chore(deps): bump astral-sh/setup-uv from 6.8.0 to 9.0.0

[dependabot]

Bumps astral-sh/setup-uv from 6.8.0 to 9.0.0.

Release notes

Sourced from astral-sh/setup-uv's releases.

v9.0.0 🌈 Change prune-cache default to false

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

• Change prune-cache default to false @​charliermarsh (#967)

🐛 Bug fixes

• fix: fall back to distribution ID when os-release has no version field @​cxzhong (#961)

🚀 Enhancements

• Speed up version client by partial response reads @​eifinger (#807)

🧰 Maintenance

• chore: update known checksums for 0.11.30 @github-actions[bot] (#968)
• chore: update known checksums for 0.11.29 @github-actions[bot] (#960)

📚 Documentation

• docs: update version references to v8.3.2 @github-actions[bot] (#949)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#970)
• chore(deps): roll up Dependabot updates @​eifinger (#962)

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details. In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

... (truncated)

Commits

• c771a70 chore(deps): roll up Dependabot updates (#970)
• 2f537ca chore: update known checksums for 0.11.30 (#968)
• 2269552 Speed up version client by partial response reads (#807)
• 47a7f4f Change prune-cache default to false (#967)
• 71966ef chore(deps): roll up Dependabot updates (#962)
• f12b1f0 fix: fall back to distribution ID when os-release has no version field (#961)
• ecd24dd chore: update known checksums for 0.11.29 (#960)
• 6a19136 docs: update version references to v8.3.2 (#949)
• 11f9893 chore: roll up Dependabot updates (#948)
• f798556 docs: update version references to v8.3.1 (#946)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:11 AM UTC · Completed 5:20 AM UTC
Commit: 4701393 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/ci.yaml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR has no linked issue providing authorization for this change. While the Dependabot description documents the version bump, protected-path changes always require explicit human review regardless of author.
  Remediation: A repository maintainer must review and approve this change to .github/workflows/ci.yaml.

Low

• [behavioral change] .github/workflows/ci.yaml — The PR bumps astral-sh/setup-uv from v6 to v9.0.0. Upstream release notes confirm a breaking change: prune-cache default changed from true to false. The GitHub Actions cache for uv will no longer be automatically pruned after each job, potentially leading to cache growth over time. CI will still function correctly, but this is a silent behavioral change worth acknowledging.
  Remediation: If cache pruning is desired, add prune-cache: true to both astral-sh/setup-uv steps via the with block. Otherwise, acknowledge the change as acceptable.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[dependabot]

Superseded by #80.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 5:10 AM UTC · Completed 5:16 AM UTC

Commit: 4701393 · View workflow run →

[fullsend-ai-retro]

Retro: PR #36 — Dependabot bump of astral-sh/setup-uv v6→v9

What happened

Dependabot opened PR #36 on 2026-08-06, bumping astral-sh/setup-uv from v6.8.0 to v9.0.0 in .github/workflows/ci.yaml (2 lines changed). CI passed. The review agent (run 31073321966) completed in ~10 minutes and posted two findings:

• High — protected-path: .github/workflows/ci.yaml is under .github/, requiring human approval.
• Low — behavioral change: upstream prune-cache default changed from true to false, a silent CI behavior change worth acknowledging.

The review agent submitted a CHANGES_REQUESTED verdict. No human ever reviewed or engaged with the PR. After 14 days, Dependabot closed it as superseded by PR #80 (same dependency, bumped further to v10.0.1).

Assessment

Review quality was mixed. The behavioral-change finding about prune-cache was genuinely useful — it surfaced a breaking change from upstream release notes that a human might overlook. This demonstrates real value the review agent can add even on bot dependency PRs. However, the protected-path finding was low-signal noise for a Dependabot version bump — the human already knows they need to approve Dependabot PRs.

The CHANGES_REQUESTED verdict was counterproductive. On a bot-authored dependency PR where the only actionable finding is "a human needs to review this" (which is already true by definition), a CHANGES_REQUESTED status adds friction without adding information. A COMMENT verdict with the behavioral-change finding would have been more appropriate.

Token cost was disproportionate. ~10 minutes of review agent time plus a retro agent run on a 2-line Dependabot bump that was never merged and had zero human interaction.

No new proposals — existing issues cover all findings

All potential improvements are already tracked in fullsend-ai/fullsend. This PR provides additional evidence for:

• #5369 — Review agent should use COMMENT instead of CHANGES_REQUESTED for governance-only findings on bot PRs. New evidence: PR chore(deps): bump astral-sh/setup-uv from 6.8.0 to 9.0.0 #36 sat 14 days with no human engagement after a CHANGES_REQUESTED verdict on a Dependabot bump where no code fix was possible — only human acknowledgment.
• #5370 — Protected-path policy should distinguish mechanical version bumps from governance changes in .github/. New evidence: The High-severity protected-path finding on a pin-hash update in CI yaml added no information beyond what Dependabot's own PR description already conveyed.
• #2588 — Downgrade protected-path severity for bot-authored dependency update PRs. New evidence: Same as above — the finding was technically correct but practically unhelpful.
• #5360 — Skip review and retro stages for bot-authored dependency update PRs. New evidence: Both review and retro ran on a PR that was never merged and had zero human interaction, consuming tokens without driving any outcome.
• #5619 — Broaden retro skip criteria to all unmerged PRs with no agent interaction. New evidence: This retro is running on a closed/unmerged PR where the only interaction was review→superseded, with no human or fix agent involvement.

Counterpoint worth preserving: While the overall token spend was disproportionate, the prune-cache behavioral-change finding demonstrates that review agents can surface genuinely useful information on bot dependency PRs. Any skip/fast-path implementation should preserve the ability to flag breaking changes from upstream release notes.