chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/uv	uses-with	patch	0.12.13 → 0.12.15
chromaui/action	action	minor	v18.8.1 → v18.9.0

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.12.15

Compare Source

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
uv pip install --system in python:* docker images or when using uv pip install --target .. (#​21699)

Performance

• Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#​21675)

Bug fixes

• Revert "Reject symlinked wheel installation destinations" (#​21699)

v0.12.14

Compare Source

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. (#​17110, #​21599, #​21603)

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. (#​17110)

Enhancements

• Resume interrupted downloads with HTTP Range requests when supported (#​21570)
• Show underlying causes and hints in user warnings (#​21565)
• Show resolver hints for failed uv tool upgrade operations (#​21566)

Preview features

• Export multiple dependency selections from a shared lockfile in one uv export --batch invocation with the batch-export preview feature (#​21618)

Performance

• Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task (#​21619)
• Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers (#​21593)
• Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task (#​21621)

Bug fixes

• Select releases that satisfy required-environments within each resolver fork instead of combining incompatible wheel coverage across forks (#​21672)
• Install packages with paths longer than MAX_PATH on Windows systems without long-path support enabled (#​21625)
• Prevent uv python install from overwriting valid unmanaged Python symlinks with relative targets on Unix (#​21639)
• Redact credentials and signatures from missing-path-segment URL errors (#​21616)
• Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation (#​21640)
• Prefer bin/python over bin/python3 when discovering interpreters in Unix environments (#​21559)
• Suppress managed-Python fallback warnings under --quiet (#​21565)
• Keep failed uv tool upgrade errors visible with -q while suppressing them with -qq (#​21566)

chromaui/action (chromaui/action)

v18.9.0

Compare Source

🚀 Enhancement

• Always upload TurboSnap v2 hashes #​1490 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

---

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	02adaea
Status:	✅  Deploy successful!
Preview URL:	https://fa855a6f.mouseterm.pages.dev
Branch Preview URL:	https://renovate-github-actions.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on work in progress — not a merge verdict. Renovate can mark it ready when it wants the full review.

Both files this PR edits are tend-generated and carry Do not edit this file directly — it will be overwritten on regeneration in their header, and the version: pin is generator output, not a repo-owned value. Running the generator confirms it:

$ uvx tend@latest init   # resolves to tend 0.2.7, the version in the files' own header
$ grep 'version: "0' .github/workflows/tend-notifications.yaml
          version: "0.12.10"

Two consequences follow, and both have already started:

• The nightly regen reverts it. nightly_workflow_update.py prepare opens a PR whenever tend@latest init output differs from what's on main. main already carries 0.12.13 and astral-sh/setup-uv@v10.1.0 from #636; the generator emits 0.12.10 and @v10.0.1, so tonight's nightly is already set to propose reverting both. Merging this makes the revert 0.12.14 → 0.12.10 instead.
• workflow-audit reports the merge commit as unexplained. Its Renovate arm classifies out a commit "changing nothing but the ref of an already-referenced action" (docs/specs/security-ci.md → "Audit visibility"); is_renovate_pin_bump enforces that by requiring every changed line under .github/workflows/ to match uses:. These are with: input lines, so the arm returns 1, and the regen arm returns 1 too because the files no longer reproduce. The commit lands in the next daily issue — noise in the control that exists to make a real workflow edit stand out.

The durable fix is the one .github/renovate.json already applies to max-sixty/tend ("tend manages its own action version… don't let Renovate bump max-sixty/tend"): a packageRule disabling astral-sh/** under matchFileNames: [".github/workflows/tend-*.yaml"]. File-scoped matters — workflow-audit.yaml pins astral-sh/setup-uv by SHA on its own account, and that one should keep getting bumped. With it in place, github-actions bumps go back to being uses:-only diffs the audit classifier explains.

Happy to open that renovate.json PR if you want it; this one would then be closed rather than merged.

[dormouse-bot]

Feedback on work in progress — not a merge verdict.

The chromaui/action bump is clean: e10900ba92350acd7561744d2d86224c2a3fbb84 is the commit v18.9.0 dereferences to, and chromatic.yml is hand-owned, so that half is a normal uses:-only bump.

The two version: "0.12.15" lines are the problem, and since my earlier note on this branch the situation has a concrete resolution: #657 is open and edits the same two lines in the opposite direction — back to 0.12.10 / astral-sh/setup-uv@v10.0.1, the values tend 0.2.7's generator emits — and adds the matchFileNames: [".github/workflows/tend-*.yaml"] rule that stops Renovate touching generated output at all. Whichever of the two merges second hits a textual conflict on those exact lines.

So the sequencing decision is the only thing left here: land #657, and Renovate re-creates this PR carrying just the chromaui/action bump, which is the part that was always its to own.

Worth noting for whoever merges: if this one goes in first, its merge commit lands in the next daily audit issue as unexplained. is_renovate_pin_bump in .github/workflows/workflow-audit.yaml requires every changed line under .github/workflows/ to be a uses: line —

# Every changed line must be a `uses:` line.
if printf '%s\n' "$changed" | grep -qvE '^[+-][[:space:]]*(- )?uses:[[:space:]]'; then
  return 1
fi

— and version: is not one, so that arm returns 1. The is_tend_regen arm returns 1 too, because it refuses any commit touching a file outside tend-*.yaml and this one also changes chromatic.yml. Neither classifier explains it.

[nedtwigg]

Closing as superseded by #657. The generated tend workflows now reproduce from tend 0.2.7, and Renovate no longer manages dependencies inside .github/workflows/tend-*.yaml.