chore(deps): commit uv.lock and lock CI to uv sync by muddlebee · Pull Request #1292 · Tracer-Cloud/opensre

muddlebee · 2026-05-05T05:17:55Z

Summary

Reproducible dependency installs: commit uv.lock, install with uv sync --frozen in CI, weekly Dependabot on the uv ecosystem, and a deps-latest canary using latest PyPI resolves.

Why this is good long term

Today, installs that only read pyproject.toml resolve whatever newest versions satisfy >= constraints on the day CI runs. That is convenient but brittle: a green main on Tuesday can turn red on Wednesday without any code change, because a transitive upgrade (for example an SDK tightening validation at import or client construction) landed on PyPI overnight. Teams then burn time bisecting “what changed?” when the answer is resolver noise, not a regression in your diff.

Committing a lockfile and installing with uv sync --frozen makes dependency state explicit and reviewable. Upgrades become intentional PRs (human or Dependabot) where you see the diff, run CI once, and decide whether to take the change. That shifts the project from “floating on the ecosystem” to “pinned by default, upgraded on purpose,” which is the usual standard for applications and CLIs shipped as a single product.

The deps-latest workflow keeps a separate signal: a scheduled / manual job that re-resolves from pyproject.toml so you still learn about upstream breakage before it forces an emergency fire drill—without every pull request inheriting unbounded drift.

Together, this setup improves predictability for contributors, stability for releases, and auditability when you need to answer what shipped in a given build.

Changes

Commit uv.lock; remove it from .gitignore.
CI, Windows label CI, synthetic tests: uv sync --frozen --extra dev, run tools via uv run python -m ….
Makefile install: uv sync --frozen --extra dev + uv run for analytics.
Dependabot: uv (weekly) for repo root.
.github/workflows/deps-latest.yml: canary install with uv pip install --python "$(which python)" -e ".[dev]" then focused pytest.

- Add uv.lock; stop gitignoring it; Dependabot uses uv ecosystem weekly. - CI, Windows label CI, and synthetic workflow use uv sync --frozen --extra dev. - Makefile install uses uv sync --frozen and uv run for analytics. - Add deps-latest weekly canary with uv pip --python $(which python) -e .[dev].

greptile-apps · 2026-05-05T05:21:11Z

Greptile Summary

Migrates all CI workflows (ci.yml, ci-labels-windows.yml, synthetic-tests.yml) from uv pip install --system to uv sync --frozen --extra dev, committing uv.lock and updating cache globs to include it, ensuring reproducible dependency resolution across all jobs.
Adds a new deps-latest.yml canary workflow that re-resolves from pyproject.toml on a weekly schedule and auto-creates a deduplicated GitHub issue on failure, keeping a signal for upstream drift without polluting every PR.
Switches Dependabot from the pip ecosystem to uv (weekly) and updates developer docs (SETUP.md, CONTRIBUTING.md, README.md) to reflect the uv-first workflow.

Confidence Score: 5/5

Safe to merge; no P0 or P1 issues found — only minor P2 style suggestions.

All workflow changes are consistent and correctly use uv sync --frozen; the canary workflow correctly includes --system; the two P2 comments are about defensive hygiene, not correctness. No regressions introduced.

No files require special attention; .github/workflows/deps-latest.yml and ci.yml are the most impactful files and both look correct.

Important Files Changed

Filename	Overview
.github/workflows/deps-latest.yml	New weekly canary workflow; correctly uses --system for uv pip install; issue-dedup logic is well-structured; minor concern about plain `python -m pytest` vs `uv run`.
.github/workflows/ci.yml	Consistently migrated to uv sync --frozen and uv run across all jobs; uv.lock added to path triggers and cache globs; e2e matrix commands wrapped with `uv run` which works for the current python3 entries.
.github/workflows/ci-labels-windows.yml	Uniformly replaced uv pip install --system with uv sync --frozen and bare python invocations with uv run; cache glob updated to include uv.lock.
.github/workflows/synthetic-tests.yml	Replaced pip cache + pip install pattern with setup-uv + uv sync --frozen; uv setup correctly precedes setup-python.
.github/dependabot.yml	Ecosystem changed from pip to uv (correct for lockfile-driven setup); interval relaxed from daily to weekly, appropriate for pinned deps.
Makefile	install target simplified to uv sync --frozen + uv run; existing PATH setup referencing .venv/bin is compatible with uv's default venv location.
.gitignore	uv.lock removed from ignore; comment updated to reflect that the lockfile is intentionally committed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[PR / Push to main] -->|paths include uv.lock| B[ci.yml triggered]
    B --> C[uv sync --frozen --extra dev]
    C --> D{Jobs}
    D --> E[quality: ruff lint + format]
    D --> F[typecheck: mypy]
    D --> G[test: pytest via uv run]
    D --> H[test-kubernetes]
    G --> I[test-thorough: uv run matrix.command]

    J[Weekly cron / workflow_dispatch] --> K[deps-latest.yml]
    K --> L[uv pip install --system latest from pyproject]
    L --> M[python -m pytest canary tests]
    M -->|failure + schedule| N[Create/dedup GitHub issue]

    O[Dependabot uv weekly] -->|uv.lock update PR| B

_{Reviews (3): Last reviewed commit: "ci: restore deps-latest as standalone wo..." | Re-trigger Greptile}

- Add --system to uv pip install with explicit python interpreter. - Add scheduled-failure issue notification step (dedupes open issue by title). - Grant issues:write permission for canary workflow notifications.

muddlebee · 2026-05-05T05:31:38Z

@greptileai review

Use jq fallback to empty string so scheduled failure creates an issue when none exists.

Resolve ci.yml conflict: keep unified Run tests (fork + non-fork parity).

- Remove .github/workflows/deps-latest.yml per maintainer feedback (workflow sprawl) - Document uv install for macOS/Linux/Windows in SETUP.md; use uv run in manual fallback - Note uv + uv.lock in README Development; align CONTRIBUTING quick start

- Add schedule + workflow_dispatch triggers; gate quality/typecheck/test to push/PR so weekly/manual runs only execute dependency-resolution-latest - Reuse uv pip install --system + focused pytest + issue on scheduled failure (same as removed deps-latest workflow)

This reverts commit 8bbea22.

Revert folding the canary into ci.yml; keep scheduled/latest-resolve check isolated

muddlebee · 2026-05-05T11:44:29Z

@greptileai review

- Add dependency-resolution-latest job (unpinned uv pip + guardrail tests + issue on schedule failure) - Align test-synthetic with uv sync --frozen and uv run (remove pip) - Drop deps-latest.yml; single Monday 9 UTC trigger for both jobs

Filename matches scheduled synthetic suite + latest-deps canary jobs

Clearer filename for weekly synthetic suite + latest-deps canary jobs

VaibhavUpreti · 2026-05-05T16:04:24Z


-# uv
-uv.lock
+# uv (uv.lock is committed)


VaibhavUpreti · 2026-05-05T16:04:48Z

    schedule:
-      interval: "daily"
+      interval: "weekly"
    open-pull-requests-limit: 10


change back to daily

VaibhavUpreti

awesome @muddlebee

github-actions · 2026-05-05T16:05:19Z

🧠 @muddlebee opened a PR. Maintainers feared them. CI genuflected. It merged. 🚨

👋 Join us on Discord - OpenSRE : hang out, contribute, or hunt for features and issues. Everyone's welcome.

muddlebee mentioned this pull request May 5, 2026

fix(llm): lazy OpenAI client init fix regression tests and Run full tests in PR CI #1291

Merged

greptile-apps Bot reviewed May 5, 2026

View reviewed changes

Comment thread .github/workflows/deps-latest.yml Outdated

Comment thread .github/workflows/deps-latest.yml Outdated

fix(ci): address deps-latest Greptile findings

978e6e3

- Add --system to uv pip install with explicit python interpreter. - Add scheduled-failure issue notification step (dedupes open issue by title). - Grant issues:write permission for canary workflow notifications.

muddlebee added 2 commits May 5, 2026 11:05

fix(ci): handle empty canary issue lookup

775ae41

Use jq fallback to empty string so scheduled failure creates an issue when none exists.

Merge upstream/main into chore/uv-lock-reproducible-ci

abed0e5

Resolve ci.yml conflict: keep unified Run tests (fork + non-fork parity).

muddlebee added the pending triage label May 5, 2026

muddlebee assigned VaibhavUpreti May 5, 2026

VaibhavUpreti reviewed May 5, 2026

View reviewed changes

Comment thread .github/workflows/deps-latest.yml Outdated

VaibhavUpreti reviewed May 5, 2026

View reviewed changes

Comment thread Makefile

muddlebee added 4 commits May 5, 2026 16:57

Revert "ci: fold dependency canary into ci.yml"

e7b24f1

This reverts commit 8bbea22.

ci: restore deps-latest as standalone workflow

163569f

Revert folding the canary into ci.yml; keep scheduled/latest-resolve check isolated

muddlebee added 2 commits May 5, 2026 17:18

ci: rename synthetic-tests workflow to scheduled-synthetic-deps

3f53069

Filename matches scheduled synthetic suite + latest-deps canary jobs

muddlebee added the ci:windows label May 5, 2026

ci: rename workflow to weekly-synthetic-and-deps-canary

f27684e

Clearer filename for weekly synthetic suite + latest-deps canary jobs

VaibhavUpreti reviewed May 5, 2026

View reviewed changes

Comment thread .gitignore

# uv

uv.lock

# uv (uv.lock is committed)

Copy link
Copy Markdown

Member

VaibhavUpreti May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rm comment

VaibhavUpreti reviewed May 5, 2026

View reviewed changes

VaibhavUpreti approved these changes May 5, 2026

View reviewed changes

VaibhavUpreti merged commit 3f1325d into Tracer-Cloud:main May 5, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): commit uv.lock and lock CI to uv sync#1292

chore(deps): commit uv.lock and lock CI to uv sync#1292
VaibhavUpreti merged 11 commits intoTracer-Cloud:mainfrom
muddlebee:chore/uv-lock-reproducible-ci

muddlebee commented May 5, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented May 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

muddlebee commented May 5, 2026

Uh oh!

Uh oh!

Uh oh!

muddlebee commented May 5, 2026

Uh oh!

VaibhavUpreti May 5, 2026

Uh oh!

VaibhavUpreti May 5, 2026

Uh oh!

VaibhavUpreti left a comment

Uh oh!

Uh oh!

github-actions Bot commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

muddlebee commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why this is good long term

Changes

Uh oh!

greptile-apps Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Uh oh!

muddlebee commented May 5, 2026

Uh oh!

Uh oh!

Uh oh!

muddlebee commented May 5, 2026

Uh oh!

VaibhavUpreti May 5, 2026

Choose a reason for hiding this comment

Uh oh!

VaibhavUpreti May 5, 2026

Choose a reason for hiding this comment

Uh oh!

VaibhavUpreti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

muddlebee commented May 5, 2026 •

edited

Loading

greptile-apps Bot commented May 5, 2026 •

edited

Loading