CI: update checkout, setup-python, setup-uv, codecov

[ChristianGeng]

Summary

Two related CI bugs, both caused by stale GitHub Action version pins:

1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob
   keys on uv.lock / requirements*.txt, neither of which exists in this
   repo (no committed lockfile, by design — it tests against latest
   resolvable deps). Caching has therefore silently never worked.

   This repo's setup-uv pin was a SHA (3259c6206f993105e3a61b142c2d97bf4b9ef83d),
   which resolves to tag v7.1.0 — already past the fix that matters here
   (v6.0.0 added pyproject.toml to the default glob, which is committed
   and changes exactly when a dependency does) and past the Node 20 → Node 24
   runtime bump (v7.0.0). So neither bug technically applied to this pin.
   Bumping to v9.0.0 anyway, for consistency with the sibling fixes below
   (matching what was done for audformat's and audbackend's setup-uv pins,
   which were in the same situation).

2. Node.js 20 deprecation: actions/checkout@v4 and
   actions/setup-python@v5 still target the deprecated Node 20 runtime.
   Bumped both to v7. codecov/codecov-action@v4 also bumped to v7;
   its v5 rewrite dropped the singular file: input in favor of files:
   (plural) — renamed accordingly in test.yml so the coverage upload
   doesn't silently no-op. No actions/cache usage exists in this repo's
   workflows.

prune-cache left at its new default (off): audmetric's dependency tree
(audeer, numpy) has no large pre-built binary wheels like torch, so pruning
would save ~0 disk space while costing avoidable re-downloads.

Test plan

• All four changed workflow YAML files validated with
  uv run --isolated --with pyyaml python3 -c "import yaml; yaml.safe_load(open('FILE'))"
• CI passes on this PR (checkout/setup-python/setup-uv/codecov-action
  bumps exercised across the full test matrix)

Part of the same CI cleanup as audeering/audeer#206,
audeering/opensmile-python#132, audeering/audb#591,
audeering/audformat#539, audeering/audbackend#307,
audeering/audresample#83, audeering/auglib#60, audeering/audonnx#115,
audeering/audinterface#206, and audeering/audiofile#193.

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates all CI workflows to use modern GitHub Actions runtimes and fixes uv/Codecov configuration so caching and coverage upload actually work.

Sequence diagram for updated CI workflow actions and coverage upload

sequenceDiagram
    participant GitHubActionsRunner as GitHubActionsRunner
    participant actions_checkout_v7 as actions_checkout_v7
    participant actions_setup_python_v7 as actions_setup_python_v7
    participant astral_sh_setup_uv_v9 as astral_sh_setup_uv_v9_0_0
    participant test_commands as test_commands
    participant codecov_action_v7 as codecov_codecov_action_v7

    GitHubActionsRunner->>actions_checkout_v7: uses actions/checkout@v7
    actions_checkout_v7-->>GitHubActionsRunner: repository checked out

    GitHubActionsRunner->>actions_setup_python_v7: uses actions/setup-python@v7
    actions_setup_python_v7-->>GitHubActionsRunner: Python environment ready

    GitHubActionsRunner->>astral_sh_setup_uv_v9: uses astral-sh/setup-uv@v9.0.0
    astral_sh_setup_uv_v9-->>GitHubActionsRunner: uv installed with pyproject.toml cache

    GitHubActionsRunner->>test_commands: run uv sync / tests
    test_commands-->>GitHubActionsRunner: test results and coverage file

    GitHubActionsRunner->>codecov_action_v7: uses codecov/codecov-action@v7 with files
    codecov_action_v7-->>GitHubActionsRunner: coverage uploaded to Codecov

Loading

File-Level Changes

Change	Details	Files
Modernize core GitHub Actions (checkout, setup-python) to Node 24–based v7 across all workflows.	Bump actions/checkout from v4 to v7 in test, doc, linter, and publish workflows. Bump actions/setup-python from v5 to v7 in all workflows using it, keeping existing python-version matrices and values intact.	.github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml .github/workflows/publish.yml
Align uv setup with current upstream defaults and consistent pinning.	Update astral-sh/setup-uv pin from a specific commit SHA to the v9.0.0 tag in all workflows. Keep uv usage (uv sync / uvx, etc.) unchanged so behavior is identical aside from improved caching defaults and runtime support.	.github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml .github/workflows/publish.yml
Update Codecov action and configuration to the new major version so coverage uploads succeed.	Bump codecov/codecov-action from v4 to v7 in the test workflow. Rename the Codecov input from file to files to match the v5+ API and ensure coverage.xml is actually uploaded. Retain the conditional upload guard so Codecov still only runs on ubuntu-latest.	.github/workflows/test.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Since you’re moving setup-uv from a SHA pin to a tagged release (v9.0.0), consider whether you want to standardize on either tag- or SHA-based pinning across workflows for supply-chain consistency and document that choice in the repo’s CI conventions.
• You’re already updating GitHub Actions to newer Node runtimes; you may also want to revisit actions/setup-node@v4 with node-version: '16.0' in publish.yml, as Node 16 is EOL and may eventually break or lose support in the Actions ecosystem.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Since you’re moving `setup-uv` from a SHA pin to a tagged release (`v9.0.0`), consider whether you want to standardize on either tag- or SHA-based pinning across workflows for supply-chain consistency and document that choice in the repo’s CI conventions.
- You’re already updating GitHub Actions to newer Node runtimes; you may also want to revisit `actions/setup-node@v4` with `node-version: '16.0'` in `publish.yml`, as Node 16 is EOL and may eventually break or lose support in the Actions ecosystem.

## Individual Comments

### Comment 1
<location path=".github/workflows/doc.yml" line_range="27" />
<code_context>

     - name: Install uv
-      uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d
+      uses: astral-sh/setup-uv@v9.0.0

     - name: Install package
</code_context>
<issue_to_address>
**🚨 issue (security):** Switching from a pinned SHA to a version tag for setup-uv weakens reproducibility and security.

Using a commit SHA ensured a fixed, reviewable version of `astral-sh/setup-uv`. Tags like `@v9.0.0` can be retagged or change upstream, reducing determinism and supply-chain safety. Please pin to the commit SHA for `v9.0.0` (or the desired version) to keep the workflow reproducible while upgrading.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

🚨 issue (security): Switching from a pinned SHA to a version tag for setup-uv weakens reproducibility and security.

Using a commit SHA ensured a fixed, reviewable version of astral-sh/setup-uv. Tags like @v9.0.0 can be retagged or change upstream, reducing determinism and supply-chain safety. Please pin to the commit SHA for v9.0.0 (or the desired version) to keep the workflow reproducible while upgrading.

[ChristianGeng]

Re: standardizing tag- vs SHA-pinning — the convention across this rollout is floating major tags for checkout/setup-python/codecov-action, and an exact tag (v9.0.0, not a SHA) for setup-uv specifically, since this PR's whole point is a specific version's caching-fix behavior. Same choice made on all sibling repos. Leaving as-is.