CI: checkout, setup-python, setup-uv, codecov

[ChristianGeng]

Summary

Two related CI bugs, both caused by stale GitHub Action version pins:

1. Dead uv caching: astral-sh/setup-uv's default cache-dependency-glob
   keys on uv.lock / requirements*.txt, neither of which exists in this
   repo (no committed lockfile, by design — it tests against latest
   resolvable deps). Caching has therefore silently never worked.

   This repo's setup-uv pin was the floating tag v5. Bumped to v9.0.0:
   v6.0.0 added pyproject.toml to the default glob, which is committed
   and changes exactly when a dependency does, so caching now works with no
   lockfile needed. v7.0.0 also carries the Node 20 → Node 24 runtime
   bump.

2. Node.js 20 deprecation: actions/checkout@v4 and
   actions/setup-python@v5 still target the deprecated Node 20 runtime.
   Bumped both to v7. codecov/codecov-action@v4 also bumped to v7;
   its v5 rewrite dropped the singular file: input in favor of files:
   (plural) — renamed accordingly in test.yml so the coverage upload
   doesn't silently no-op. No actions/cache usage exists in this repo's
   workflows.

prune-cache left at its new default (off): audmath's only runtime
dependency is numpy, with no large pre-built binary wheels like torch, so
pruning would save ~0 disk space while costing avoidable re-downloads.

Test plan

• All four changed workflow YAML files validated with
  uv run --isolated --with pyyaml python3 -c "import yaml; yaml.safe_load(open('FILE'))"
• CI passes on this PR (checkout/setup-python/setup-uv/codecov-action
  bumps exercised across the full test matrix)

Part of the same CI cleanup as audeering/audeer#206,
audeering/opensmile-python#132, audeering/audb#591,
audeering/audformat#539, audeering/audbackend#307,
audeering/audresample#83, audeering/auglib#60, audeering/audonnx#115,
audeering/audinterface#206, and audeering/audiofile#193.

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This pull request modernizes the CI workflows by bumping all pinned GitHub Actions to current Node 24–compatible versions and fixing uv and Codecov configuration so dependency caching and coverage uploads actually work across all workflows.

Flow diagram for updated CI workflow actions and caching

flowchart TD
    GH[GitHub Actions runner]

    GH --> Ck["actions/checkout@v7"]
    Ck --> Py["actions/setup-python@v7"]
    Py --> Uv["astral-sh/setup-uv@v9.0.0"]
    Uv -->|uses pyproject.toml for cache-dependency-glob| UCache[Dependency cache]
    Uv --> Tests[Run tests/docs/lint]
    Tests --> Cov["codecov/codecov-action@v7"]
    Cov -->|files input| Codecov[Codecov service]

Loading

File-Level Changes

Change	Details	Files
Update core GitHub Actions (checkout, setup-python) to Node 24–compatible versions across all workflows.	Bumped actions/checkout from v4 to v7 in test, doc, linter, and publish workflows. Bumped actions/setup-python from v5 to v7 in all workflows, ensuring the same matrix or fixed Python versions as before are used.	.github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml .github/workflows/publish.yml
Fix uv environment caching and runtime by upgrading setup-uv to a version that keys on pyproject.toml and runs on Node 24.	Bumped astral-sh/setup-uv from floating tag v5 to fixed version v9.0.0 in all workflows. Relies on setup-uv’s newer default cache-dependency-glob that includes pyproject.toml so caches are now populated without a lockfile. Keeps prune-cache at its default (off), matching the project’s small binary footprint.	.github/workflows/test.yml .github/workflows/doc.yml .github/workflows/linter.yml .github/workflows/publish.yml
Update Codecov action and configuration so coverage uploads work with the new major version.	Bumped codecov/codecov-action from v4 to v7 in the test workflow. Renamed the Codecov input from file to files to match the new action API while still uploading ./coverage.xml. Kept upload conditional on ubuntu-latest matrix to preserve existing behavior.	.github/workflows/test.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• To make the uv caching behavior more future-proof, consider explicitly setting cache-dependency-glob to include pyproject.toml rather than relying on the setup-uv default, so a future default change doesn’t silently disable caching again.
• In publish.yml you still use actions/setup-node@v4 (with node-version: '16.0'), so it might be worth checking whether you also want to bump that action to the latest major to align with the Node 24 runtime migration done for checkout/setup-python.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- To make the uv caching behavior more future-proof, consider explicitly setting `cache-dependency-glob` to include `pyproject.toml` rather than relying on the `setup-uv` default, so a future default change doesn’t silently disable caching again.
- In `publish.yml` you still use `actions/setup-node@v4` (with `node-version: '16.0'`), so it might be worth checking whether you also want to bump that action to the latest major to align with the Node 24 runtime migration done for checkout/setup-python.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[ChristianGeng]

Re: making cache-dependency-glob explicit — relying on setup-uv's documented default (includes pyproject.toml as of v6.0.0) is intentional, for consistency across this whole rollout (audeer#206, opensmile-python#132, audb#591, audformat#539, audbackend#307, audresample#83, auglib#60, audonnx#115, audinterface#206, audiofile#193). Leaving as-is.