Bump actions/setup-python from 5.1.1 to 5.2.0

[dependabot]

Bumps actions/setup-python from 5.1.1 to 5.2.0.

Bug fixes: Add arch to cache key. This addresses issues with caching by adding the architecture (arch)
to the cache key, ensuring that cache keys are accurate to prevent conflicts.

[BFB]

Release notes

Sourced from actions/setup-python's releases.

v5.2.0

What's Changed

Bug fixes:

• Add .zip extension to Windows package downloads for Expand-Archive Compatibility by @​priyagupta108 in actions/setup-python#916 This addresses compatibility issues on Windows self-hosted runners by ensuring that the filenames for Python and PyPy package downloads explicitly include the .zip extension, allowing the Expand-Archive command to function correctly.
• Add arch to cache key by @​Zxilly in actions/setup-python#896 This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts

Documentation changes:

• Fix display of emojis in contributors doc by @​sciencewhiz in actions/setup-python#899
• Documentation update for caching poetry dependencies by @​gowridurgad in actions/setup-python#908

Dependency updates:

• Bump @​iarna/toml version from 2.2.5 to 3.0.0 by @​priya-kinthali in actions/setup-python#912
• Bump pyinstaller from 3.6 to 5.13.1 by @​aparnajyothi-y in actions/setup-python#923

New Contributors

• @​sciencewhiz made their first contribution in actions/setup-python#899
• @​priyagupta108 made their first contribution in actions/setup-python#916
• @​Zxilly made their first contribution in actions/setup-python#896
• @​aparnajyothi-y made their first contribution in actions/setup-python#923

Full Changelog: actions/setup-python@v5...v5.2.0

Commits

• f677139 Bump pyinstaller from 3.6 to 5.13.1 in /tests/data (#923)
• 2bd53f9 Documentation update for caching poetry dependencies (#908)
• 80b49d3 fix: add arch to cache key (#896)
• 036a523 Fix: Add .zip extension to Windows package downloads for Expand-Archive C...
• 04c1311 Fix display of emojis in contributors doc (#899)
• cb68456 Updated @​iarna/toml version to 3.0.0 (#912)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

The following labels could not be found: AT: Integrate Without Testing.

[mahf708]

We can potentially make these PRs less frequent if we have a "major" pin instead of a specific pin, e.g.

-        uses: actions/[email protected]
+        uses: actions/setup-python@v5

[bartgol]

@mahf708 Yes, I don't think we need to update these every minor/micro update. And with actions being relatively small pieces of software, security/bug fixes are not that frequent, at least after v2 or so. My guess is that minor/micro versions can add small features, which we may not need anyways?

[xylar]

My guess is that minor/micro versions can add small features, which we may not need anyways?

My understanding if you only pin to the major version is that it will use the latest version with that major version. So you would get those small features.

[mahf708]

My guess is that minor/micro versions can add small features, which we may not need anyways?

My understanding if you only pin to the major version is that it will use the latest version with that major version. So you would get those small features.

My understanding aligns with Xylar's. Essentially, if we have @v5 in there, we will still get the latest each time the action is run. I will do a follow-up PR and move all our actions to use major pins to lessen these PRs.

I am also bringing docker build/upload/test github actions to the e3sm monorepo next, so our dependabot will finally have more fun with non-github-action pins to upgrade and fiddle with :)

xref #6583