[dependabot]

Bumps the github-actions group with 2 updates in the / directory: astral-sh/setup-uv and lsst-sqre/docverse-upload.

Updates astral-sh/setup-uv from 10.3.0 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

• docs: update version references to v10.3.1 @github-actions[bot] (#1102)

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @​dannyward630 (#1093)

🧰 Maintenance

... (truncated)

Commits

• 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
• 0192b69 chore: update known checksums for 0.13.6 (#1117)
• 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
• 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
• 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
• 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
• 56618ca docs: update version references to v10.3.2 (#1104)
• 07a047e chore: update known checksums for 0.13.5 (#1103)
• e1b8536 docs: update version references to v10.3.1 (#1102)
• 18d369b chore(deps): roll up Dependabot updates (#1101)
• Additional commits viewable in compare view

Updates lsst-sqre/docverse-upload from 05c6698b00482673da2d1bcd93b367ebe74a98d0 to 174ec75d7bf704d2fdb4494b943d25a35706be30

Changelog

Sourced from lsst-sqre/docverse-upload's changelog.

Change log

1.0.0 (2026-10-20)

New features

• Initial release of lsst-sqre/docverse-upload, a native JavaScript (Node 24) GitHub Action that uploads a built documentation directory to Docverse. The action tars the directory, creates a build, uploads the tarball to the presigned URL, marks the build as uploaded, and then polls the build-processing job and each publish_edition job until the editions are live. Built against the Docverse 1.0.0b11 API; requires a Docverse server at 1.0.0b1 or later.
• Builds are annotated with GitHub Actions provenance automatically. The build's git_ref defaults to $GITHUB_HEAD_REF on pull_request events and $GITHUB_REF_NAME otherwise, which is what Docverse uses to scope PR-preview editions.
• Optionally posts (and updates in place) a pull request comment linking to the updated editions when a github-token with pull-requests: write is provided. On push events the comment goes to every open PR for the branch.
• completed_with_errors is treated as success with a warning annotation per failed edition; publish failures and timeouts also warn rather than failing the step. Gate downstream steps on job-status and publish-status for strict behavior.
• Inputs: org, project, dir, and token (required); base-url (default https://roundtable.lsst.cloud/docverse/api), git-ref, alternate-name, wait (default true), wait-for-publish (default true), wait-timeout (seconds, default 1800), github-token, and comment-on-pr (default true).
• Outputs: build-id, build-url, published-url (the primary updated edition: the one tracking the build's git_ref, else main, else first by slug), job-status, publish-status (published, failed, timed-out, or skipped), and editions-json (array of slug, title, kind, published_url, publish_status).

Commits

• 174ec75 Bump the dev-dependencies group with 4 updates (#48)
• ba4a9c8 Merge pull request #47 from lsst-sqre/tickets/DM-56095-release-workflow
• 01722ed Make scriv collect a prerequisite of releasing
• c099ff0 Bump vite from 8.3.1 to 8.3.3 (#45)
• 00f2c88 Merge pull request #44 from lsst-sqre/tickets/DM-56095-release
• 723cdd1 Write the 1.0.0 changelog entry
• 47d1b15 Merge pull request #43 from lsst-sqre/tickets/DM-56095-api-refresh
• ab644e7 Finalize action inputs and outputs before 1.0
• ec89abc Use the DOCVERSE_DEV_TOKEN secret name in the smoke test
• 3ebb37a Add end-to-end upload smoke test to CI
• Additional commits viewable in compare view

[jonathansick]

@dependabot rebase