chore(deps): bump the actions group across 1 directory with 2 updates

[dependabot]

Bumps the actions group with 2 updates in the / directory: astral-sh/setup-uv and actions/attest-build-provenance.

Updates astral-sh/setup-uv from 3 to 4

Release notes

Sourced from astral-sh/setup-uv's releases.

v4.0.0 🌈 Fail when cache local path does not exist when trying to cache

🚨 Breaking change 🚨

By default, the action will now fail if caching is enabled but there is nothing to upload (the uv cache directory does not exist). If you want to ignore this, set the ignore-nothing-to-cache input to true.

- name: Ignore nothing to cache
  uses: astral-sh/setup-uv@v3
  with:
    enable-cache: true
    ignore-nothing-to-cache: true

---

In previous releases only an error got logged when saving the cache failed. In most cases users did not realize something was wrong with their config.

Changes

🚨 Breaking changes

• Fail when cache local path does not exist when trying to cache @​eifinger (#163)

🐛 Bug fixes

• Fail when cache local path does not exist when trying to cache @​eifinger (#163)
• Remove working dir from cacheDependencyGlob error message @​eifinger (#162)

📚 Documentation

• Change some formulations in README.md @​eifinger (#164)
• Add comment to clarify process.exit(0) @​eifinger (#161)

v3.2.4 🌈 Expand ~ tilde in input paths

This release adds support for expanding the ~ character to the user's home directory for the following inputs:

• cache-local-path
• tool-dir
• tool-bin-dir
• cache-dependency-glob

- name: Expand the tilde character
  uses: astral-sh/setup-uv@v3
  with:
    cache-local-path: "~/path/to/cache"
</tr></table> 

... (truncated)

Commits

• 38f3f10 Resolve latest version instead of downloading latest release (#178)
• 8bdd012 Add test for python-version (#177)
• 5f42d5a Replace v3 with v4 in README.md (#176)
• 26ddfef Add matrix example for python-version (#175)
• ee4fa33 Add input python-version (#174)
• 4209155 Reduce test matrices (#173)
• 9839fa9 chore: update known checksums for 0.5.5 (#170)
• 196fe5f Speed up updating known checksums (#166)
• 49d8a3d Clarify caching will only fail when enabled and nothing to cache (#165)
• d8db0a8 Change some formulations in README.md (#164)
• Additional commits viewable in compare view

Updates actions/attest-build-provenance from 1.4.4 to 2.0.1

Release notes

Sourced from actions/attest-build-provenance's releases.

v2.0.1

What's Changed

• Bump actions/attest from 2.0.0 to 2.0.1 by @​bdehamer in actions/attest-build-provenance#406
  • Deduplicate subjects before adding to in-toto statement

Full Changelog: actions/attest-build-provenance@v2.0.0...v2.0.1

v2.0.0

The attest-build-provenance action now supports attesting multiple subjects simultaneously. When identifying multiple subjects with the subject-path input a single attestation is created with references to each of the supplied subjects, rather than generating separate attestations for each artifact. This reduces the number of attestations that you need to create and manage.

What's Changed

• Bump cross-spawn from 7.0.3 to 7.0.6 by @​dependabot in actions/attest-build-provenance#319
• Prepare v2.0.0 release by @​bdehamer in actions/attest-build-provenance#321
  • Bump actions/attest from 1.4.1 to 2.0.0 (w/ multi-subject attestation support)

Full Changelog: actions/attest-build-provenance@v1.4.4...v2.0.0

Commits

• c4fbc64 bump actions/attest from 2.0.0 to 2.0.1 (#406)
• 619dbb2 bump actions/attest to v2.0.0 (#321)
• 90d4930 Bump the npm-development group with 3 updates (#329)
• fb315c1 Bump the npm-development group with 5 updates (#323)
• a379071 Bump cross-spawn from 7.0.3 to 7.0.6 (#319)
• dada0c3 Bump the npm-development group across 1 directory with 5 updates (#317)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Superseded by #1351.