job may be creating this cache." Harmless -- the losing job's save would have been byte-identical anyway -- but requested clean, warning-free CI across the board. Added `cache-suffix: ${{ github.workflow }}` to every setup-uv step, so each workflow gets its own cache entry instead of racing to share one. Trade-off: workflows no longer share a warm cache with each other, so each pays its own first-run cost independently instead of one job seeding it for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: cgeng <cgeng@audeering.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix CI caching; bump checkout/setup-python off Node.js 20 Two related CI bugs, both caused by stale GitHub Action version pins: 1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob keys on uv.lock/requirements*.txt, neither of which exists here (no committed lockfile, by design), so caching never actually worked. Bumped astral-sh/setup-uv to v9.0.0: v6.0.0 added pyproject.toml to the default glob, which is committed and changes exactly when a dependency does, so caching now works with no lockfile needed. 2. Node.js 20 deprecation: actions/checkout and actions/setup-python bumped to v7, clearing the "Node.js 20 is deprecated" warning. codecov/codecov-action bumped to v7; its v5 rewrite dropped the singular `file:` input in favor of `files:`, renamed accordingly. actions/cache (where used, for test-data caching) bumped to v6 for the same reason. Left `prune-cache` at its new default (off): no large pre-built binary wheels like torch in this repo's dependency tree, so pruning would save ~0 disk space while costing avoidable re-downloads. Part of the same CI cleanup as audeering/audeer#206, audeering/opensmile-python#132, audeering/audb#591, audeering/audformat#539, audeering/audbackend#307, and audeering/audresample#83. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Bump mamba-org/setup-micromamba off Node.js 20 too Left this untouched in the first commit since it wasn't one of the four actions this rollout targets, but it still triggers its own "Node.js 20 is deprecated" warning (v2 targets Node 20). v3.0.0 updated it to run on Node 24, so bump it too -- otherwise the PR's own claim of clearing the Node.js 20 warning entirely isn't actually true for this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Give each workflow its own uv cache to stop reservation races Documentation, Linter, Test, and Publish jobs sometimes land on an identical setup-uv cache key (same OS + Python version + dependency-file hash), so whichever job finishes first saves the cache and the others get "Failed to save: Unable to reserve cache with key ..., another job may be creating this cache." Harmless -- the losing job's save would have been byte-identical anyway -- but requested clean, warning-free CI across the board. Added `cache-suffix: ${{ github.workflow }}` to every setup-uv step, so each workflow gets its own cache entry instead of racing to share one. Trade-off: workflows no longer share a warm cache with each other, so each pays its own first-run cost independently instead of one job seeding it for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: cgeng <cgeng@audeering.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix CI caching; bump checkout/setup-python off Node.js 20 setup-uv's cache keys on uv.lock/requirements*.txt, neither of which exists here (no committed lockfile, by design), so caching never actually worked. Bumped astral-sh/setup-uv from the floating tag v5 -> v9.0.0: v6.0.0 added pyproject.toml to the default glob, which is committed and changes exactly when a dependency does -- so caching now works with no lockfile needed. v7.0.0 also carries the Node 20 -> Node 24 runtime bump. Also bumped actions/checkout and actions/setup-python from v4/v5 to v7, and codecov/codecov-action from v4 to v7, clearing the "Node.js 20 is deprecated" warning entirely. codecov-action's v5 rewrite dropped the `file` input this workflow used; renamed to `files`, its replacement. No actions/cache usage exists in this repo's workflows. Left `prune-cache` at its new default (off): audmath's only runtime dependency is numpy, with no large pre-built binary wheels like torch, so pruning would save ~0 disk space while costing avoidable re-downloads. Same cleanup as audeering/audeer#206, audeering/opensmile-python#132, audeering/audb#591, audeering/audformat#539, audeering/audbackend#307, audeering/audresample#83, audeering/auglib#60, audeering/audonnx#115, audeering/audinterface#206, and audeering/audiofile#193. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Give each workflow its own uv cache to stop reservation races Documentation, Linter, Test, and Publish jobs sometimes land on an identical setup-uv cache key (same OS + Python version + dependency-file hash), so whichever job finishes first saves the cache and the others get "Failed to save: Unable to reserve cache with key ..., another job may be creating this cache." Harmless -- the losing job's save would have been byte-identical anyway -- but requested clean, warning-free CI across the board. Added `cache-suffix: ${{ github.workflow }}` to every setup-uv step, so each workflow gets its own cache entry instead of racing to share one. Trade-off: workflows no longer share a warm cache with each other, so each pays its own first-run cost independently instead of one job seeding it for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: cgeng <cgeng@audeering.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix CI caching; bump checkout/setup-python off Node.js 20 setup-uv's cache keys on uv.lock/requirements*.txt, neither of which exists here (no committed lockfile, by design), so caching never actually worked. Bumped astral-sh/setup-uv (pinned via SHA 3259c6206f99, which resolves to tag v7.1.0) -> v9.0.0: v6.0.0 added pyproject.toml to the default glob, which is committed and changes exactly when a dependency does -- so caching now works with no lockfile needed. Note the existing pin already sat at v7.1.0, past both the caching fix (v6.0.0) and the Node 20 -> Node 24 runtime bump (v7.0.0), so neither bug technically applied to this action here -- bumping to v9.0.0 anyway for consistency across the sibling repos in this cleanup, matching what was done for audformat's and audbackend's setup-uv pins after the fact (same SHA-pin situation). Also bumped actions/checkout and actions/setup-python from v4/v5 to v7, and codecov/codecov-action from v4 to v7, clearing the "Node.js 20 is deprecated" warning entirely. codecov-action's v5 rewrite dropped the `file` input this workflow used; renamed to `files`, its replacement. No actions/cache usage exists in this repo's workflows. Left `prune-cache` at its new default (off): audmetric's runtime dependencies (audeer, numpy) have no large pre-built binary wheels like torch, so pruning would save ~0 disk space while costing avoidable re-downloads. Same cleanup as audeering/audeer#206, audeering/opensmile-python#132, audeering/audb#591, audeering/audformat#539, audeering/audbackend#307, audeering/audresample#83, audeering/auglib#60, audeering/audonnx#115, audeering/audinterface#206, and audeering/audiofile#193. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Give each workflow its own uv cache to stop reservation races Documentation, Linter, Test, and Publish jobs sometimes land on an identical setup-uv cache key (same OS + Python version + dependency-file hash), so whichever job finishes first saves the cache and the others get "Failed to save: Unable to reserve cache with key ..., another job may be creating this cache." Harmless -- the losing job's save would have been byte-identical anyway -- but requested clean, warning-free CI across the board. Added `cache-suffix: ${{ github.workflow }}` to every setup-uv step, so each workflow gets its own cache entry instead of racing to share one. Trade-off: workflows no longer share a warm cache with each other, so each pays its own first-run cost independently instead of one job seeding it for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: cgeng <cgeng@audeering.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix CI caching; bump checkout/setup-python off Node.js 20 setup-uv's cache keys on uv.lock/requirements*.txt, neither of which exists here (no committed lockfile, by design), so caching never actually worked. Bumped astral-sh/setup-uv from v5 to v9.0.0: v6.0.0 added pyproject.toml to the default glob, which is committed and changes exactly when a dependency does -- so caching now works with no lockfile needed. v7.0.0 also moved the action off the deprecated Node.js 20 runtime. Also bumped actions/checkout and actions/setup-python from v4/v5 to v7, and codecov/codecov-action from v4 to v7, clearing the "Node.js 20 is deprecated" warning entirely. codecov-action's v5 rewrite dropped the `file` input this workflow used; renamed to `files`, its replacement, in test.yml so the coverage upload doesn't silently no-op. No actions/cache usage exists in this repo's workflows. Left `prune-cache` at its new default (off): audobject's runtime dependencies (asttokens, audeer, oyaml, packaging) have no large pre-built binary wheels like torch, so pruning would save ~0 disk space while costing avoidable re-downloads. Same cleanup as audeering/audeer#206, audeering/opensmile-python#132, audeering/audb#591, audeering/audformat#539, audeering/audbackend#307, audeering/audresample#83, audeering/auglib#60, audeering/audonnx#115, audeering/audinterface#206, audeering/audiofile#193, and audeering/audmath#76, audeering/audmetric#94. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Give each workflow its own uv cache to stop reservation races Documentation, Linter, Test, and Publish jobs sometimes land on an identical setup-uv cache key (same OS + Python version + dependency-file hash), so whichever job finishes first saves the cache and the others get "Failed to save: Unable to reserve cache with key ..., another job may be creating this cache." Harmless -- the losing job's save would have been byte-identical anyway -- but requested clean, warning-free CI across the board. Added `cache-suffix: ${{ github.workflow }}` to every setup-uv step, so each workflow gets its own cache entry instead of racing to share one. Trade-off: workflows no longer share a warm cache with each other, so each pays its own first-run cost independently instead of one job seeding it for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: cgeng <cgeng@audeering.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix CI caching; bump checkout/setup-python off Node.js 20 Two related CI bugs, both caused by stale GitHub Action version pins: 1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob keys on uv.lock/requirements*.txt, neither of which exists here (no committed lockfile, by design), so caching never actually worked. Bumped astral-sh/setup-uv to v9.0.0: v6.0.0 added pyproject.toml to the default glob, which is committed and changes exactly when a dependency does, so caching now works with no lockfile needed. 2. Node.js 20 deprecation: actions/checkout and actions/setup-python bumped to v7, clearing the "Node.js 20 is deprecated" warning. codecov/codecov-action bumped to v7; its v5 rewrite dropped the singular `file:` input in favor of `files:`, renamed accordingly. actions/cache (where used, for test-data caching) bumped to v6 for the same reason. Left `prune-cache` at its new default (off): no large pre-built binary wheels like torch in this repo's dependency tree, so pruning would save ~0 disk space while costing avoidable re-downloads. Part of the same CI cleanup as audeering/audeer#206, audeering/opensmile-python#132, audeering/audb#591, audeering/audformat#539, audeering/audbackend#307, and audeering/audresample#83. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Bump mamba-org/setup-micromamba off Node.js 20 too Left this untouched in the first commit since it wasn't one of the four actions this rollout targets, but it still triggers its own "Node.js 20 is deprecated" warning (v1 targets Node 20). v3.0.0 updated it to run on Node 24, so bump it too -- otherwise the PR's own claim of clearing the Node.js 20 warning entirely isn't actually true for this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Give each workflow its own uv cache to stop reservation races Documentation, Linter, Test, and Publish jobs sometimes land on an identical setup-uv cache key (same OS + Python version + dependency-file hash), so whichever job finishes first saves the cache and the others get "Failed to save: Unable to reserve cache with key ..., another job may be creating this cache." Harmless -- the losing job's save would have been byte-identical anyway -- but requested clean, warning-free CI across the board. Added `cache-suffix: ${{ github.workflow }}` to every setup-uv step, so each workflow gets its own cache entry instead of racing to share one. Trade-off: workflows no longer share a warm cache with each other, so each pays its own first-run cost independently instead of one job seeding it for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: cgeng <cgeng@audeering.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix CI caching; bump checkout/setup-python off Node.js 20 Two related CI bugs, both caused by stale GitHub Action version pins: 1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob keys on uv.lock/requirements*.txt, neither of which exists here (no committed lockfile, by design), so caching never actually worked. This repo's setup-uv pin was already a SHA (3259c6206f993105e3a61b142c2d97bf4b9ef83d) that resolves to tag v7.1.0 — past the fix that matters here (v6.0.0 added pyproject.toml to the default glob) and past the Node 20 -> Node 24 runtime bump (v7.0.0). Bumping to v9.0.0 anyway, for consistency with the other repos in this cleanup. 2. Node.js 20 deprecation: actions/checkout and actions/setup-python bumped v4/v5 -> v7, clearing the "Node.js 20 is deprecated" warning. codecov/codecov-action bumped v4 -> v7; its v5 rewrite dropped the singular `file:` input in favor of `files:`, renamed accordingly. No actions/cache usage exists in this repo's workflows. Left `prune-cache` at its new default (off): audplot's dependency tree (audmath, audmetric, matplotlib, pandas, seaborn) has no large pre-built binary wheels like torch, so pruning would save ~0 disk space while costing avoidable re-downloads. Part of the same CI cleanup as audeering/audeer#206, audeering/opensmile-python#132, audeering/audb#591, audeering/audformat#539, audeering/audbackend#307, audeering/audresample#83, audeering/auglib#60, audeering/audonnx#115, audeering/audinterface#206, audeering/audiofile#193, audeering/audmath#76, audeering/audmetric#94, audeering/audmodel#63, and audeering/audobject#127. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Give each workflow its own uv cache to stop reservation races Documentation, Linter, Test, and Publish jobs sometimes land on an identical setup-uv cache key (same OS + Python version + dependency-file hash), so whichever job finishes first saves the cache and the others get "Failed to save: Unable to reserve cache with key ..., another job may be creating this cache." Harmless -- the losing job's save would have been byte-identical anyway -- but requested clean, warning-free CI across the board. Added `cache-suffix: ${{ github.workflow }}` to every setup-uv step, so each workflow gets its own cache entry instead of racing to share one. Trade-off: workflows no longer share a warm cache with each other, so each pays its own first-run cost independently instead of one job seeding it for the rest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: cgeng <cgeng@audeering.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

sourcery-ai Bot reviewed Aug 4, 2026

View reviewed changes

ChristianGeng requested review from Copilot and hagenw August 4, 2026 13:30

Copilot started reviewing on behalf of ChristianGeng August 4, 2026 13:31 View session

Copilot AI reviewed Aug 4, 2026

View reviewed changes

ChristianGeng mentioned this pull request Aug 4, 2026

Release 2.5.0 #204

Merged

ChristianGeng self-assigned this Aug 4, 2026

cgeng added 2 commits August 4, 2026 15:50

ChristianGeng changed the title ~~Disable uv cache in CI: no lockfile to key it on~~ Bump astral-sh/setup-uv to v9.0.0: real caching, fixes Node.js 20 warning too Aug 4, 2026

ChristianGeng changed the title ~~Bump astral-sh/setup-uv to v9.0.0: real caching, fixes Node.js 20 warning too~~ Bump astral-sh/setup-uv to v9.0.0 for working cache without a lockfile Aug 4, 2026

ChristianGeng changed the title ~~Bump astral-sh/setup-uv to v9.0.0 for working cache without a lockfile~~ Fix CI caching; bump checkout/setup-python off Node.js 20 Aug 4, 2026

hagenw changed the title ~~Fix CI caching; bump checkout/setup-python off Node.js 20~~ CI: update checkout, setup-python, setup-uv Aug 5, 2026

Revert "Set prune-cache: true, restoring the pre-v9 default"

0d57e11

This reverts commit 1d16748.

hagenw approved these changes Aug 5, 2026

View reviewed changes

ChristianGeng merged commit 549ae07 into main Aug 5, 2026
21 checks passed

ChristianGeng deleted the fix/uv-cache-no-lockfile branch August 5, 2026 09:06

This was referenced Aug 5, 2026

CI: update checkout, setup-python, setup-uv audeering/opensmile-python#132

Merged

CI: update checkout, setup-python, setup-uv audeering/audb#591

Merged

ChristianGeng mentioned this pull request Aug 6, 2026

Let only the Test workflow save the shared uv cache #207

Merged

2 tasks

Navigation Menu

Uh oh!

CI: update checkout, setup-python, setup-uv - #206

CI: update checkout, setup-python, setup-uv#206
ChristianGeng merged 7 commits into
mainfrom
fix/uv-cache-no-lockfile

ChristianGeng commented Aug 4, 2026 •

edited

Loading

Uh oh!

sourcery-ai Bot commented Aug 4, 2026 •

edited

Loading

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

hagenw commented Aug 4, 2026

Uh oh!

ChristianGeng commented Aug 4, 2026

Uh oh!

hagenw commented Aug 4, 2026

Uh oh!

ChristianGeng commented Aug 5, 2026 •

edited

Loading

Uh oh!

hagenw commented Aug 5, 2026

Uh oh!

ChristianGeng commented Aug 5, 2026

Uh oh!

hagenw left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ChristianGeng commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sourcery-ai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

hagenw commented Aug 4, 2026

Uh oh!

ChristianGeng commented Aug 4, 2026

Uh oh!

hagenw commented Aug 4, 2026

Uh oh!

ChristianGeng commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hagenw commented Aug 5, 2026

Uh oh!

ChristianGeng commented Aug 5, 2026

Uh oh!

hagenw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ChristianGeng commented Aug 4, 2026 •

edited

Loading

sourcery-ai Bot commented Aug 4, 2026 •

edited

Loading

ChristianGeng commented Aug 5, 2026 •

edited

Loading