diff --git a/python/README.md b/python/README.md index f9a4a18..c3335f3 100644 --- a/python/README.md +++ b/python/README.md @@ -158,19 +158,6 @@ GitHub rejects a pull request that asks for an unknown one. Set `dry_run: true` to log the branch and pull request the action would have created, without pushing or opening anything. -The upgrade skips releases published within the last 7 days, so a broken or -compromised release has time to be yanked before it can land in the lock file. -Change the cutoff with `exclude_newer`, which takes anything uv's -`--exclude-newer` accepts: a date, an RFC 3339 timestamp, a duration such as -`30 days`, or `false` to upgrade to the newest releases with no cutoff at all. -It reaches uv as `UV_EXCLUDE_NEWER`, so it overrides an `exclude-newer` the -repository sets in `pyproject.toml` or `uv.toml`. Pass `exclude_newer: ""` to -leave that setting in charge instead. - -```yaml - - uses: mongodb-labs/drivers-github-tools/python/uv-lock-update@v3 - with: - app_id: ${{ vars.APP_ID }} - private_key: ${{ secrets.APP_PRIVATE_KEY }} - exclude_newer: 14 days -``` +The action sets no resolution cutoff. A repo that wants to hold back newly +published packages configures `exclude-newer` in its own `pyproject.toml` or +`uv.toml`, exactly as for `python/setup`. diff --git a/python/uv-lock-update/action.yml b/python/uv-lock-update/action.yml index 435645a..72d7825 100644 --- a/python/uv-lock-update/action.yml +++ b/python/uv-lock-update/action.yml @@ -21,13 +21,6 @@ inputs: dry_run: description: If 'true', report intended actions without pushing or modifying pull requests default: "false" - exclude_newer: - description: >- - Cutoff passed to uv as UV_EXCLUDE_NEWER, so the upgrade ignores releases - published after it. Accepts anything uv's --exclude-newer does: a date, an - RFC 3339 timestamp, a duration such as '30 days', or 'false' to disable the - cutoff. Pass "" to leave the cutoff to the project's own uv configuration. - default: 7 days runs: using: composite @@ -64,17 +57,7 @@ runs: - name: Upgrade the lock file shell: bash - env: - EXCLUDE_NEWER: ${{ inputs.exclude_newer }} run: | - # uv rejects an empty UV_EXCLUDE_NEWER, so an empty input unsets it - # rather than passing "" through. Unsetting also drops any the caller - # exported, so this input alone decides the cutoff. - if [ -n "$EXCLUDE_NEWER" ]; then - export UV_EXCLUDE_NEWER="$EXCLUDE_NEWER" - else - unset UV_EXCLUDE_NEWER - fi uv lock --upgrade - name: Commit and summarize the upgrade