Bump hynek/build-and-inspect-python-package from 2 to 2.18.0 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: hynek/build-and-inspect-python-package.

Updates hynek/build-and-inspect-python-package from 2 to 2.18.0

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v2.18.0

Added

• New input: skip-sdist to skip building the source distribution. #228

v2.17.0

Fixed

• The action now passes Zizmor in pedantic mode. #212

v2.16.0

Added

• New include-free-threaded input. When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

v2.15.0

Added

• The Python version used to build the package can now be configured using the python-version input. #191

v2.14.0

Changed

• Update tools such that they work on Python 3.14 (which is now 3.x on GitHub Actions). #182

• The action now ignores UV_PYTHON coming from the outside. #184

v2.13.0

Added

• New output: package_name is the name of the built package as stored in metadata. #162

• The package name is now part of the action summary which is helpful when you build more than one package from a repository. #169

Changed

• All GitHub actions are now pinned to exact hashes for better reproducibility and mild security improvements.

  Since chosen prefix SHA-1 hash collision attacks exist, this is but security theater against serious attackers.

v2.12.0

This release only updates our dependencies to support packaging metadata v2.4 (as created, for example, by recent Hatchling releases).

[!NOTE] To upload packages with metadata v2.4 (which is required for PEP 639 license metadata) using the official pypi-publish GitHub Action, you must make sure to use its v1.12.4 or later.

v2.11.0

... (truncated)

Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

3.0.1 - 2026-07-30

Fixed

• To avoid uv configuration interference with the project that is being built, the installation of our own tools is now ran in a different directory. Additionally, UV_EXCLUDE_NEWER is unset. #240

3.0.0 - 2026-07-30

Security

• Given the increase and supply-chain attacks and advancements in tooling (for example, pinact or GitHub's Dependabot), this action will stop force-tagging minor and micro releases. This means, there will be no @v3 or @v3.0 tag that gets updated and force-pushed with each update. Always tag with the full version and commit hash; use Zizmor to secure your actions if you can.

Changed

• Only updates of actions and build dependencies, notably including Twine 7 that adds support for packaging metadata 2.5 and PEP 794 – Import Name Metadata.

2.18.0 - 2026-05-11

Added

• New input: skip-sdist to skip building the source distribution. #228

2.17.0 - 2026-03-27

Fixed

• The action now passes Zizmor in pedantic mode. #212

2.16.0 - 2026-03-26

Added

• New input: include-free-threaded When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

2.15.0 - 2026-03-19

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!