CI: update checkout, setup-python, setup-uv, codecov

[ChristianGeng]

Problem

Two related CI bugs, both caused by stale GitHub Action version pins:

1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob
   on v5 is **/uv.lock + **/requirements*.txt. audresample is a library
   with no committed lockfile (by design, to test against latest resolvable
   deps), so the glob never matches and caching silently never worked.
2. Node.js 20 deprecation warnings: actions/checkout@v4,
   actions/setup-python@v5, and codecov/codecov-action@v4 all still
   target the deprecated Node 20 runtime.

Fix

• astral-sh/setup-uv@v5 -> @v9.0.0 (exact tag; this repo does not
  publish a floating major tag). v6.0.0 added pyproject.toml to the
  default cache-dependency-glob, and it stayed there through v9.0.0.
  pyproject.toml is committed and changes exactly when a dependency does,
  so caching now works with no lockfile needed. Bumped in all four
  workflow files, including both occurrences in publish.yml (build and
  deploy jobs).
• actions/checkout@v4 -> @v7, actions/setup-python@v5 -> @v7
  (every occurrence), clearing the Node.js 20 deprecation warning.
• codecov/codecov-action@v4 -> @v7 in test.yml. Its v5 rewrite
  dropped the singular file: input in favor of files: (plural); renamed
  accordingly so coverage upload doesn't silently get ignored.
• actions/cache is not used anywhere in this repo, so no change needed
  there.

prune-cache

setup-uv's default for prune-cache changed from true to false at
v9.0.0. Left it at the new default: audresample's only runtime dependency
is numpy, and its dev dependency group (audiofile, audeer, matplotlib,
pytest, sphinx, etc.) has no large pre-built wheels like torch, so
pruning would save ~0 disk space while costing avoidable re-downloads on
every run.

Related

Same pattern already applied and merged in:

• CI: update checkout, setup-python, setup-uv audeer#206
• CI: update checkout, setup-python, setup-uv opensmile-python#132
• CI: update checkout, setup-python, setup-uv audb#591
• CI: update checkout, setup-python, setup-uv, codecov audformat#539

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates all GitHub Actions workflows to use newer, Node 20–compatible action versions and fixes uv caching and Codecov upload configuration by bumping astral-sh/setup-uv, actions/checkout, actions/setup-python, and codecov/codecov-action with minimal behavioral changes otherwise.

Sequence diagram for updated CI test workflow using new actions and uv caching

sequenceDiagram
    actor Developer
    participant GitHub_Actions
    participant actions_checkout
    participant actions_setup_python
    participant setup_uv
    participant codecov_action

    Developer->>GitHub_Actions: push or pull_request
    GitHub_Actions->>actions_checkout: actions/checkout@v7
    GitHub_Actions->>actions_setup_python: actions/setup-python@v7
    GitHub_Actions->>setup_uv: astral-sh/setup-uv@v9.0.0
    alt [pyproject.toml unchanged]
        setup_uv-->>GitHub_Actions: [use cached environment]
    else [pyproject.toml changed]
        setup_uv-->>GitHub_Actions: [create and cache new environment]
    end
    GitHub_Actions->>codecov_action: codecov/codecov-action@v7
    codecov_action-->>GitHub_Actions: [coverage files processed with files input]

Loading

File-Level Changes

Change	Details	Files
Update setup-uv to v9.0.0 to enable dependency-based caching via pyproject.toml across all workflows.	Bump astral-sh/setup-uv from v5 to v9.0.0 in publish workflow build job. Bump astral-sh/setup-uv from v5 to v9.0.0 in publish workflow deploy/docs job. Bump astral-sh/setup-uv from v5 to v9.0.0 in test workflow. Bump astral-sh/setup-uv from v5 to v9.0.0 in doc workflow. Bump astral-sh/setup-uv from v5 to v9.0.0 in linter workflow.	.github/workflows/publish.yml .github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml
Modernize core GitHub Actions to versions that run on supported Node.js runtimes.	Bump actions/checkout from v4 to v7 in publish workflow build and deploy jobs. Bump actions/checkout from v4 to v7 in test workflow. Bump actions/checkout from v4 to v7 in doc workflow. Bump actions/checkout from v4 to v7 in linter workflow. Bump actions/setup-python from v5 to v7 in publish workflow build and deploy jobs. Bump actions/setup-python from v5 to v7 in test workflow. Bump actions/setup-python from v5 to v7 in doc workflow. Bump actions/setup-python from v5 to v7 in linter workflow.	.github/workflows/publish.yml .github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml
Update Codecov action and configuration to the new multi-file input API so coverage uploads succeed.	Bump codecov/codecov-action from v4 to v7 in test workflow. Rename Codecov input from file to files to match new action version.	.github/workflows/test.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}