chore(deps): update astral-sh/setup-uv action to v10.1.0

[hermes-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/setup-uv	action	minor	v10.0.1 → v10.1.0	v10.2.0

---

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#​1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#​1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#​1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#​1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @​github-actions[bot] (#​1041)
• chore: update known checksums for 0.12.10/0.12.11 @​github-actions[bot] (#​1038)
• chore: update known checksums for 0.12.9 @​github-actions[bot] (#​1035)
• chore: update known checksums for 0.12.7/0.12.8 @​github-actions[bot] (#​1031)
• chore: update known checksums for 0.12.6 @​github-actions[bot] (#​1030)
• chore: update known checksums for 0.12.5 @​github-actions[bot] (#​1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @​woodruffw (#​1024)
• Pin one-shot tools @​woodruffw (#​1022)
• ci: remove obsolete direct push attempts @​eifinger (#​1019)

📚 Documentation

• docs: update version references to v10.0.1 @​github-actions[bot] (#​1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @​eifinger (#​1043)
• Harden npm install defaults @​zaniebot (#​1026)
• Add dependency cooldowns @​woodruffw (#​1021)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: redhat-et/ProtoBot/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: c03ae8e2-de78-4700-b97c-b7268510504b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-retro]

PR #156 was a trivial, pinned-SHA Renovate bump of astral-sh/setup-uv (v10.0.1 → v10.1.0), approved with no comments by a human (JohnStrunk) after CI passed, then merged. No fullsend triage, code, or review agent ever engaged with this PR — the repo's .github/workflows/fullsend.yaml intentionally excludes renovate/* branches from those stages on open/sync/ready-for-review (per tracked upstream work fullsend-ai/fullsend#1985, #1986), while deliberately still running the retro stage on PR close. That design choice is working as configured, so there is no agent-review-quality or rework-rate finding here to report.

What this run does add is concrete, fresh evidence for two already-open upstream issues. This retro is 1 of 6 near-simultaneous retro dispatches: PRs #154, #155, #156, #157, #158, and #159 (all Renovate dependency/action bumps) were approved and merged by the same human within roughly a 5-minute window (14:02–14:07 UTC on 2026-09-21), and each merge independently spun up a full retro agent run (GCP setup, token minting, checkout, model invocation) to analyze what is effectively the same trivial change six times over. This directly corroborates fullsend-ai/fullsend#6153 and #6154 (debounce/burst-detect retro dispatch for mass PR closures by the same actor) — notably, the original version of this idea, #4256, was closed 2026-07-16, yet the exact failure mode it described is still reproducing here two months later, suggesting either the fix didn't fully land or wasn't rolled out to this repo's dispatch config. It also corroborates fullsend-ai/fullsend#5360 (skip/cheapen review and retro for bot-authored dependency PRs with zero other agent involvement), which is itself one of 25+ overlapping open issues on this theme per the consolidation meta-issue fullsend-ai/fullsend#5817.

No new proposal is filed here — the backlog on this exact topic is already saturated (see #6153, #6154, #5360, #5817), and adding another instance would compound the sprawl #5817 is explicitly trying to fix. Maintainers may want to prioritize #5817's consolidation and re-verify whether #6153/#6154's proposed debounce design has actually shipped to per-repo installations like this one, since the 2026-07-16 closure of #4256 did not prevent recurrence.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 2:05 PM UTC · Completed 2:10 PM UTC

Commit: 7ba2d19 · View workflow run →

Runtime: claude · Model: sonnet → claude-sonnet-5 · Effort: high · Cost: $0.84