From 0925607180b6f1ed00c77554408f941b61d4fb91 Mon Sep 17 00:00:00 2001
From: Joeri Abbo <jabbo@schubergphilis.com>
Date: Sat, 26 Sep 2026 13:14:29 +0200
Subject: [PATCH] feat: add package-manager input with uv support

auto (default) uses uv when uv.lock exists and runs
uv sync --all-packages --frozen; otherwise pip with requirements.txt
as before. setup-uv is pinned by SHA.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 README.md  |  1 +
 action.yml | 47 +++++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 44 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index e630484..db0899c 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,7 @@ jobs:
 
 | Option                  | Default | Required | Description                                                                                                |
 | :---------------------- | :------ | -------- | :--------------------------------------------------------------------------------------------------------- |
+| package-manager         | auto    |          | `auto`, `uv` or `pip`. `auto` uses uv (`uv sync --all-packages --frozen`) when `uv.lock` exists, else pip |
 | pyinstaller-binary-name |         |          | If populated, then a binary will be created using pyinstaller and attached to a release                    |
 | pyinstaller-entrypoint  | main.py |          | The Python script that pyinstaller turns into a binary                                                     |
 | token                   |         | x        | GitHub token required for Docker registry authentication and uploading release assets (if building binary) |
diff --git a/action.yml b/action.yml
index ebd5e88..f5433a7 100644
--- a/action.yml
+++ b/action.yml
@@ -3,6 +3,11 @@ name: mcvs-python-action
 description: |
   The Mission Critical Vulnerability Scanner (MCVS) Python action.
 inputs:
+  package-manager:
+    default: auto
+    description: |
+      How to install the project: auto, uv or pip. auto picks uv when a
+      uv.lock exists and pip with requirements.txt otherwise.
   pyinstaller-binary-name:
     description: The name of the binary that is created using pyinstaller.
   pyinstaller-entrypoint:
@@ -36,13 +41,41 @@ runs:
         path: .
         severity-cutoff: high
     #
-    # If a requirements file exists in the project, then install the packages.
+    # Pick the package manager. 'run' is the prefix used to call project tools
+    # like ruff, mypy and pytest from the installed environment.
     #
-    - name: Install PIP packages defined in requirements.txt
+    - name: Resolve package manager
+      id: resolve
       shell: bash
+      env:
+        PACKAGE_MANAGER: ${{ inputs.package-manager }}
+      run: |
+        pm=${PACKAGE_MANAGER}
+        if [ "${pm}" = auto ]; then
+          if [ -f uv.lock ]; then pm=uv; else pm=pip; fi
+        fi
+        case "${pm}" in
+          uv) run="uv run --no-sync" ;;
+          pip) run="python3 -m" ;;
+          *) echo "::error::package-manager must be auto, uv or pip"; exit 1 ;;
+        esac
+        echo "package-manager=${pm}" >> "${GITHUB_OUTPUT}"
+        echo "run=${run}" >> "${GITHUB_OUTPUT}"
+    # yamllint disable-line rule:line-length
+    - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      if: ${{ steps.resolve.outputs.package-manager == 'uv' }}
+    #
+    # Install the project: uv sync for uv, requirements.txt (if any) for pip.
+    #
+    - name: Install packages
+      shell: bash
+      env:
+        PACKAGE_MANAGER: ${{ steps.resolve.outputs.package-manager }}
       run: |
         requirements_file=requirements.txt
-        if [ -f ${requirements_file} ]; then
+        if [ "${PACKAGE_MANAGER}" = uv ]; then
+          uv sync --all-packages --frozen
+        elif [ -f ${requirements_file} ]; then
           pip install \
             --requirement ${requirements_file}
         fi
@@ -88,8 +121,14 @@ runs:
     #
     - name: Check Conditions
       id: condition_check
-      run: echo "Checking conditions..."
+      run: |
+        if [ "${PACKAGE_MANAGER}" = uv ]; then
+          echo "::error::pyinstaller builds are only supported for pip projects"
+          exit 1
+        fi
       shell: bash
+      env:
+        PACKAGE_MANAGER: ${{ steps.resolve.outputs.package-manager }}
       if: ${{ github.event_name == 'push' && contains(github.ref, 'refs/tags/') && inputs.pyinstaller-binary-name != '' }}
     # yamllint enable rule:line-length
     - name: Build binary using pyinstaller