Bump the github-actions-updates group with 2 updates

.github/SECURITY.md

@@ -3,6 +3,7 @@
 
 <!-- START doctoc generated TOC please keep comment here to allow auto update -->
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 
 - [Apache Airflow Security](#apache-airflow-security)
   - [What should be and should NOT be reported ?](#what-should-be-and-should-not-be-reported-)

.github/actions/breeze/action.yml

@@ -22,9 +22,6 @@ inputs:
   python-version:
     description: 'Python version to use'
     default: "3.10"
-  uv-version:
-    description: 'uv version to use'
-    default: "0.11.3"  # Keep this comment to allow automatic replacement of uv version
 outputs:
   host-python-version:
     description: Python version used in host
@@ -38,9 +35,16 @@ runs:
         python-version: ${{ inputs.python-version }}
     - name: "Install uv"
       shell: bash
-      run: pip install "uv==${UV_VERSION}"
-      env:
-        UV_VERSION: ${{ inputs.uv-version }}
+      # Extract uv version from uv.lock. The format is stable: the line
+      # immediately after `name = "uv"` is `version = "<X.Y.Z>"`.
+      run: |
+        UV_VERSION=$(sed -n '/^name = "uv"$/{n;s/^version = "\(.*\)"$/\1/p;}' uv.lock)
+        if [[ -z "${UV_VERSION}" ]]; then
+          echo "Failed to extract uv version from uv.lock" >&2
+          exit 1
+        fi
+        echo "Installing uv==${UV_VERSION}"
+        pip install "uv==${UV_VERSION}"
     # NOTE! Installing Breeze without using cache is FASTER than when using cache - uv is so fast and has
     # so low overhead, that just running upload cache/restore cache is slower than installing it from scratch
     - name: "Install Breeze"

.github/actions/install-prek/action.yml

@@ -22,12 +22,6 @@ inputs:
   python-version:
     description: 'Python version to use'
     default: "3.10"
-  uv-version:
-    description: 'uv version to use'
-    default: "0.11.3"  # Keep this comment to allow automatic replacement of uv version
-  prek-version:
-    description: 'prek version to use'
-    default: "0.3.8"  # Keep this comment to allow automatic replacement of prek version
   save-cache:
     description: "Whether to save prek cache"
     required: true
@@ -37,16 +31,31 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: "Extract uv and prek versions from uv.lock"
+      id: versions
+      shell: bash
+      # The uv.lock format is stable: the line immediately after `name = "<pkg>"`
+      # is `version = "<X.Y.Z>"` for that package.
+      run: |
+        UV_VERSION=$(sed -n '/^name = "uv"$/{n;s/^version = "\(.*\)"$/\1/p;}' uv.lock)
+        PREK_VERSION=$(sed -n '/^name = "prek"$/{n;s/^version = "\(.*\)"$/\1/p;}' uv.lock)
+        if [[ -z "${UV_VERSION}" || -z "${PREK_VERSION}" ]]; then
+          echo "Failed to extract uv (${UV_VERSION}) or prek (${PREK_VERSION}) version from uv.lock" >&2
+          exit 1
+        fi
+        echo "Extracted uv==${UV_VERSION}, prek==${PREK_VERSION}"
+        echo "uv-version=${UV_VERSION}" >> "${GITHUB_OUTPUT}"
+        echo "prek-version=${PREK_VERSION}" >> "${GITHUB_OUTPUT}"
     - name: "Install uv"
       shell: bash
       run: pip install "uv==${UV_VERSION}"
       env:
-        UV_VERSION: ${{ inputs.uv-version }}
+        UV_VERSION: ${{ steps.versions.outputs.uv-version }}
     - name: Install prek
       shell: bash
       env:
-        PREK_VERSION: ${{inputs.prek-version}}
-        UV_VERSION: ${{ inputs.uv-version }}
+        UV_VERSION: ${{ steps.versions.outputs.uv-version }}
+        PREK_VERSION: ${{ steps.versions.outputs.prek-version }}
       run: |
         uv tool install prek==${PREK_VERSION} --with uv==${UV_VERSION}
       working-directory: ${{ github.workspace }}
@@ -64,7 +73,7 @@ runs:
       uses: apache/infrastructure-actions/stash/restore@1c35b5ccf8fba5d4c3fdf25a045ca91aa0cbc468
       with:
         # yamllint disable rule:line-length
-        key: cache-prek-v9-${{ inputs.platform }}-python${{ inputs.python-version }}-uv${{ inputs.uv-version }}-${{ hashFiles('**/.pre-commit-config.yaml') }}
+        key: cache-prek-v9-${{ inputs.platform }}-python${{ inputs.python-version }}-uv${{ steps.versions.outputs.uv-version }}-${{ hashFiles('**/.pre-commit-config.yaml') }}
         path: /tmp/
       id: restore-prek-cache
     - name: "Restore .cache from the tar file"
@@ -113,7 +122,7 @@ runs:
       uses: apache/infrastructure-actions/stash/save@1c35b5ccf8fba5d4c3fdf25a045ca91aa0cbc468
       with:
         # yamllint disable rule:line-length
-        key: cache-prek-v9-${{ inputs.platform }}-python${{ inputs.python-version }}-uv${{ inputs.uv-version }}-${{ hashFiles('**/.pre-commit-config.yaml') }}
+        key: cache-prek-v9-${{ inputs.platform }}-python${{ inputs.python-version }}-uv${{ steps.versions.outputs.uv-version }}-${{ hashFiles('**/.pre-commit-config.yaml') }}
         path: /tmp/cache-prek.tar.gz
         if-no-files-found: 'error'
         retention-days: '2'

.github/skills/airflow-translations/locales/pl.md

@@ -147,6 +147,25 @@ Preserve all `{{variable}}` placeholders. Adjust word order for natural Polish:
 "title": "Usuń {{liczba}} połączeń"  // variable name translated
 ```
 
+## Terminology Glossary
+
+Preferred wording for specific UI terms. Apply these to new translations and
+prefer them when reviewing existing ones.
+
+| English / context | Preferred Polish | Avoid |
+|---|---|---|
+| Consuming Asset (asset consumed by a Dag run) | **Zabierający zasób** | ~~Konsumujący zasób~~ |
+| Bulk clear / delete / update (toaster and button labels) | **grupowy / grupowego / grupowej / grupowe …** | ~~masowy / masowego / masowej / masowe~~ |
+| Deactivated (Dag header status) | **Deaktywowany** / Deaktywowana / Deaktywowane | ~~Dezaktywowany~~ |
+
+Notes:
+
+- For "bulk <verb>" always use "grupowy" with the grammatical form that
+  matches the noun — e.g. "żądanie grupowego wyczyszczenia", "żądanie
+  grupowej aktualizacji". Never use "masowy".
+- "Deactivated" / "Deaktywowany" must agree in gender with the noun it
+  describes (e.g. neuter "zadanie" → "Deaktywowane").
+
 ## Terminology Reference
 
 The established Polish translations are defined in the existing locale files.

.github/workflows/airflow-e2e-tests.yml

@@ -123,7 +123,7 @@ jobs:
           cd ./airflow-e2e-tests && zip -r logs.zip logs
         if: always()
       - name: "Upload logs"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: "e2e-test-logs-${{ inputs.e2e_test_mode }}"
           path: './airflow-e2e-tests/logs.zip'

.github/workflows/automatic-backport.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Find PR information
         id: pr-info
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/basic-tests.yml

@@ -72,10 +72,6 @@ on:  # yamllint disable-line rule:truthy
         description: "Whether to use uv in the image"
         required: true
         type: string
-      uv-version:
-        description: 'uv version to use'
-        default: "0.11.3"  # Keep this comment to allow automatic replacement of uv version
-        type: string
       platform:
         description: 'Platform for the build - linux/amd64 or linux/arm64'
         required: true
@@ -143,9 +139,16 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
       - name: "Install uv"
-        run: pip install "uv==${UV_VERSION}"
-        env:
-          UV_VERSION: ${{ inputs.uv-version }}
+        # Extract uv version from uv.lock. The format is stable: the line
+        # immediately after `name = "uv"` is `version = "<X.Y.Z>"`.
+        run: |
+          UV_VERSION=$(sed -n '/^name = "uv"$/{n;s/^version = "\(.*\)"$/\1/p;}' uv.lock)
+          if [[ -z "${UV_VERSION}" ]]; then
+            echo "Failed to extract uv version from uv.lock" >&2
+            exit 1
+          fi
+          echo "Installing uv==${UV_VERSION}"
+          pip install "uv==${UV_VERSION}"
       - name: "Run shared ${{ matrix.shared-distribution }} tests"
         run: uv run --group dev pytest --color=yes -n auto
         working-directory: shared/${{ matrix.shared-distribution }}
@@ -161,9 +164,16 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
       - name: "Install uv"
-        run: pip install "uv==${UV_VERSION}"
-        env:
-          UV_VERSION: ${{ inputs.uv-version }}
+        # Extract uv version from uv.lock. The format is stable: the line
+        # immediately after `name = "uv"` is `version = "<X.Y.Z>"`.
+        run: |
+          UV_VERSION=$(sed -n '/^name = "uv"$/{n;s/^version = "\(.*\)"$/\1/p;}' uv.lock)
+          if [[ -z "${UV_VERSION}" ]]; then
+            echo "Failed to extract uv version from uv.lock" >&2
+            exit 1
+          fi
+          echo "Installing uv==${UV_VERSION}"
+          pip install "uv==${UV_VERSION}"
       - name: "Run scripts tests"
         run: uv run --project . pytest --color=yes -n auto
         working-directory: ./scripts/
@@ -182,7 +192,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320  # v5.0.0
+        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb  # v6.0.0
         with:
           version: 9
           run_install: false
@@ -301,89 +311,6 @@ jobs:
           fetch-depth: 2
           persist-credentials: false
 
-  upgrade-check:
-    timeout-minutes: 45
-    name: "Upgrade checks"
-    runs-on: ${{ fromJSON(inputs.runners) }}
-    env:
-      PYTHON_MAJOR_MINOR_VERSION: "${{ inputs.default-python-version }}"
-    if: inputs.canary-run == 'true'
-    steps:
-      - name: "Cleanup repo"
-        shell: bash
-        run: docker run -v "${GITHUB_WORKSPACE}:/workspace" -u 0:0 bash -c "rm -rf /workspace/*"
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          persist-credentials: false
-      - name: "Install Breeze"
-        uses: ./.github/actions/breeze
-        id: breeze
-      - name: "Install prek"
-        uses: ./.github/actions/install-prek
-        id: prek
-        with:
-          python-version: ${{ steps.breeze.outputs.host-python-version }}
-          platform: ${{ inputs.platform }}
-          save-cache: false
-      - name: "Autoupdate all prek hooks"
-        run: prek autoupdate --cooldown-days 4 --freeze
-      - name: "Check if there are any changes in prek hooks"
-        run: |
-          if ! git diff --exit-code; then
-            echo -e "\n\033[0;31mThere are changes in prek hooks after upgrade check.\033[0m"
-            echo -e "\n\033[0;33mHow to fix:\033[0m Run \`breeze ci upgrade\` locally to fix it!.\n"
-            exit 1
-          fi
-      - name: "Run automated upgrade for chart dependencies"
-        run: >
-          prek
-          --all-files --show-diff-on-failure --color always --verbose
-          --stage manual
-          update-chart-dependencies
-        if: always()
-      # For UV we are not failing the upgrade installers check if it is updated because
-      # it is upgraded very frequently, so we want to manually upgrade it rather than
-      # get notified about it - until it stabilizes in 1.* version
-      - name: "Run automated upgrade for uv,  prek (not failing - just informational)"
-        run: >
-          prek
-          --all-files --show-diff-on-failure --color always --verbose
-          --stage manual upgrade-important-versions || true
-        if: always()
-        env:
-          UPGRADE_FLIT: "false"
-          UPGRADE_GITPYTHON: "false"
-          UPGRADE_GOLANG: "false"
-          UPGRADE_HATCH: "false"
-          UPGRADE_HATCHLING: "false"
-          UPGRADE_MYPY: "false"
-          UPGRADE_NODE_LTS: "false"
-          UPGRADE_PIP: "false"
-          UPGRADE_PYTHON: "false"
-          UPGRADE_PYYAML: "false"
-          UPGRADE_RICH: "false"
-          UPGRADE_RUFF: "false"
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: "Run automated upgrade for important versions minus uv (failing if needed)"
-        run: |
-          if ! prek \
-            --all-files --show-diff-on-failure --color always --verbose \
-            --stage manual upgrade-important-versions; then
-              echo -e "\n\033[0;31mThere are changes in prek hooks after upgrade check.\033[0m"
-              echo -e "\n\033[0;33mHow to fix:\033[0m Run \`breeze ci upgrade\` locally to fix it!.\n"
-              exit 1
-          fi
-        if: always()
-        env:
-          UPGRADE_UV: "false"
-          UPGRADE_PREK: "false"
-          UPGRADE_MPROCS: "false"
-          UPGRADE_PROTOC: "false"
-          UPGRADE_OPENAPI_GENERATOR: "false"
-          UPGRADE_COOLDOWN_DAYS: "4"
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   test-airflow-release-commands:
     timeout-minutes: 80
     name: "Test Airflow release commands"
@@ -451,9 +378,16 @@ jobs:
         with:
           persist-credentials: false
       - name: "Install uv"
-        run: pip install "uv==${UV_VERSION}"
-        env:
-          UV_VERSION: ${{ inputs.uv-version }}
+        # Extract uv version from uv.lock. The format is stable: the line
+        # immediately after `name = "uv"` is `version = "<X.Y.Z>"`.
+        run: |
+          UV_VERSION=$(sed -n '/^name = "uv"$/{n;s/^version = "\(.*\)"$/\1/p;}' uv.lock)
+          if [[ -z "${UV_VERSION}" ]]; then
+            echo "Failed to extract uv version from uv.lock" >&2
+            exit 1
+          fi
+          echo "Installing uv==${UV_VERSION}"
+          pip install "uv==${UV_VERSION}"
       - name: "Set up Airflow home directory"
         run: |
           echo "Setting AIRFLOW_HOME to $AIRFLOW_HOME"

.github/workflows/check-newsfragment-pr-number.yml

@@ -21,7 +21,7 @@ on:  # yamllint disable-line rule:truthy
   pull_request:
     branches:
       - main
-    types: [opened, reopened, synchronize, labeled, unlabeled]
+    types: [opened, reopened, synchronize]
 
 permissions:
   contents: read

.github/workflows/ci-amd-arm.yml

@@ -40,7 +40,6 @@ env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GITHUB_USERNAME: ${{ github.actor }}
   SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-  UV_VERSION: "0.11.3"  # Keep this comment to allow automatic replacement of uv version
   VERBOSE: "true"
 
 concurrency:
@@ -213,23 +212,6 @@ jobs:
       platform: ${{ needs.build-info.outputs.platform }}
       shared-distributions-as-json: ${{needs.build-info.outputs.shared-distributions-as-json}}
 
-  verify-release-calendar:
-    name: "Verify release calendar"
-    runs-on: ${{ fromJSON(needs.build-info.outputs.runner-type) }}
-    needs: [build-info]
-    # Only run on canary builds (push to main, scheduled runs, or manual dispatch)
-    if: needs.build-info.outputs.canary-run == 'true'
-    timeout-minutes: 10
-    steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          persist-credentials: false
-      - name: "Install uv"
-        run: pip install "uv==${UV_VERSION}"
-      - name: "Verify release calendar"
-        run: uv run dev/verify_release_calendar.py
-
   build-ci-images:
     name: Build CI images
     needs: [build-info]
@@ -1015,7 +997,7 @@ jobs:
           CURRENT_FAILURES: "${{ steps.get-failures.outputs.failed-jobs }}"
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: "Upload notification state"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: "slack-state-tests-${{ github.ref_name }}"
           path: ./slack-state/
@@ -1116,7 +1098,7 @@ jobs:
             --pattern "**/warnings-*.txt" \
             --output ./files
       - name: "Upload artifact for summarized warnings"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: "test-summarized-warnings"
           path: ./files/warn-summary-*.txt