-
Type:
Task
-
Resolution: Unresolved
-
Priority:
Critical - P2
-
None
-
Affects Version/s: None
-
Component/s: Infrastructure
-
None
-
Python Drivers
-
Not Needed
-
None
-
None
-
None
-
None
-
None
-
None
Context
.github/dependabot.yml already has a uv package-ecosystem entry (in addition to the existing grouped github-actions entry), running weekly with a 7-day cooldown. This entry currently produces individual version-update PRs per outdated Python dependency, and uv.lock is not committed to the repository — it's currently excluded via .gitignore — so there's no reproducible resolution across contributor machines, CI, and releases. Dependabot's uv ecosystem does not reliably support lockfile-only version updates (versioning-strategy: lockfile-only is currently broken for uv, per dependabot/dependabot-core#14073), so it isn't a good fit for routine lock refreshes. This ticket commits the lock file, restricts Dependabot's uv entry to security updates only, adds a separate scheduled GitHub Actions workflow to refresh uv.lock weekly as a single PR, and adds a CI guard against a stale lock.
Definition of done
* .gitignore is updated to stop excluding uv.lock at the repo root.
* uv.lock is generated from the current pyproject.toml and committed to the repo root.
* The existing uv entry in .github/dependabot.yml is updated so it only opens security-update PRs (no routine version-update PRs):
- package-ecosystem: "uv"
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7
# Disables routine version-update PRs for this ecosystem; has no effect
# on security updates, which use a separate internal limit (max 10 open PRs).
open-pull-requests-limit: 0
groups:
uv-security-updates:
applies-to: "security-updates"
patterns:
- "*"
* A new scheduled workflow (e.g. .github/workflows/update-uv-lock.yml) is added that:
** Runs weekly (e.g. Monday morning UTC), plus supports manual workflow_dispatch.
** Runs uv lock --upgrade to refresh uv.lock against latest compatible versions.
** Opens a single PR containing only the uv.lock diff (e.g. via peter-evans/create-pull-request, already used elsewhere in this repo's workflows) so CI runs before merge.
** Does not modify pyproject.toml.
* CI adds a step running uv lock --check (or uv sync --locked) so the build fails whenever uv.lock is out of sync with pyproject.toml.
* CONTRIBUTING.md documents how to regenerate uv.lock locally (uv lock) and what to do if the new CI check fails.
Pitfalls
* Dependabot's uv ecosystem is already producing individual version-update PRs today (e.g. #2974). Once open-pull-requests-limit: 0 is applied, these will stop — review and close/merge any currently-open individual uv PRs as part of this change so they don't linger indefinitely.
- is related to
-
-
- Closed
-