Skip to content

build(ci): Use setup-uv v7 and remove uv version pinning #7799

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
phacops merged 5 commits into from
Mar 6, 2026
Merged

build(ci): Use setup-uv v7 and remove uv version pinning #7799

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c2417a7
fix(ci): Install Python in bump-version workflow
phacops Mar 5, 2026
a0757ac
build(ci): Update setup-uv action to v7
phacops Mar 5, 2026
128bf98
build(ci): Remove uv version pinning and use setup-uv v7
phacops Mar 5, 2026
f49dc6b
build(ci): Use uv run for Python execution in workflows and Makefile
phacops Mar 5, 2026
c9a4eb4
build(ci): Pin setup-uv to commit hash for v7.3.1
phacops Mar 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .github/workflows/bump-version.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,8 @@ jobs:
- uses: actions/checkout@v6.0.2
with:
token: ${{ secrets.GETSENTRY_BOT_REVERT_TOKEN }}
- uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
with:
version: '0.8.2'
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
- run: uv python install
- run: |
set -euxo pipefail

Expand Down
13 changes: 5 additions & 8 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,18 +32,17 @@ jobs:
- uses: actions/checkout@v6.0.2
name: Checkout code

- uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
version: '0.8.2'
enable-cache: false

- name: Test bump_version.py runs without errors
Comment thread
sentry[bot] marked this conversation as resolved.
run: |
# Test that the script can be imported and shows help
python tools/bump_version.py --help
uv run python tools/bump_version.py --help

# Test with a dry run (should fail with appropriate message for non-existent package)
python tools/bump_version.py test-package 1.0.0 || echo "Expected failure for non-existent package"
uv run python tools/bump_version.py test-package 1.0.0 || echo "Expected failure for non-existent package"

linting:
name: "pre-commit hooks" # (includes Python formatting + linting)
Expand All @@ -60,9 +59,8 @@ jobs:
app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}

- uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
version: '0.8.2'
# we just cache the venv-dir directly in action-setup-venv
enable-cache: false

Expand Down Expand Up @@ -138,9 +136,8 @@ jobs:
- uses: actions/checkout@v6.0.2
name: Checkout code

- uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
version: '0.8.2'
# we just cache the venv-dir directly in action-setup-venv
enable-cache: false

Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/ddl-changes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,8 @@ jobs:
clean: false
fetch-depth: 200

- uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
version: '0.8.2'
# we just cache the venv-dir directly in action-setup-venv
enable-cache: false

Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/docs-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,8 @@ jobs:
steps:
- uses: actions/checkout@v6.0.2

- uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
version: '0.8.2'
# we just cache the venv-dir directly in action-setup-venv
enable-cache: false

Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,8 @@ jobs:
steps:
- uses: actions/checkout@v6.0.2

- uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
with:
version: '0.8.2'
# we just cache the venv-dir directly in action-setup-venv
enable-cache: false

Expand Down
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ ENV PATH="/.venv/bin:$PATH" UV_PROJECT_ENVIRONMENT=/.venv \
UV_COMPILE_BYTECODE=1 UV_NO_CACHE=1

RUN python3 -m pip install \
--index-url 'https://pypi.devinfra.sentry.io/simple' 'uv==0.8.2'
--index-url 'https://pypi.devinfra.sentry.io/simple' 'uv'
Copy link
Copy Markdown

@cursor cursor Bot Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unpinned uv version in production Dockerfile risks build breakage

Medium Severity

The uv package version pin was removed in the production Dockerfile, changing from 'uv==0.8.2' to 'uv'. While the GitHub Actions all pin to a specific SHA for setup-uv, the Dockerfile now installs whatever uv version happens to be latest on the private PyPI index at build time. A breaking uv release (e.g., changes to uv sync, lockfile format, or dependency resolution) could cause non-reproducible or failing production image builds without any code change.

Fix in Cursor Fix in Web


# We don't want uv-managed python, we want to use python from the image.
# We only want to use uv to manage dependencies.
Expand Down
6 changes: 3 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ install-rs-dev:

snubadocs:
uv pip install -U -r ./docs-requirements.txt
sphinx-build -W -b html docs/source docs/build
uv run sphinx-build -W -b html docs/source docs/build

build-admin:
cd snuba/admin && yarn install && yarn run build
Expand All @@ -63,11 +63,11 @@ test-frontend-admin:
cd snuba/admin && yarn install && yarn run test

validate-configs:
.venv/bin/python snuba/validate_configs.py
uv run python snuba/validate_configs.py

generate-config-docs:
uv pip install -r ./docs-requirements.txt
.venv/bin/python -m snuba.datasets.configuration.generate_config_docs
uv run python -m snuba.datasets.configuration.generate_config_docs

watch-rust-snuba:
which cargo-watch || cargo install cargo-watch
Expand Down
Loading