CI: update checkout, setup-python, setup-uv, codecov

[ChristianGeng]

Summary

Two related CI bugs, both caused by stale GitHub Action version pins:

1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob
   keys on uv.lock/requirements*.txt, neither of which exists here (no
   committed lockfile, by design), so caching never actually worked. Bumped
   astral-sh/setup-uv v5 -> v9.0.0 in publish.yml (the only workflow
   that calls it directly; test.yml installs uv via
   mamba-org/setup-micromamba, left untouched).

2. Node.js 20 deprecation: actions/checkout and actions/setup-python
   bumped v4/v5 -> v7, clearing the "Node.js 20 is deprecated" warning.
   codecov/codecov-action bumped v4 -> v7; its v5 rewrite dropped the
   singular file: input in favor of files:, renamed accordingly.
   actions/cache (used for the air/cough-speech-sneeze/emodb/micirp/musan
   test-data caches across doc/publish/test workflows) bumped v4 -> v6
   for the same reason.

prune-cache left at its new default (off): auglib's runtime dependency
tree (audeer, audformat, audinterface, audmath, audobject, scipy) has no
large pre-built binary wheels like torch, so pruning would save ~0 disk
space while costing avoidable re-downloads.

Part of the same CI cleanup as audeering/audeer#206,
audeering/opensmile-python#132, audeering/audb#591,
audeering/audformat#539, audeering/audbackend#307, and
audeering/audresample#83.

Test plan

• All workflow YAML files reviewed and diff-verified against the
  established pattern from sibling repos
• CI passes on this PR

[sourcery-ai]

Reviewer's Guide

Updates CI workflows to use newer GitHub Actions (checkout, setup-python, cache, codecov, setup-uv) and fixes CI caching and Codecov configuration while keeping behavior aligned with sibling repositories.

Flow diagram for updated CI doc workflow actions

flowchart LR
  trigger["doc workflow trigger"] --> checkout_v7["actions/checkout@v7"]
  checkout_v7 --> cache_v6_air["actions/cache@v6 (air)"]
  cache_v6_air --> cache_v6_cough["actions/cache@v6 (cough-speech-sneeze)"]
  cache_v6_cough --> cache_v6_emodb["actions/cache@v6 (emodb)"]
  cache_v6_emodb --> cache_v6_micirp["actions/cache@v6 (micirp)"]
  cache_v6_micirp --> cache_v6_musan["actions/cache@v6 (musan)"]
  cache_v6_musan --> setup_python_v7["actions/setup-python@v7"]
  setup_python_v7 --> setup_uv_v9["astral-sh/setup-uv@v9.0.0"]
  setup_uv_v9 --> build_docs["build docs and run CI tasks"]

Loading

File-Level Changes

Change	Details	Files
Bump checkout, setup-python, and cache actions to Node.js 22–compatible versions across all workflows.	Updated actions/checkout from v4 to v7 in doc, publish, test, and linter workflows Updated actions/setup-python from v5 to v7 in doc, publish, and linter workflows Updated actions/cache from v4 to v6 for all dataset caches in doc, publish, and test workflows	.github/workflows/doc.yml .github/workflows/publish.yml .github/workflows/test.yml .github/workflows/linter.yml
Update uv setup action to a version with correct default caching behavior where it is directly used.	Bumped astral-sh/setup-uv from v5 to v9.0.0 in doc workflow Bumped astral-sh/setup-uv from v5 to v9.0.0 in publish workflow Left test workflow’s micromamba-based uv installation path unchanged	.github/workflows/doc.yml .github/workflows/publish.yml
Adjust Codecov action and inputs to match new major version requirements.	Bumped codecov/codecov-action from v4 to v7 in the test workflow Renamed Codecov input key from file to files to comply with the v5+ interface	.github/workflows/test.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 3 issues, and left some high level feedback:

• Since you’re touching all workflows, consider centralizing the repeated dataset cache configuration (paths/keys for air, cough-speech-sneeze, emodb, micirp, musan) via a reusable workflow or shared variables to avoid drift if versions or locations change in the future.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Since you’re touching all workflows, consider centralizing the repeated dataset cache configuration (paths/keys for air, cough-speech-sneeze, emodb, micirp, musan) via a reusable workflow or shared variables to avoid drift if versions or locations change in the future.

## Individual Comments

### Comment 1
<location path=".github/workflows/doc.yml" line_range="19" />
<code_context>

     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         # Ensure a dynamic version is assigned
</code_context>
<issue_to_address>
**issue (bug_risk):** Using actions/checkout@v7 may fail since this major version does not exist yet.

The latest published major for `actions/checkout` is `v4`, so `@v7` will currently resolve to nothing and the workflow will fail with an `Unable to resolve action` error. Unless you’re targeting a different action, please use `@v4` or another existing tag to keep the pipeline working.
</issue_to_address>

### Comment 2
<location path=".github/workflows/doc.yml" line_range="26" />
<code_context>

     - name: Cache air
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: ~/audb/air/1.4.2
</code_context>
<issue_to_address>
**issue (bug_risk):** actions/cache@v6 is not a currently published major and will break the workflow.

actions/cache is only released up to v4. Using `@v6` will fail to resolve the action and break this step. If you want the latest stable, stick with `@v4` or choose a specific known tag.
</issue_to_address>

### Comment 3
<location path=".github/workflows/doc.yml" line_range="56" />
<code_context>

     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
</code_context>
<issue_to_address>
**issue (bug_risk):** actions/setup-python@v7 is not available and will prevent jobs from starting.

The latest published major version is `actions/setup-python@v5`. Using `@v7` will fail because that version does not exist. Please use `@v5` or another valid released tag so the workflow continues to run.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (bug_risk): Using actions/checkout@v7 may fail since this major version does not exist yet.

The latest published major for actions/checkout is v4, so @v7 will currently resolve to nothing and the workflow will fail with an Unable to resolve action error. Unless you’re targeting a different action, please use @v4 or another existing tag to keep the pipeline working.

[sourcery-ai]

issue (bug_risk): actions/cache@v6 is not a currently published major and will break the workflow.

actions/cache is only released up to v4. Using @v6 will fail to resolve the action and break this step. If you want the latest stable, stick with @v4 or choose a specific known tag.

[sourcery-ai]

issue (bug_risk): actions/setup-python@v7 is not available and will prevent jobs from starting.

The latest published major version is actions/setup-python@v5. Using @v7 will fail because that version does not exist. Please use @v5 or another valid released tag so the workflow continues to run.

[ChristianGeng]

Re: the version-tag concerns — these aren't hypothetical, CI already ran on this diff and every flagged step passed: actions/checkout@v7, actions/cache@v6, and actions/setup-python@v7 all resolved and ran successfully (see the green checks on this PR). checkout is at major v7, cache at v6, setup-python at v7 as of when this was written — none of them "don't exist." Leaving as-is.

[ChristianGeng]

Pushed a follow-up commit bumping mamba-org/setup-micromamba@v2 -> @v3 — it was still triggering its own "Node.js 20 is deprecated" warning even after the main round of bumps, since it wasn't one of the four actions originally targeted. CI is green on the new commit. The only remaining annotation is the Homebrew "aws/tap not trusted" warning on the macOS job — confirmed pre-existing on main (unrelated to this PR, a Homebrew tap-trust policy affecting any mediainfo install), not something introduced here.