[actions] relax python version requirements

[capcom6]

Summary by CodeRabbit

• Chores
  • Updated the publishing workflow to use newer tooling versions.
  • Pinned the Python runtime to 3.13 and enabled dependency caching for faster runs.
  • Simplified the dependency installation step during publishing.

[coderabbitai]

Warning

Review limit reached

@capcom6, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 58 minutes and 37 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cebbc83c-cb14-423c-a5ea-fc4b083b73e8

📥 Commits

Reviewing files that changed from the base of the PR and between cfbdae6 and b6d3eb0.

⛔ Files ignored due to path filters (1)

• Pipfile.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .github/workflows/publish.yml

📝 Walkthrough

Walkthrough

The publish workflow updates checkout and Python setup actions, pins Python 3.13 with pipenv caching, and changes the dependency installation command.

Changes

Publish workflow update

Layer / File(s)	Summary
Workflow runtime and install .github/workflows/publish.yml	The publish job updates actions/checkout and actions/setup-python, pins Python 3.13 with pipenv caching, and changes pipenv install --deploy --dev to pipenv install --dev.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the workflow change to update and pin the Python version in GitHub Actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[capcom6]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[capcom6]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[capcom6]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[capcom6]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[capcom6]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[capcom6]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Around line 33-35: The publish workflow’s dependency install step currently
uses pipenv install --dev, which can re-resolve dependencies instead of using
the locked environment. Update the Install dependencies step to use pipenv sync
--dev so the publish build is strictly lockfile-enforced and reproducible; this
change applies in the workflow job that performs the dependency setup.
- Line 27: The publish workflow is enabling Pipenv dependency caching in a
privileged release job, which should be removed. Update the publish job in the
GitHub Actions workflow to disable the pipenv cache setting, and keep any
dependency caching only in non-privileged test jobs so the release pipeline does
not use cached dependencies.
- Around line 22-24: The publish workflow is using third-party actions with
floating tags, and checkout is still persisting credentials. Update the checkout
and setup-python steps in the publish job to use pinned commit SHAs instead of
version tags, and set persist-credentials to false on the actions/checkout step
to reduce token exposure. Use the existing checkout and setup-python entries in
the workflow to make the change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4a813887-e3ac-4fad-b2bd-247df0045685

📥 Commits

Reviewing files that changed from the base of the PR and between 1640f96 and cfbdae6.

⛔ Files ignored due to path filters (1)

• Pipfile.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .github/workflows/publish.yml