Skip to content

build: pin uv version and add linter concurrency #495

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jmeridth wants to merge 5 commits into from
Closed

build: pin uv version and add linter concurrency #495

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
646a08e
build: migrate from pip to uv for dependency management
jmeridth Mar 8, 2026
a703530
chore(deps): bump astral-sh/setup-uv from 5.4.1 to 7.3.1
jmeridth Mar 9, 2026
2f4699e
build: replace GITHUB_TOKEN with octo-sts token federation in update-…
jmeridth Mar 10, 2026
fef98ba
fix: ospo-reusable-workflows path
jmeridth Mar 10, 2026
0d976ff
build: pin uv version and add linter concurrency
jmeridth Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/chainguard/update-uv-lock.sts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
issuer: https://token.actions.githubusercontent.com
subject_pattern: "repo:github-community-projects/evergreen:pull_request"
claim_pattern:
job_workflow_ref: "github-community-projects/evergreen/.github/workflows/update-uv-lock.yml@.*"

permissions:
contents: write
2 changes: 2 additions & 0 deletions .github/linters/.codespellrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
[codespell]
ignore-words-list = astroid
2 changes: 1 addition & 1 deletion .github/linters/.jscpd.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"threshold": 25,
"ignore": ["/github/workspace/test*"],
"ignore": ["test*", "**/.venv/**"],
"absolute": true
}
2 changes: 1 addition & 1 deletion .github/workflows/auto-labeler.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
permissions:
contents: read
pull-requests: write
uses: github/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
with:
config-name: release-drafter.yml
secrets:
Expand Down
12 changes: 8 additions & 4 deletions .github/workflows/copilot-setup-steps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,15 @@ jobs:
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- name: Install uv
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
python-version: 3.12
version: "0.10.9"
enable-cache: true

- name: Set up Python
run: uv python install 3.14

- name: Install dependencies
run: |
pip install -r requirements.txt -r requirements-test.txt
uv sync --frozen --python 3.14
2 changes: 1 addition & 1 deletion .github/workflows/pr-title.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,6 @@ jobs:
contents: read
pull-requests: read
statuses: write
uses: github/ospo-reusable-workflows/.github/workflows/pr-title.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
uses: github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
secrets:
github-token: ${{ secrets.GITHUB_TOKEN }}
13 changes: 8 additions & 5 deletions .github/workflows/python-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,18 +18,21 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
python-version: [3.11, 3.12]
python-version: [3.11, 3.12, 3.13, 3.14]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- name: Install uv
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
python-version: ${{ matrix.python-version }}
version: "0.10.9"
enable-cache: true
- name: Set up Python ${{ matrix.python-version }}
run: uv python install ${{ matrix.python-version }}
- name: Install dependencies
run: |
pip install -r requirements.txt -r requirements-test.txt
uv sync --frozen --python ${{ matrix.python-version }}
- name: Lint with flake8 and pylint
run: |
make lint
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
permissions:
contents: write
pull-requests: read
uses: github/ospo-reusable-workflows/.github/workflows/release.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
with:
publish: true
release-config-name: release-drafter.yml
Expand All @@ -25,7 +25,7 @@ jobs:
packages: write
id-token: write
attestations: write
uses: github/ospo-reusable-workflows/.github/workflows/release-image.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-image.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
with:
image-name: ${{ github.repository }}
full-tag: ${{ needs.release.outputs.full-tag }}
Expand All @@ -40,7 +40,7 @@ jobs:
permissions:
contents: read
discussions: write
uses: github/ospo-reusable-workflows/.github/workflows/release-discussion.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-discussion.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
with:
full-tag: ${{ needs.release.outputs.full-tag }}
body: ${{ needs.release.outputs.body }}
Expand Down
13 changes: 9 additions & 4 deletions .github/workflows/super-linter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ on:
pull_request:
branches: [main]

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions:
contents: read

Expand All @@ -23,13 +27,14 @@ jobs:
with:
fetch-depth: 0
persist-credentials: false
- name: Setup Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- name: Install uv
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
python-version: "3.12"
version: "0.10.9"
enable-cache: true
- name: Install dependencies
run: |
pip install -r requirements.txt -r requirements-test.txt
uv sync --frozen
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow previously pinned a specific Python version via actions/setup-python, but now uv sync --frozen will use whatever Python happens to be on ubuntu-latest at the time the job runs. That can introduce nondeterministic CI failures as ubuntu-latest changes. Consider explicitly installing/pinning Python (e.g., via uv python install <version>) and passing --python <version> to uv sync here as well.

Suggested change
uv sync --frozen
uv python install 3.12
uv sync --frozen --python 3.12

Copilot uses AI. Check for mistakes.
- name: Lint Code Base
uses: super-linter/super-linter@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
env:
Expand Down
45 changes: 45 additions & 0 deletions .github/workflows/update-uv-lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
---
name: Update uv.lock

on:
pull_request:
paths:
- pyproject.toml

permissions:
id-token: write

jobs:
update-lock:
if: github.event.pull_request.user.login == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- name: Get GitHub App token via octo-sts
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
id: octo-sts
with:
scope: github-community-projects/evergreen
identity: update-uv-lock

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.head_ref }}
persist-credentials: true # Use the workflow temporary token from octo-sts to allow pushing changes back to the dependabot branch
token: ${{ steps.octo-sts.outputs.token }}

- name: Install uv
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
version: "0.10.9"
enable-cache: true

- name: Update uv.lock
run: uv lock

- name: Commit and push updated lockfile
run: |
git config user.name "octo-sts[bot]"
git config user.email "801323+octo-sts[bot]@users.noreply.github.com"
git add uv.lock
git diff --cached --quiet || git commit -s -m "chore(deps): update uv.lock"
git push
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,5 +158,8 @@ devenv.local.nix
devenv.*
.devenv*

# Claude
**/.claude/*.local.*

# Local testing files
dependabot-output.yaml
9 changes: 6 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,11 @@ FROM python:3.14.0-slim@sha256:0aecac02dc3d4c5dbb024b753af084cafe41f5416e02193f1
LABEL org.opencontainers.image.source https://github.com/github-community-projects/evergreen

WORKDIR /action/workspace
COPY requirements.txt *.py /action/workspace/
COPY pyproject.toml uv.lock *.py /action/workspace/

RUN python3 -m pip install --no-cache-dir --no-deps -r requirements.txt \
COPY --from=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82 /uv /uvx /bin/

RUN uv sync --frozen --no-dev --no-editable \
&& apt-get -y update \
&& apt-get -y install --no-install-recommends git=1:2.47.3-0+deb13u1 \
&& rm -rf /var/lib/apt/lists/*
Expand All @@ -16,5 +18,6 @@ RUN python3 -m pip install --no-cache-dir --no-deps -r requirements.txt \
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
CMD python3 -c "import os,sys; sys.exit(0 if os.path.exists('/action/workspace/evergreen.py') else 1)"

ENV PYTHONUNBUFFERED=1
CMD ["/action/workspace/evergreen.py"]
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Docker entrypoint/cmd will try to execute /action/workspace/evergreen.py as a binary (uv run /action/workspace/evergreen.py), but evergreen.py has no shebang and isn’t executable, so the action container is likely to fail at runtime. Update the Dockerfile so the entrypoint runs Python explicitly (e.g., have the entrypoint include python and keep the script path in CMD), or make the script executable with a shebang if you intend to execute it directly.

Suggested change
CMD ["/action/workspace/evergreen.py"]
CMD ["python3", "/action/workspace/evergreen.py"]

Copilot uses AI. Check for mistakes.
ENTRYPOINT ["python3", "-u"]
ENTRYPOINT ["uv", "run"]
14 changes: 7 additions & 7 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.PHONY: test
test:
pytest -v --cov=. --cov-config=.coveragerc --cov-fail-under=80 --cov-report term-missing
uv run pytest -v --cov=. --cov-config=.coveragerc --cov-fail-under=80 --cov-report term-missing

.PHONY: clean
clean:
Expand All @@ -9,10 +9,10 @@ clean:
.PHONY: lint
lint:
# stop the build if there are Python syntax errors or undefined names
flake8 . --config=.github/linters/.flake8 --count --select=E9,F63,F7,F82 --show-source
uv run flake8 . --config=.github/linters/.flake8 --count --select=E9,F63,F7,F82 --show-source
# exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
flake8 . --config=.github/linters/.flake8 --count --exit-zero --max-complexity=15 --max-line-length=150
isort --settings-file=.github/linters/.isort.cfg .
pylint --rcfile=.github/linters/.python-lint --fail-under=9.0 *.py
mypy --config-file=.github/linters/.mypy.ini *.py
black .
uv run flake8 . --config=.github/linters/.flake8 --count --exit-zero --max-complexity=15 --max-line-length=150
uv run isort --settings-file=.github/linters/.isort.cfg .
uv run pylint --rcfile=.github/linters/.python-lint --fail-under=9.0 *.py
uv run mypy --config-file=.github/linters/.mypy.ini *.py
uv run black .
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,11 +348,12 @@ jobs:
## Local usage without Docker

1. Make sure you have at least Python3.11 installed
1. Install [uv](https://docs.astral.sh/uv/getting-started/installation/)
1. Copy `.env-example` to `.env`
1. Fill out the `.env` file with a _token_ from a user that has access to the organization to scan (listed below). Tokens should have at least write:org access for organization scanning and write:repository for repository scanning.
1. Fill out the `.env` file with the configuration parameters you want to use
1. `pip3 install -r requirements.txt`
1. Run `python3 ./evergreen.py`, which will output everything in the terminal
1. `uv sync`
1. Run `uv run python3 ./evergreen.py`, which will output everything in the terminal

## License

Expand Down
25 changes: 25 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
[project]
name = "evergreen"
version = "1.0.0"
description = "GitHub Action that enables Dependabot for all repositories in a GitHub organization."
requires-python = ">=3.11"
dependencies = [
"github3-py==4.0.1",
"python-dotenv==1.2.1",
"requests==2.32.5",
"ruamel-yaml==0.19.1",
]
Comment on lines +1 to +11
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description/title focuses on pinning the setup-uv version and adding linter concurrency, but this change set also introduces a full migration to pyproject.toml/uv.lock and removes requirements*.txt. Either update the PR description to match the broader scope or split the dependency-management migration into a separate PR to keep review/rollback risk smaller.

Copilot uses AI. Check for mistakes.

[dependency-groups]
dev = [
"black==26.1.0",
"flake8==7.3.0",
"isort==7.0.0",
"mypy==1.19.1",
"mypy-extensions==1.1.0",
"pylint==4.0.5",
"pytest==9.0.2",
"pytest-cov==7.0.0",
"types-PyYAML==6.0.12.20250915",
"types-requests==2.32.4.20260107",
]
9 changes: 0 additions & 9 deletions requirements-test.txt
View file
Open in desktop

This file was deleted.

32 changes: 0 additions & 32 deletions requirements.txt
View file
Open in desktop

This file was deleted.

Loading
Loading