From ea58b6011128fb9935c0254c89d1d3594980961d Mon Sep 17 00:00:00 2001 From: Daniel Ari Friedman Date: Wed, 4 Nov 2026 18:00:50 -0800 Subject: [PATCH] ci: pin uv to 0.13.7 in the workflow and guard it with required-version astral-sh/setup-uv is pinned by commit, which pins the installer, not the tool: with no `version` input the action installs the latest uv. Adds `version: "0.13.7"` to 2 steps and `required-version = "==0.13.7"` to [tool.uv]` in `pyproject.toml, the same value in the same commit, so the two can only drift together. --- .github/workflows/gates.yml | 2 ++ pyproject.toml | 1 + 2 files changed, 3 insertions(+) diff --git a/.github/workflows/gates.yml b/.github/workflows/gates.yml index 61fe91b..35b00f1 100644 --- a/.github/workflows/gates.yml +++ b/.github/workflows/gates.yml @@ -21,6 +21,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: + version: "0.13.7" enable-cache: true - name: Sync the locked environment @@ -71,6 +72,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: + version: "0.13.7" enable-cache: true - name: Sync the locked environment diff --git a/pyproject.toml b/pyproject.toml index cd55946..243e8a6 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -74,6 +74,7 @@ module = ["scipy.*"] ignore_missing_imports = true [tool.uv] +required-version = "==0.13.7" constraint-dependencies = ["pillow>=13.0.0"] [dependency-groups]