ci: pin the uv that CI installs, and update ruff in a Dependabot group of its own

.github/ci-requirements.txt

@@ -0,0 +1,2 @@
+# The uv every workflow installs. Dependabot raises it, and the installer tier runs on the change.
+uv==0.13.1

.github/dependabot.yml

@@ -6,13 +6,23 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 5
     groups:
+      # A dependency goes to the first group it matches. A ruff release can report findings that the
+      # lint step fails on, so it gets a pull request of its own.
+      ruff:
+        patterns: ["ruff"]
       python-minor-and-patch:
         update-types: ["minor", "patch"]
     ignore:
       # mcp 2 removed mcp.server.fastmcp, which env/gateway imports at module scope, and the dev
       # extra's fastmcp needs mcp<2, so a major update can't resolve.
       - dependency-name: "mcp"
         update-types: ["version-update:semver-major"]
+  # ci-requirements.txt: the uv the workflows install.
+  - package-ecosystem: "pip"
+    directory: "/.github"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
   - package-ecosystem: "npm"
     directory: "/src/agent_env/explorer/ui"
     schedule:

.github/workflows/clean-install.yml

@@ -28,6 +28,6 @@ jobs:
         with:
           python-version: "3.11"
       - name: Install uv from public PyPI
-        run: python -m pip install --quiet --index-url https://pypi.org/simple uv
+        run: python -m pip install --quiet --index-url https://pypi.org/simple -r .github/ci-requirements.txt
       - name: Build, install clean, run hello twice
         run: python .github/scripts/clean_install.py --work "$RUNNER_TEMP/clean-install"

.github/workflows/local-backends.yml

@@ -35,7 +35,7 @@ jobs:
           python-version: "3.12"
       - name: Install from uv.lock
         run: |
-          python -m pip install --quiet uv
+          python -m pip install --quiet -r .github/ci-requirements.txt
           uv sync --locked --extra dev --python "$(command -v python)"
           echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
       - name: Lockfile resolves from PyPI only
@@ -91,7 +91,7 @@ jobs:
           python-version: "3.12"
       - name: Install from uv.lock
         run: |
-          python -m pip install --quiet uv
+          python -m pip install --quiet -r .github/ci-requirements.txt
           uv sync --locked --extra dev --python "$(command -v python)"
           echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
       - name: Integration tier on the local defaults
@@ -128,7 +128,7 @@ jobs:
           python-version: "3.12"
       - name: Install from uv.lock
         run: |
-          python -m pip install --quiet uv
+          python -m pip install --quiet -r .github/ci-requirements.txt
           uv sync --locked --extra dev --python "$(command -v python)"
           echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
       # Public ECR caps anonymous pulls by data per source IP, and hosted runners share IPs, so its pulls
@@ -191,7 +191,7 @@ jobs:
           # moves; diffing against base.sha would count the base's own later commits as changes.
           BASE: ${{ github.event_name == 'pull_request' && 'HEAD^1' || github.event.before }}
         run: |
-          paths='^(src/agent_env/cli/(__init__|__main__|_installers|_plugin_changes|plugin)\.py|src/agent_env/(plugins|config)/|src/agent_env/py\.typed|packages/agentenv-protocol/|tst/installer/|tst/util/capabilities\.py|pyproject\.toml|uv\.lock|Makefile|\.github/(workflows/local-backends\.yml|scripts/check_skip_policy\.py))'
+          paths='^(src/agent_env/cli/(__init__|__main__|_installers|_plugin_changes|plugin)\.py|src/agent_env/(plugins|config)/|src/agent_env/py\.typed|packages/agentenv-protocol/|tst/installer/|tst/util/capabilities\.py|pyproject\.toml|uv\.lock|Makefile|\.github/(ci-requirements\.txt|workflows/local-backends\.yml|scripts/check_skip_policy\.py))'
           if ! changed=$(git diff --name-only "$BASE" HEAD 2>/dev/null); then
             echo "plugins=true" >> "$GITHUB_OUTPUT"
           elif grep -qE "$paths" <<< "$changed"; then
@@ -214,7 +214,7 @@ jobs:
           python-version: "3.12"
       - name: Install from uv.lock
         run: |
-          python -m pip install --quiet uv pipx
+          python -m pip install --quiet -r .github/ci-requirements.txt pipx
           uv sync --locked --extra dev --python "$(command -v python)"
           echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
       - name: Installer tier

.github/workflows/plugin-api.yml

@@ -52,7 +52,7 @@ jobs:
       # would land on it.
       - name: Plugin surface against the base
         run: |
-          python -m pip install --quiet uv
+          python -m pip install --quiet -r .github/ci-requirements.txt
           title=$(cat "$RUNNER_TEMP/title")
           where=()
           [ -e "$RUNNER_TEMP/on-main" ] && where=(--on-main)

.github/workflows/publish-pypi.yml

@@ -57,7 +57,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install uv from public PyPI
-        run: python -m pip install --quiet --index-url https://pypi.org/simple uv
+        run: python -m pip install --quiet --index-url https://pypi.org/simple -r .github/ci-requirements.txt
       - name: Check the tag names the version being built
         run: |
           version=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
@@ -85,7 +85,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install uv from public PyPI
-        run: python -m pip install --quiet --index-url https://pypi.org/simple uv
+        run: python -m pip install --quiet --index-url https://pypi.org/simple -r .github/ci-requirements.txt
       - name: Build agentenv-framework, pinned to this release's agentenv-framework-protocol
         run: |
           protocol=$(sed -n 's/^version = "\(.*\)"/\1/p' packages/agentenv-protocol/pyproject.toml)