Improve uv dependency management workflow

XMLWordPrintableJSON

    • None
    • Python Drivers
    • Not Needed
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      Context

      .github/dependabot.yml already has a uv package-ecosystem entry (in addition to the existing grouped github-actions entry), running weekly with a 7-day cooldown. This entry currently produces individual version-update PRs per outdated Python dependency, and uv.lock is not committed to the repository — it's currently excluded via .gitignore — so there's no reproducible resolution across contributor machines, CI, and releases. Dependabot's uv ecosystem does not reliably support lockfile-only version updates (versioning-strategy: lockfile-only is currently broken for uv, per dependabot/dependabot-core#14073), so it isn't a good fit for routine lock refreshes. This ticket commits the lock file, restricts Dependabot's uv entry to security updates only, adds a separate scheduled GitHub Actions workflow to refresh uv.lock weekly as a single PR, and adds a CI guard against a stale lock.

      Definition of done


      * .gitignore is updated to stop excluding uv.lock at the repo root.
      * uv.lock is generated from the current pyproject.toml and committed to the repo root.
      * The existing uv entry in .github/dependabot.yml is updated so it only opens security-update PRs (no routine version-update PRs): 

        - package-ecosystem: "uv"
    directory: "/"
    schedule: 
      interval: "weekly"
    cooldown: 
      default-days: 7
    # Disables routine version-update PRs for this ecosystem; has no effect
    # on security updates, which use a separate internal limit (max 10 open PRs).
    open-pull-requests-limit: 0
    groups: 
      uv-security-updates: 
        applies-to: "security-updates"
        patterns: 
          - "*"

      * A new scheduled workflow (e.g. .github/workflows/update-uv-lock.yml) is added that:
      ** Runs weekly (e.g. Monday morning UTC), plus supports manual workflow_dispatch.
      ** Runs uv lock --upgrade to refresh uv.lock against latest compatible versions.
      ** Opens a single PR containing only the uv.lock diff (e.g. via peter-evans/create-pull-request, already used elsewhere in this repo's workflows) so CI runs before merge.
      ** Does not modify pyproject.toml.
      * CI adds a step running uv lock --check (or uv sync --locked) so the build fails whenever uv.lock is out of sync with pyproject.toml.
      * CONTRIBUTING.md documents how to regenerate uv.lock locally (uv lock) and what to do if the new CI check fails.

      Pitfalls


      * Dependabot's uv ecosystem is already producing individual version-update PRs today (e.g. #2974). Once open-pull-requests-limit: 0 is applied, these will stop — review and close/merge any currently-open individual uv PRs as part of this change so they don't linger indefinitely.

            Assignee:
            Steve Silvester
            Reporter:
            Steve Silvester
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: