pyvyos.git/.github/workflows/python-pr-validation.yml, branch dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.2

Merge pull request #49 from vyos-contrib/dependabot/github_actions/actions/checkout-7.0.0

2026-07-26T13:55:50+00:00

Bump actions/checkout from 6.0.2 to 7.0.0

Merge pull request #47 from vyos-contrib/dependabot/github_actions/actions/setup-python-6.3.0

2026-07-26T13:55:37+00:00

Bump actions/setup-python from 6.2.0 to 6.3.0

Bump actions/checkout from 6.0.2 to 7.0.0

2026-07-01T12:48:53+00:00

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot]

Bump astral-sh/setup-uv from 8.1.0 to 8.2.0

2026-07-01T12:48:49+00:00

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...fac544c07dec837d0ccb6301d7b5580bf5edae39) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot]

Bump actions/setup-python from 6.2.0 to 6.3.0

2026-07-01T12:48:46+00:00

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot]

ci: pin actions by full commit SHA

2026-05-19T06:14:08+00:00

Per OpenSSF Scorecard 'Pinned-Dependencies' guidance, third-party GitHub Actions should be referenced by full commit SHA, not by tag. Tags are mutable; a SHA is not. Each pin keeps a '# vX.Y.Z' trailing comment so Dependabot can read the current version and propose updates while still pinning by SHA. - actions/checkout de0fac2 # v6.0.2 - actions/setup-python a309ff8 # v6.2.0 - astral-sh/setup-uv 0880764 # v8.1.0 - pypa/gh-action-pypi-publish cef2210 # v1.14.0 This commit does not change pyvyos HTTP payloads, request handling, or response parsing.

ci: pin setup-uv to v8.1.0 (no floating v8 tag yet)

2026-05-19T06:10:07+00:00

ci: bump actions off Node.js 20

2026-05-19T06:08:52+00:00

GitHub deprecation notice: Node.js 20 will be removed from runners in September 2026 and forced to Node 24 in June 2026. Pin to current majors that already run on Node 24. - actions/checkout@v4 -> v6 - actions/setup-python@v5 -> v6 - astral-sh/setup-uv@v3 -> v8 - pypa/gh-action-pypi-publish@v1.13.0 -> v1.14.0 - pre-commit/pre-commit-hooks@v5.0.0 -> v6.0.0 This commit does not change pyvyos HTTP payloads, request handling, or response parsing.

ci: pin uv cache key to pyproject.toml

2026-05-19T03:20:53+00:00

The matrix job in commit 7aa4989 left astral-sh/setup-uv@v3 with its default cache fingerprint of "**/uv.lock". This repo is a library and intentionally does not commit uv.lock (commit a2df706), so the glob matches nothing and the action errors out. Switch the fingerprint to pyproject.toml, the actual source of truth for dependencies. Cache hits remain across PRs that don't touch dependencies; cache invalidates on dependency changes.

build: tighten runtime deps and lower Python floor to 3.11

2026-05-19T03:06:11+00:00

- requires-python: >=3.13 -> >=3.11. The code does not use any 3.13-only feature. typing.List/Dict/Union/Optional throughout, no PEP 695 generics, no Self, no match. Classifiers updated to advertise 3.11/3.12/3.13. - runtime dependencies: trim to requests only. - python-dotenv is only used by examples; move to the dev extra. - urllib3 is never imported by pyvyos directly; it remains available transitively through requests. - pre-existing dev tooling (pytest, pytest-cov, pytest-env) untouched. - CI: PR validation runs on a 3.11/3.12/3.13 matrix. - README: reword the Python requirement. - .python-version: 3.13.0 -> 3.13 (CI uses the matrix). - Wheel build verified to include pyvyos/py.typed and to declare Requires-Python: >=3.11 with requests as the only runtime requirement.