From e1ef12868e52bab0195aca7f81dcab4868e1f48d Mon Sep 17 00:00:00 2001
From: cgeng <cgeng@audeering.com>
Date: Tue, 4 Aug 2026 15:27:18 +0200
Subject: [PATCH 1/7] Disable uv cache in CI: no lockfile to key it on

setup-uv's cache defaults to keying on a uv.lock/requirements*.txt
glob, but uv.lock is gitignored here (a library tests against a
range of dependency versions, not one pinned set), so the cache can
never invalidate: "No file matched... The cache will never get
invalidated." Disabling it outright is more honest than leaving a
cache that can silently never refresh.
---
 .github/workflows/doc.yml     | 2 ++
 .github/workflows/linter.yml  | 2 ++
 .github/workflows/publish.yml | 2 ++
 .github/workflows/test.yml    | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index a2915c67..adf2cf1b 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -25,6 +25,8 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5
+      with:
+        enable-cache: false
 
     - name: Test building documentation
       run: uv run python -m sphinx docs/ docs/_build/ -b html -W
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index a6fe6cef..ec07156e 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -21,6 +21,8 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5
+      with:
+        enable-cache: false
 
     - name: Install pre-commit hooks
       run: uvx pre-commit install --install-hooks
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4ce8bcde..be5a5a7d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,6 +26,8 @@ jobs:
     
     - name: Install uv
       uses: astral-sh/setup-uv@v5
+      with:
+        enable-cache: false
 
     # PyPI package
     - name: Build Python package
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3c24d107..920b779c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,6 +25,8 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5
+      with:
+        enable-cache: false
 
     - name: Sync Python environment
       run: uv sync

From 718bd6358b617dadfbf86b9fde60ba5ef7402480 Mon Sep 17 00:00:00 2001
From: cgeng <cgeng@audeering.com>
Date: Tue, 4 Aug 2026 15:50:23 +0200
Subject: [PATCH 2/7] Bump astral-sh/setup-uv to v9 instead of disabling its
 cache

v5's pinned default cache-dependency-glob is literally uv.lock +
requirements*.txt (confirmed from the v5 tag's own action.yml),
neither of which exists here -- exactly why the cache never
invalidated. v6.0.0 added pyproject.toml to the default glob for
precisely this case: it's committed and changes whenever a
dependency actually changes, so the cache now hits when nothing
changed and correctly invalidates when it does, with no lockfile
needed. Checked every breaking change from v6 through v9 against
how these 4 workflows use the action (no python-version/
working-directory/manifest-file on the setup-uv step, no
self-hosted runners) -- none apply. Also fixes the Node.js 20
deprecation warning as a side effect (a v7 change).
---
 .github/workflows/doc.yml     | 4 +---
 .github/workflows/linter.yml  | 4 +---
 .github/workflows/publish.yml | 4 +---
 .github/workflows/test.yml    | 4 +---
 4 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index adf2cf1b..7e6f5f7a 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -24,9 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
-      with:
-        enable-cache: false
+      uses: astral-sh/setup-uv@v9
 
     - name: Test building documentation
       run: uv run python -m sphinx docs/ docs/_build/ -b html -W
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index ec07156e..e369bb9e 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -20,9 +20,7 @@ jobs:
         python-version: '3.12'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
-      with:
-        enable-cache: false
+      uses: astral-sh/setup-uv@v9
 
     - name: Install pre-commit hooks
       run: uvx pre-commit install --install-hooks
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index be5a5a7d..330a3552 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,9 +25,7 @@ jobs:
         python-version: '3.12'
     
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
-      with:
-        enable-cache: false
+      uses: astral-sh/setup-uv@v9
 
     # PyPI package
     - name: Build Python package
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 920b779c..30a2df0b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,9 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
-      with:
-        enable-cache: false
+      uses: astral-sh/setup-uv@v9
 
     - name: Sync Python environment
       run: uv sync

From 178f3f7634e5dd3640a488fc7c3332a9c373a6c6 Mon Sep 17 00:00:00 2001
From: cgeng <cgeng@audeering.com>
Date: Tue, 4 Aug 2026 15:51:31 +0200
Subject: [PATCH 3/7] Fix version pin: v9.0.0, not v9 (no floating major tag)

astral-sh/setup-uv doesn't publish a floating v9 tag, only exact
version tags -- confirmed the hard way, the first push failed all
jobs immediately with "Unable to resolve action ... unable to find
version v9". Checked available tags directly: v9.0.0 is the one
that exists.
---
 .github/workflows/doc.yml     | 2 +-
 .github/workflows/linter.yml  | 2 +-
 .github/workflows/publish.yml | 2 +-
 .github/workflows/test.yml    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 7e6f5f7a..c1cfa699 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -24,7 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v9
+      uses: astral-sh/setup-uv@v9.0.0
 
     - name: Test building documentation
       run: uv run python -m sphinx docs/ docs/_build/ -b html -W
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index e369bb9e..f31fe7a9 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -20,7 +20,7 @@ jobs:
         python-version: '3.12'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v9
+      uses: astral-sh/setup-uv@v9.0.0
 
     - name: Install pre-commit hooks
       run: uvx pre-commit install --install-hooks
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 330a3552..4014ec7a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,7 +25,7 @@ jobs:
         python-version: '3.12'
     
     - name: Install uv
-      uses: astral-sh/setup-uv@v9
+      uses: astral-sh/setup-uv@v9.0.0
 
     # PyPI package
     - name: Build Python package
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 30a2df0b..cc3f0eef 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,7 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v9
+      uses: astral-sh/setup-uv@v9.0.0
 
     - name: Sync Python environment
       run: uv sync

From 9ab35beeb09dbe2bcb9f21e2836bddd783eff4dc Mon Sep 17 00:00:00 2001
From: cgeng <cgeng@audeering.com>
Date: Tue, 4 Aug 2026 16:14:44 +0200
Subject: [PATCH 4/7] Bump actions/checkout and actions/setup-python to v7

Both v4/v5 target Node.js 20, deprecated on GitHub-hosted runners.
checkout@v5 and setup-python@v6 are the versions that actually move
to Node 24; went straight to v7 for both since it's already what
was verified for setup-uv above. Checked every breaking change
along the way against this repo's actual usage:

- checkout v5: Node 24 (the fix). Runner requirement v2.327.1+,
  already satisfied (GitHub-hosted runners report 2.336.0)
- checkout v6: persists git credentials to a separate file --
  internal implementation detail, not observable here
- checkout v7: blocks checking out fork PRs for
  pull_request_target/workflow_run -- none of these 5 workflows use
  those trigger types (push/pull_request only)
- setup-python v6: Node 24 (the fix), same runner requirement
- setup-python v7: removes the pip-install input (unused everywhere
  here -- every call site only passes python-version)

Together with the earlier setup-uv bump, this clears the Node.js 20
deprecation warning entirely (was flagging 3 actions, now 0).
---
 .github/workflows/doc.yml      | 4 ++--
 .github/workflows/linter.yml   | 4 ++--
 .github/workflows/publish.yml  | 4 ++--
 .github/workflows/test-pip.yml | 4 ++--
 .github/workflows/test.yml     | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index c1cfa699..9a054246 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -16,10 +16,10 @@ jobs:
         python-version: [ '3.12' ]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index f31fe7a9..61fe15be 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: '3.12'
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4014ec7a..2da09e87 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,11 +16,11 @@ jobs:
       group: ${{ github.workflow }}-${{ github.ref }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 2
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: '3.12'
     
diff --git a/.github/workflows/test-pip.yml b/.github/workflows/test-pip.yml
index 89592eb1..513db9dd 100644
--- a/.github/workflows/test-pip.yml
+++ b/.github/workflows/test-pip.yml
@@ -16,10 +16,10 @@ jobs:
         python-version: [ '3.12' ]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cc3f0eef..798a1a21 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,10 +16,10 @@ jobs:
         python-version: [ '3.10', '3.11', '3.12', '3.13', '3.14' ]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 

From b3ae12984ecb12a9bff9a8aa9d5ff5b8e66f6864 Mon Sep 17 00:00:00 2001
From: cgeng <cgeng@audeering.com>
Date: Tue, 4 Aug 2026 16:24:27 +0200
Subject: [PATCH 5/7] Bump codecov/codecov-action to v7, fixing the last
 Node.js 20 flag

v4 was the last remaining action still targeting Node 20 after the
checkout/setup-python/setup-uv bumps. v6.0.0 is where this action
moves to Node 24; went to v7 (current latest) since its only
further change is removing an internal CI workflow, nothing that
affects usage here.

v5.0.0 rewrote the action around the Codecov CLI wrapper and, in
the process, dropped the singular `file` input this workflow used
(`file: ./coverage.xml`) -- confirmed by diffing action.yml across
v4/v5/v6. Only `files` (plural, comma-separated) exists from v5
onward. Renamed the input accordingly so the explicit coverage.xml
path keeps being passed, rather than silently falling back to the
action's own auto-discovery.
---
 .github/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 798a1a21..8ca03788 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -36,8 +36,8 @@ jobs:
       run: uv run pytest
 
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@v7
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
-        file: ./coverage.xml
+        files: ./coverage.xml
       if: matrix.os == 'ubuntu-latest'

From 1d16748a22178a4d4d67434f48e580cc639e1164 Mon Sep 17 00:00:00 2001
From: cgeng <cgeng@audeering.com>
Date: Wed, 5 Aug 2026 09:25:38 +0200
Subject: [PATCH 6/7] Set prune-cache: true, restoring the pre-v9 default

v9.0.0 changed prune-cache's default from true to false, so the
entire uv cache (including pre-built wheels, cheap to re-download)
now persists unbounded instead of shrinking back to just
source-built wheels after each run. Setting it explicitly keeps
that bound while still getting v9's other fixes.
---
 .github/workflows/doc.yml     | 2 ++
 .github/workflows/linter.yml  | 2 ++
 .github/workflows/publish.yml | 2 ++
 .github/workflows/test.yml    | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 9a054246..52803f9d 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -25,6 +25,8 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
+      with:
+        prune-cache: true
 
     - name: Test building documentation
       run: uv run python -m sphinx docs/ docs/_build/ -b html -W
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 61fe15be..9e1c49d9 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -21,6 +21,8 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
+      with:
+        prune-cache: true
 
     - name: Install pre-commit hooks
       run: uvx pre-commit install --install-hooks
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2da09e87..c408a98a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,6 +26,8 @@ jobs:
     
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
+      with:
+        prune-cache: true
 
     # PyPI package
     - name: Build Python package
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8ca03788..3077b47f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,6 +25,8 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
+      with:
+        prune-cache: true
 
     - name: Sync Python environment
       run: uv sync

From 0d57e1142f048f1012d2ad6b39e1ead1b32908fc Mon Sep 17 00:00:00 2001
From: cgeng <cgeng@audeering.com>
Date: Wed, 5 Aug 2026 10:28:12 +0200
Subject: [PATCH 7/7] Revert "Set prune-cache: true, restoring the pre-v9
 default"

This reverts commit 1d16748a22178a4d4d67434f48e580cc639e1164.
---
 .github/workflows/doc.yml     | 2 --
 .github/workflows/linter.yml  | 2 --
 .github/workflows/publish.yml | 2 --
 .github/workflows/test.yml    | 2 --
 4 files changed, 8 deletions(-)

diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 52803f9d..9a054246 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -25,8 +25,6 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
-      with:
-        prune-cache: true
 
     - name: Test building documentation
       run: uv run python -m sphinx docs/ docs/_build/ -b html -W
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 9e1c49d9..61fe15be 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -21,8 +21,6 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
-      with:
-        prune-cache: true
 
     - name: Install pre-commit hooks
       run: uvx pre-commit install --install-hooks
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c408a98a..2da09e87 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,8 +26,6 @@ jobs:
     
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
-      with:
-        prune-cache: true
 
     # PyPI package
     - name: Build Python package
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3077b47f..8ca03788 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,8 +25,6 @@ jobs:
 
     - name: Install uv
       uses: astral-sh/setup-uv@v9.0.0
-      with:
-        prune-cache: true
 
     - name: Sync Python environment
       run: uv sync