ci(github): centralize uv setup and update certifi (#721)

* ci: constrain uv and update certifi

* ci: update uv pins to 0.13.4

* ci: verify uv project version requirement

* ci: format dependency sync verifier

* ci: centralize uv setup on project constraint

* ci: format dependency sync checker

Author: frgfm

.github/actions/setup-uv/action.yml

@@ -0,0 +1,9 @@
+name: Set up uv
+description: Install the lowest uv version allowed by the root pyproject.toml.
+runs:
+  using: composite
+  steps:
+    - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      with:
+        version-file: pyproject.toml
+        resolution-strategy: lowest

.github/dependabot.yml

@@ -59,7 +59,7 @@ updates:
         patterns:
           - "*"
   # Compose manifests live at the root; Dockerfiles live under src/.
-  # Update uv in the Dockerfiles together with every workflow's UV_VERSION manually.
+  # Keep the Dockerfile uv image tags at the lower bound in pyproject.toml.
   - package-ecosystem: "docker-compose"
     directory: "/"
     schedule:

.github/verify_deps_sync.py

@@ -23,6 +23,7 @@
 PRECOMMIT_CONFIG = ".pre-commit-config.yaml"
 PYPROJECTS = ["./pyproject.toml", "./client/pyproject.toml"]
 TRACKED_DEPS = ("uv", "ruff", "ty", "prek")
+UV_REQUIRED_VERSION_PROJECTS = {"./pyproject.toml"}
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.DEBUG)
@@ -52,10 +53,31 @@ def add_dep(deps: dict[str, list[dict[str, str]]], dep: str, file: str, group: s
         deps[pkg].append({"file": file, "version": parsed["version"], "group": group})
 
 
-def add_pyproject_deps(deps: dict[str, list[dict[str, str]]], pyproject_path: str) -> None:
+def uv_lower_bound(required_version: str, source: str, troubles: list[str]) -> str | None:
+    versions = re.findall(r"(?:^|,)\s*>=\s*(\d+(?:\.\d+){1,2})(?=\s*(?:,|$))", required_version)
+    if len(versions) != 1:
+        troubles.append(
+            f"{source}: [tool.uv].required-version must have one >= lower bound, found {required_version!r}"
+        )
+        return None
+    return versions[0]
+
+
+def add_pyproject_deps(deps: dict[str, list[dict[str, str]]], pyproject_path: str, troubles: list[str]) -> None:
     with Path(pyproject_path).open("rb") as f:
         pyproject: dict[str, Any] = tomllib.load(f)
 
+    tool_config = pyproject.get("tool", {})
+    uv_config = tool_config.get("uv") if isinstance(tool_config, dict) else None
+    if pyproject_path in UV_REQUIRED_VERSION_PROJECTS or uv_config is not None:
+        required_version = uv_config.get("required-version") if isinstance(uv_config, dict) else None
+        if isinstance(required_version, str):
+            lower_bound = uv_lower_bound(required_version, pyproject_path, troubles)
+            if lower_bound is not None:
+                deps["uv"].append({"file": pyproject_path, "version": f"=={lower_bound}", "group": "required-version"})
+        else:
+            troubles.append(f"{pyproject_path}: [tool.uv].required-version is missing")
+
     project = pyproject.get("project", {})
     if isinstance(project, dict):
         dependencies = project.get("dependencies", [])
@@ -80,6 +102,8 @@ def add_pyproject_deps(deps: dict[str, list[dict[str, str]]], pyproject_path: st
 
 def main() -> None:
     deps: dict[str, list[dict[str, str]]] = {dep: [] for dep in TRACKED_DEPS}
+    troubles = []
+    setup_action_calls = 0
 
     for dockerfile in DOCKERFILES:
         dockerfile_content = Path(dockerfile).read_text(encoding="utf-8")
@@ -105,20 +129,41 @@ def main() -> None:
                 })
 
     for pyproject_path in PYPROJECTS:
-        add_pyproject_deps(deps, pyproject_path)
+        add_pyproject_deps(deps, pyproject_path, troubles)
 
     for workflow_file in Path(".github/workflows").glob("*.yml"):
-        with workflow_file.open("r", encoding="utf-8") as f:
-            workflow = yaml.safe_load(f) or {}
-        env = workflow.get("env", {})
-        if "UV_VERSION" in env:
-            deps["uv"].append({
-                "file": str(workflow_file),
-                "version": f"=={env['UV_VERSION'].lstrip('v')}",
-                "group": "workflow",
-            })
+        workflow_content = workflow_file.read_text(encoding="utf-8")
+        if "astral-sh/setup-uv@" in workflow_content:
+            troubles.append(f"{workflow_file}: use the shared .github/actions/setup-uv action")
+        setup_action_calls += workflow_content.count("./.github/actions/setup-uv")
+
+    action_path = Path(".github/actions/setup-uv/action.yml")
+    action = yaml.safe_load(action_path.read_text(encoding="utf-8"))
+    setup_steps = [
+        step
+        for step in action.get("runs", {}).get("steps", [])
+        if str(step.get("uses", "")).startswith("astral-sh/setup-uv@")
+    ]
+    if setup_action_calls == 0:
+        troubles.append(".github/workflows: no shared .github/actions/setup-uv calls found")
+    if len(setup_steps) != 1:
+        troubles.append(f"{action_path}: expected one astral-sh/setup-uv step")
+    else:
+        setup = setup_steps[0].get("with", {})
+        if (
+            "version" in setup
+            or setup.get("version-file") != "pyproject.toml"
+            or setup.get("resolution-strategy") != "lowest"
+        ):
+            troubles.append(f"{action_path}: install uv from pyproject.toml with resolution-strategy: lowest")
+        else:
+            root = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
+            required = root.get("tool", {}).get("uv", {}).get("required-version")
+            if isinstance(required, str):
+                lower_bound = uv_lower_bound(required, "pyproject.toml", troubles)
+                if lower_bound is not None:
+                    deps["uv"].append({"file": str(action_path), "version": f"=={lower_bound}", "group": "setup-uv"})
 
-    troubles = []
     for dep, versions in deps.items():
         if not versions:
             troubles.append(f"{dep}: no tracked version found")

.github/workflows/builds.yml

@@ -8,7 +8,6 @@ on:
 
 env:
   PYTHON_VERSION: "3.11"
-  UV_VERSION: "0.11.14"
 
 jobs:
   docker:
@@ -19,9 +18,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Build, run & check docker
         env:
           SUPERADMIN_LOGIN: dummy_login
@@ -51,9 +48,7 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Install project
         run: |
           uv pip install --system -e client/.

.github/workflows/docs.yml

@@ -3,9 +3,6 @@ on:
   push:
     branches: main
 
-env:
-  UV_VERSION: "0.11.14"
-
 jobs:
   gh-pages:
     runs-on: ubuntu-latest
@@ -17,9 +14,7 @@ jobs:
         with:
           python-version: "3.10"
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv pip install --system -e "client/.[docs]"
 

.github/workflows/publish.yml

@@ -6,7 +6,6 @@ on:
 
 env:
   PYTHON_VERSION: "3.11"
-  UV_VERSION: "0.11.14"
 
 jobs:
   pypi:
@@ -18,9 +17,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv pip install --system setuptools wheel twine --upgrade
       - name: Build and publish
@@ -47,9 +44,7 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Install package
         run: |
           uv pip install --system pyroclient

.github/workflows/pull_requests.yml

@@ -4,9 +4,6 @@ on:
   pull_request:
     branches: main
 
-env:
-  UV_VERSION: "0.11.14"
-
 jobs:
   docs-client:
     runs-on: ubuntu-latest
@@ -18,9 +15,7 @@ jobs:
         with:
           python-version: "3.10"
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv pip install --system -e "client/.[docs]"
 

.github/workflows/push.yml

@@ -9,7 +9,6 @@ env:
   BACKEND_IMAGE_NAME: alert-api
   DOCKERHUB_USER: ${{ secrets.DOCKERHUB_LOGIN }}
   PYTHON_VERSION: "3.11"
-  UV_VERSION: "0.11.14"
 
 jobs:
   docker:
@@ -20,9 +19,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Resolve image tag
         run: |
           if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then

.github/workflows/scripts.yml

@@ -8,7 +8,6 @@ on:
 
 env:
   PYTHON_VERSION: "3.11"
-  UV_VERSION: "0.11.14"
 
 jobs:
   end-to-end:
@@ -19,9 +18,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Run the backend & the test
         env:
           SUPERUSER_LOGIN: dummy_login

.github/workflows/style.yml

@@ -8,7 +8,6 @@ on:
 
 env:
   PYTHON_VERSION: "3.11"
-  UV_VERSION: "0.11.14"
 
 jobs:
   ruff:
@@ -19,9 +18,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Run ruff
         run: |
           uv run --group quality ruff --version
@@ -35,9 +32,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Run ty
         run: |
           uv run --group quality ty --version
@@ -51,9 +46,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
-      - uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
+      - uses: ./.github/actions/setup-uv
       - name: Run prek hooks
         run: |
           uv run --group quality prek --version