ci: pin the uv that CI installs, and update ruff in a Dependabot group of its own

[AlexS-scale]

What and why

uv. Each workflow installs the newest uv with pip install uv. #194 made the jobs install the Python packages from uv.lock, but uv itself was not pinned. Thus a uv release can make all pull requests fail at the same time, with no change in this repository. This occurred with uv 0.13.1: the installer check failed on main and on each pull request until #199.

• .github/ci-requirements.txt pins uv==0.13.1, the current release. The 8 steps in 4 workflows that install uv install it from that file: local-backends.yml, clean-install.yml, plugin-api.yml and publish-pypi.yml.
• A new pip entry in dependabot.yml updates the file each week. Each uv update comes in its own pull request.
• The changes job now counts .github/ci-requirements.txt, so a uv update runs the installer tier. That tier runs plugin add and remove through the real uv, so a uv release that breaks them fails on its own pull request, not on main.

pipx in the installer job is not pinned yet.

ruff. ruff is pinned exactly in the dev extra (#192), because what it reports changes between releases. Dependabot put its updates in python-minor-and-patch, together with the other minor and patch updates. A ruff release that reports a new finding would fail the whole group. ruff now has a group of its own, defined first, because Dependabot puts a dependency in the first group that it matches.

How it was tested

• actionlint: no findings.
• .github/dependabot.yml is valid against the SchemaStore dependabot-2.0 schema (check-jsonschema --builtin-schema vendor.dependabot).
• pip install --index-url https://pypi.org/simple -r .github/ci-requirements.txt in a new venv installs uv 0.13.1.
• The changes job's path pattern matches .github/ci-requirements.txt, and still does not match .github/dependabot.yml.
• The Dependabot documentation says that the pip ecosystem "supports updates to any .txt file", and that "if a dependency matches more than one rule, it's included in the first group that it matches".

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Pins the uv installed by all eight CI steps and gives ruff its own Dependabot group.

• CI workflows now use the same pinned uv release.
• Ruff updates arrive in their own pull requests.

_{Reviews (2) · Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." · Reviewed by Greptile}