ci: remove actions/setup-python in GHA

[browniebroke]

Committed via https://github.com/asottile/all-repos

Summary by Sourcery

Update GitHub workflows to use uv instead of actions/setup-python for Python tooling.

CI:

• Switch labels workflow to astral-sh/setup-uv and run labels via uvx using GH_PAT.
• Simplify CI workflow by relying on setup-uv for Python environments and adjusting uv sync invocation.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates GitHub Actions workflows to use astral-sh/setup-uv instead of actions/setup-python and adjusts how the labels tool is installed and invoked, simplifying Python environment management and aligning token usage with current secrets.

Flow diagram for updated GitHub Actions CI and labels workflows

flowchart TD
  subgraph labels_workflow
    L0[checkout]
    L1[setup-uv]
    L2[uvx labels sync]
    L0 --> L1 --> L2
  end

  subgraph ci_workflow
    C0[checkout]
    C1[setup-uv matrix python-version]
    C2[uv sync]
    C3[uv run pytest]
    C0 --> C1 --> C2 --> C3
  end

Loading

File-Level Changes

Change	Details	Files
Switch labels workflow from actions/setup-python and pip-installed labels to uv-based execution using setup-uv.	Remove explicit Python setup step that used actions/setup-python. Remove pip-based installation of the labels package in the workflow. Add astral-sh/setup-uv action to provision the uv-based Python environment. Change labels sync command to run via uvx and use the GH_PAT secret instead of GITHUB_TOKEN.	.github/workflows/labels.yml
Simplify CI workflow Python environment setup by replacing actions/setup-python with setup-uv and using uv sync without suppressing Python downloads.	Replace actions/setup-python with astral-sh/setup-uv while still passing the matrix python-version to configure the environment. Remove allow-prereleases flag previously passed to actions/setup-python. Remove redundant second setup-uv step so environment is set up only once. Change uv sync invocation to default behavior (removing --no-python-downloads) before running pytest.	.github/workflows/ci.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Switching from secrets.GITHUB_TOKEN to secrets.GH_PAT in the labels workflow will break runs on forks and any repo without that secret configured; consider falling back to GITHUB_TOKEN when GH_PAT is unset or documenting the requirement in the workflow.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Switching from `secrets.GITHUB_TOKEN` to `secrets.GH_PAT` in the labels workflow will break runs on forks and any repo without that secret configured; consider falling back to `GITHUB_TOKEN` when `GH_PAT` is unset or documenting the requirement in the workflow.

## Individual Comments

### Comment 1
<location path=".github/workflows/labels.yml" line_range="17" />
<code_context>
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       - name: Sync config with Github
-        run: labels -u ${{ github.repository_owner }} -t ${{ secrets.GITHUB_TOKEN }} sync -f .github/labels.toml
+        run: uvx labels -u ${{ github.repository_owner }} -t ${{ secrets.GH_PAT }} sync -f .github/labels.toml
</code_context>
<issue_to_address>
**🚨 question (security):** Switching from `GITHUB_TOKEN` to `GH_PAT` introduces an extra secret that needs careful scope management.

Using `secrets.GH_PAT` instead of `secrets.GITHUB_TOKEN` removes GitHub’s automatic scoping and rotation, so it’s important to ensure `GH_PAT` has only the minimal scopes needed for label syncing and that there’s a defined rotation/revocation process. If `GITHUB_TOKEN` can support these operations, preferring it would simplify and strengthen secret management.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

🚨 question (security): Switching from GITHUB_TOKEN to GH_PAT introduces an extra secret that needs careful scope management.

Using secrets.GH_PAT instead of secrets.GITHUB_TOKEN removes GitHub’s automatic scoping and rotation, so it’s important to ensure GH_PAT has only the minimal scopes needed for label syncing and that there’s a defined rotation/revocation process. If GITHUB_TOKEN can support these operations, preferring it would simplify and strengthen secret management.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.92%. Comparing base (cdb884c) to head (c0f9398).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1743   +/-   ##
=======================================
  Coverage   99.92%   99.92%           
=======================================
  Files          37       37           
  Lines        1333     1333           
  Branches       71       71           
=======================================
  Hits         1332     1332           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.