Chore(deps): bump the github-actions group across 1 directory with 8 updates

[dependabot]

Bumps the github-actions group with 8 updates in the / directory:

Package	From	To
Swatinem/rust-cache	2.8.0	2.9.2
leynos/shared-actions/.github/actions/setup-rust	18bed1ca49a6de3d8882bd72635a32ae3f023d57	f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
astral-sh/setup-uv	8.3.2	10.0.1
leynos/shared-actions/.github/actions/generate-coverage	c3141c3d4cb2a2828d2abbcf3d94b15197740c58	f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
leynos/shared-actions/.github/actions/upload-codescene-coverage	4977418856133491c6aa7407d40668744df21818	f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
leynos/shared-actions/.github/workflows/dependabot-automerge.yml	18bed1ca49a6de3d8882bd72635a32ae3f023d57	f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
actions/github-script	8	9
leynos/shared-actions/.github/workflows/mutation-cargo.yml	dae5d4205c5b3b9f5ad37fddfc8d87276f7ea874	f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Updates Swatinem/rust-cache from 2.8.0 to 2.9.2

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.2

What's Changed

• Typofix by @​23Skidoo in Swatinem/rust-cache#316
• fix: include target names in build/ and .fingerprint/ cleanup by @​eitsupi in Swatinem/rust-cache#317
• fix: include cdylib/rlib/dylib/staticlib targets in build and fingerprint cleanup by @​eitsupi in Swatinem/rust-cache#320
• Scan content of $CARGO_HOME/bin on restore instead of relying on cargo install metadata by @​clechasseur in Swatinem/rust-cache#325
• docs: Update checkout action version to latest by @​sondrelg in Swatinem/rust-cache#345
• Fix Windows cache path validation after Rollup migration by @​eitsupi in Swatinem/rust-cache#355
• fix: support Cargo V2 build dir layout by @​claytonwramsey in Swatinem/rust-cache#371

New Contributors

• @​23Skidoo made their first contribution in Swatinem/rust-cache#316
• @​eitsupi made their first contribution in Swatinem/rust-cache#317
• @​clechasseur made their first contribution in Swatinem/rust-cache#325
• @​sondrelg made their first contribution in Swatinem/rust-cache#345
• @​claytonwramsey made their first contribution in Swatinem/rust-cache#371

Full Changelog: Swatinem/rust-cache@v2.9.1...v2.9.2

v2.9.1

Fix regression in hash calculation

Full Changelog: Swatinem/rust-cache@v2.9.0...v2.9.1

v2.9.0

What's Changed

• Add support for running rust-cache commands from within a Nix shell by @​marc0246 in Swatinem/rust-cache#290
• Bump taiki-e/install-action from 2.62.57 to 2.62.60 in the actions group by @​dependabot[bot] in Swatinem/rust-cache#291
• Bump the actions group across 1 directory with 5 updates by @​dependabot[bot] in Swatinem/rust-cache#296
• Bump the prd-major group with 3 updates by @​dependabot[bot] in Swatinem/rust-cache#294
• Bump @​types/node from 24.10.1 to 25.0.2 in the dev-major group by @​dependabot[bot] in Swatinem/rust-cache#295
• Consider all installed toolchains in cache key by @​tamird in Swatinem/rust-cache#293
• Compare case-insenitively for full cache key match by @​kbriggs in Swatinem/rust-cache#303
• Migrate to node24 runner by @​rhysd in Swatinem/rust-cache#314
• Bump the actions group across 1 directory with 7 updates by @​dependabot[bot] in Swatinem/rust-cache#312
• Bump the prd-minor group across 1 directory with 2 updates by @​dependabot[bot] in Swatinem/rust-cache#307
• Bump @​types/node from 25.0.2 to 25.2.2 in the dev-minor group by @​dependabot[bot] in Swatinem/rust-cache#309

New Contributors

• @​marc0246 made their first contribution in Swatinem/rust-cache#290
• @​tamird made their first contribution in Swatinem/rust-cache#293
• @​kbriggs made their first contribution in Swatinem/rust-cache#303

Full Changelog: Swatinem/rust-cache@v2.8.2...v2.9.0

v2.8.2

What's Changed

• ci: address lint findings, add zizmor workflow by @​woodruffw in Swatinem/rust-cache#262
• feat: Implement ability to disable adding job ID + rust environment hashes to cache names by @​Ryan-Brice in Swatinem/rust-cache#279
• Don't overwrite env for cargo-metadata call by @​MaeIsBad in Swatinem/rust-cache#285

... (truncated)

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.9.2

• Fix credentials.toml cleanup
• Improvements to cleanup, preserving more valid targets
• Improvements to cargo install handling
• Correctly sort/dedupe Rust versions

2.9.1

• Fix regression in hash calculation

2.9.0

• Update to node24
• Support running from within a nix shell
• Consider all installed toolchains for cache key
• Use case-insensitive comparison to determine exact cache hit

2.8.2

• Don't overwrite env for cargo-metadata call

2.8.1

• Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata
• Various dependency updates

2.8.0

• Add support for warpbuild cache provider
• Add new cache-workspace-crates feature

2.7.8

• Include CPU arch in the cache key

2.7.7

• Also cache cargo install metadata

2.7.6

• Allow opting out of caching $CARGO_HOME/bin
• Add runner OS in cache key
• Adds an option to do lookup-only of the cache

2.7.5

... (truncated)

Commits

• 6323deb 2.9.2
• b16e8d7 bump rollup and rebuild
• 3bf42ac invert target/profile check in cleanup
• 6e5b278 correctly sort and dedupe Rust versions
• 5adc05f Bump the actions group across 1 directory with 3 updates (#368)
• 66b1e95 fix: support Cargo V2 build dir layout (#371)
• 72d126e Merge pull request #367 from Swatinem/dependabot/npm_and_yarn/dev-patch-2b495...
• 48968d2 Bump the dev-patch group with 2 updates
• 9f151ac update dependencies, rebuild
• 0e24e5d Bump the actions group across 1 directory with 6 updates (#364)
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/actions/setup-rust from 18bed1ca49a6de3d8882bd72635a32ae3f023d57 to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

Updates astral-sh/setup-uv from 8.3.2 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/actions/generate-coverage from c3141c3d4cb2a2828d2abbcf3d94b15197740c58 to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/actions/upload-codescene-coverage from 4977418856133491c6aa7407d40668744df21818 to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/workflows/dependabot-automerge.yml from 18bed1ca49a6de3d8882bd72635a32ae3f023d57 to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

Updates actions/github-script from 8 to 9

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

• getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
• Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

• require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
• getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
• If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

• Add ACTIONS_ORCHESTRATION_ID to user-agent string by @​Copilot in actions/github-script#695
• ci: use deployment: false for integration test environments by @​salmanmkc in actions/github-script#712
• feat!: add getOctokit to script context, upgrade @​actions/github v9, @​octokit/core v7, and related packages by @​salmanmkc in actions/github-script#700

New Contributors

• @​Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

• 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
• ca10bbd fix: use @​octokit/core/types import for v7 compatibility
• 86e48e2 merge: incorporate main branch changes
• c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
• afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
• ff8117e ci: fix user-agent test to handle orchestration ID
• 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
• 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
• c17d55b ci: add getOctokit integration test job
• a047196 test: add getOctokit integration tests via callAsyncFunction
• Additional commits viewable in compare view

Updates leynos/shared-actions/.github/workflows/mutation-cargo.yml from dae5d4205c5b3b9f5ad37fddfc8d87276f7ea874 to f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4

Commits

• f4764be Add install-whitaker shared action (#361)
• a42afcf Build(deps): bump the github-actions group with 3 updates (#415)
• a197301 Add install-nixie shared action (#360)
• 57a33fa Build(deps): bump the github-actions group with 3 updates (#410)
• 7576833 chore: ignore agent tool and editor artefacts
• 1014f0c Build(deps): bump the github-actions group across 1 directory with 7 updates ...
• 8add2d9 Strip semver pre-release metadata when resolving MSI versions (#405) (#406)
• 2f90d10 Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#...
• 47b337e Add rustflags passthrough to setup-rust and rust-build-release (#391)
• 19a7f5d Group github-actions Dependabot updates into a single PR
• Additional commits viewable in compare view

[sourcery-ai]

Sorry @dependabot[bot], you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[leynos]

@dependabot recreate