diff --git a/.github/ci-requirements.txt b/.github/ci-requirements.txt new file mode 100644 index 00000000..f9821901 --- /dev/null +++ b/.github/ci-requirements.txt @@ -0,0 +1,2 @@ +# The uv every workflow installs. Dependabot raises it, and the installer tier runs on the change. +uv==0.13.1 diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 099f79c2..7d8755c2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,10 @@ updates: interval: "weekly" open-pull-requests-limit: 5 groups: + # A dependency goes to the first group it matches. A ruff release can report findings that the + # lint step fails on, so it gets a pull request of its own. + ruff: + patterns: ["ruff"] python-minor-and-patch: update-types: ["minor", "patch"] ignore: @@ -13,6 +17,12 @@ updates: # extra's fastmcp needs mcp<2, so a major update can't resolve. - dependency-name: "mcp" update-types: ["version-update:semver-major"] + # ci-requirements.txt: the uv the workflows install. + - package-ecosystem: "pip" + directory: "/.github" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 - package-ecosystem: "npm" directory: "/src/agent_env/explorer/ui" schedule: diff --git a/.github/workflows/clean-install.yml b/.github/workflows/clean-install.yml index 8e6239b1..471ebc7f 100644 --- a/.github/workflows/clean-install.yml +++ b/.github/workflows/clean-install.yml @@ -28,6 +28,6 @@ jobs: with: python-version: "3.11" - name: Install uv from public PyPI - run: python -m pip install --quiet --index-url https://pypi.org/simple uv + run: python -m pip install --quiet --index-url https://pypi.org/simple -r .github/ci-requirements.txt - name: Build, install clean, run hello twice run: python .github/scripts/clean_install.py --work "$RUNNER_TEMP/clean-install" diff --git a/.github/workflows/local-backends.yml b/.github/workflows/local-backends.yml index be1a7458..b9d0fc17 100644 --- a/.github/workflows/local-backends.yml +++ b/.github/workflows/local-backends.yml @@ -35,7 +35,7 @@ jobs: python-version: "3.12" - name: Install from uv.lock run: | - python -m pip install --quiet uv + python -m pip install --quiet -r .github/ci-requirements.txt uv sync --locked --extra dev --python "$(command -v python)" echo "$PWD/.venv/bin" >> "$GITHUB_PATH" - name: Lockfile resolves from PyPI only @@ -91,7 +91,7 @@ jobs: python-version: "3.12" - name: Install from uv.lock run: | - python -m pip install --quiet uv + python -m pip install --quiet -r .github/ci-requirements.txt uv sync --locked --extra dev --python "$(command -v python)" echo "$PWD/.venv/bin" >> "$GITHUB_PATH" - name: Integration tier on the local defaults @@ -128,7 +128,7 @@ jobs: python-version: "3.12" - name: Install from uv.lock run: | - python -m pip install --quiet uv + python -m pip install --quiet -r .github/ci-requirements.txt uv sync --locked --extra dev --python "$(command -v python)" echo "$PWD/.venv/bin" >> "$GITHUB_PATH" # Public ECR caps anonymous pulls by data per source IP, and hosted runners share IPs, so its pulls @@ -191,7 +191,7 @@ jobs: # moves; diffing against base.sha would count the base's own later commits as changes. BASE: ${{ github.event_name == 'pull_request' && 'HEAD^1' || github.event.before }} run: | - paths='^(src/agent_env/cli/(__init__|__main__|_installers|_plugin_changes|plugin)\.py|src/agent_env/(plugins|config)/|src/agent_env/py\.typed|packages/agentenv-protocol/|tst/installer/|tst/util/capabilities\.py|pyproject\.toml|uv\.lock|Makefile|\.github/(workflows/local-backends\.yml|scripts/check_skip_policy\.py))' + paths='^(src/agent_env/cli/(__init__|__main__|_installers|_plugin_changes|plugin)\.py|src/agent_env/(plugins|config)/|src/agent_env/py\.typed|packages/agentenv-protocol/|tst/installer/|tst/util/capabilities\.py|pyproject\.toml|uv\.lock|Makefile|\.github/(ci-requirements\.txt|workflows/local-backends\.yml|scripts/check_skip_policy\.py))' if ! changed=$(git diff --name-only "$BASE" HEAD 2>/dev/null); then echo "plugins=true" >> "$GITHUB_OUTPUT" elif grep -qE "$paths" <<< "$changed"; then @@ -214,7 +214,7 @@ jobs: python-version: "3.12" - name: Install from uv.lock run: | - python -m pip install --quiet uv pipx + python -m pip install --quiet -r .github/ci-requirements.txt pipx uv sync --locked --extra dev --python "$(command -v python)" echo "$PWD/.venv/bin" >> "$GITHUB_PATH" - name: Installer tier diff --git a/.github/workflows/plugin-api.yml b/.github/workflows/plugin-api.yml index 4ece4b4a..0bbe0c9d 100644 --- a/.github/workflows/plugin-api.yml +++ b/.github/workflows/plugin-api.yml @@ -52,7 +52,7 @@ jobs: # would land on it. - name: Plugin surface against the base run: | - python -m pip install --quiet uv + python -m pip install --quiet -r .github/ci-requirements.txt title=$(cat "$RUNNER_TEMP/title") where=() [ -e "$RUNNER_TEMP/on-main" ] && where=(--on-main) diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 376ce452..be4c3f33 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -57,7 +57,7 @@ jobs: with: python-version: "3.12" - name: Install uv from public PyPI - run: python -m pip install --quiet --index-url https://pypi.org/simple uv + run: python -m pip install --quiet --index-url https://pypi.org/simple -r .github/ci-requirements.txt - name: Check the tag names the version being built run: | version=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml) @@ -85,7 +85,7 @@ jobs: with: python-version: "3.12" - name: Install uv from public PyPI - run: python -m pip install --quiet --index-url https://pypi.org/simple uv + run: python -m pip install --quiet --index-url https://pypi.org/simple -r .github/ci-requirements.txt - name: Build agentenv-framework, pinned to this release's agentenv-framework-protocol run: | protocol=$(sed -n 's/^version = "\(.*\)"/\1/p' packages/agentenv-protocol/pyproject.toml)