chore(deps): update astral-sh/setup-uv action to v7.2.0

[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/setup-uv	action	minor	v7.1.6 → v7.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v7.2.0: 🌈 add outputs python-version and python-cache-hit

Compare Source

Changes

Among some minor typo fixes and quality of life features for developers of actions the main feature of this release are new outputs:

• python-version: The Python version that was set (same content as existing UV_PYTHON)
• python-cache-hit: A boolean value to indicate the Python cache entry was found

While implementing this it became clear, that it is easier to handle the Python binaries in a separate cache entry. The added benefit for users is that the "normal" cache containing the dependencies can be used in all runs no matter if these cache the Python binaries or not.

[!NOTE]
This release will invalidate caches that contain the Python binaries. This happens a single time.

🐛 Bug fixes

• chore: remove stray space from UV_PYTHON_INSTALL_DIR message @​akx (#​720)

🚀 Enhancements

• add outputs python-version and python-cache-hit @​eifinger (#​728)
• Add action typings with validation @​krzema12 (#​721)

🧰 Maintenance

• fix: use uv_build backend for old-python-constraint-project @​eifinger (#​729)
• chore: update known checksums for 0.9.22 @​github-actions[bot] (#​727)
• chore: update known checksums for 0.9.21 @​github-actions[bot] (#​726)
• chore: update known checksums for 0.9.20 @​github-actions[bot] (#​725)
• chore: update known checksums for 0.9.18 @​github-actions[bot] (#​718)

⬆️ Dependency updates

• Bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 @​dependabot[bot] (#​719)
• Bump github/codeql-action from 4.31.6 to 4.31.9 @​dependabot[bot] (#​723)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[claude]

Pull Request Review

Summary

This PR updates astral-sh/setup-uv from v7.1.6 to v7.2.0 across three GitHub Actions workflows. This is a standard dependency update from Renovate Bot.

Review

✅ Positive Aspects

1. Pinned SHA Commits: The PR correctly uses commit SHAs (61cb8a9741eeb8a550a1b8544337180c0fc8476b) instead of floating tags, which follows security best practices for GitHub Actions.

2. Consistent Updates: All three workflow files are updated consistently:

   • .github/workflows/rag-evaluation.yml
   • .github/workflows/release.yml
   • .github/workflows/test.yml

3. Minor Version Update: This is a minor version bump (7.1.6 → 7.2.0) which should be low risk.

📋 Changes in v7.2.0

According to the release notes:

New Features:

• Adds new outputs: python-version and python-cache-hit
• Separates Python binaries into a dedicated cache entry for better cache reuse

Important Note:

• One-time cache invalidation: Existing caches containing Python binaries will be invalidated on first run with v7.2.0. This is expected and will only happen once.

⚠️ Considerations

1. CI Performance Impact: The first CI run after merging will miss the cache and take longer due to the one-time cache invalidation. Subsequent runs should be faster with the improved caching strategy.

2. No Breaking Changes: This is a backward-compatible update. The workflows don't need modification to use the new features (the new outputs are optional).

3. Testing: The update affects all CI workflows including the main test suite. Monitor the first few CI runs after merge to ensure the new caching behavior works as expected.

🔍 Security & Quality

• ✅ No security vulnerabilities introduced
• ✅ No code changes to the application itself
• ✅ Renovate Bot properly maintains SHA pinning
• ✅ Release is from the official astral-sh organization

Recommendation

APPROVE - This is a safe dependency update that improves the GitHub Actions workflow with better caching and new optional outputs. The one-time cache invalidation is expected and acceptable.

Post-Merge Action Items

1. Monitor the first CI run after merge for successful cache recreation
2. Consider using the new python-cache-hit output in future workflow optimizations if needed

---

Review generated following repository conventions from CLAUDE.md