gateway: add astral-sh/setup-uv

[junrushao]

Request for adding a new GitHub Action to the allow list

Overview

Add astral-sh/setup-uv, the official action to install and cache the uv Python package/project manager, to the org-wide allow list. uv provides fast, reproducible Python environment management, lockfiles, and a pip-compatible interface and can also install Python itself; the action installs uv on the runner and (optionally) persists uv’s cache to speed up subsequent runs. This is broadly useful for ASF projects with Python components (builds, tests, docs).

Name of action: astral-sh/setup-uv

URL of action: https://github.com/astral-sh/setup-uv

Version to pin to (hash only): b75a909f75acd358c2196fb9a5f1299a9a8868a4

Permissions

The action downloads uv release artifacts from the astral-sh/uv GitHub Releases API and adds the binary to PATH. No repository write operations are performed by the action itself.

Related Actions

• actions/setup-python (already allowed via actions/*) installs Python versions and integrates with runner caches. astral-sh/setup-uv is complementary: it installs uv (and uv can then install Python and manage environments), adds optional uv cache persistence, and supports lockfile-driven workflows for determinism and speed.

Checklist

You should be able to check most of these boxes for an action to be considered for review.
Please check all boxes that currently apply:

• The action is listed in the GitHub Actions Marketplace
• The action is not already on the list of approved actions
• The action has a sufficient number of contributors or has contributors within the ASF community
• The action has a clearly defined license (MIT license in repo)
• The action is actively developed or maintained (recent releases incl. v6.7.0 on 2025-09-14)
• The action has CI/unit tests configured (repo shows CI workflows incl. test)

[dave2wave]

Please note that the tooling team is making use of this in one of our sample workflows here: https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-dists.yaml#L44-L45

[raboof]

• please allow a specific hash instead of a wildcard and add a tag field
• please remove keep (#252)
• it would be nice to keep the order somewhat alphabetical, though that might be something for later (#203)

[junrushao]

@raboof Thanks for responding to the request! I've updated the PR accordingly and please review again.