fix(ci): pin the uv toolchain deterministically - #114
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough저장소의 Changesuv 도구체인 재현성
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
marked this pull request as ready for review
August 11, 2026 20:24
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
tests/test_uv_toolchain_documentation.py (1)
11-27: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win문서 절차의 내용을 검증하도록 테스트를 강화하세요.
현재 테스트는 키워드가 한 번 나타나는지만 확인합니다. 제목만 남기거나 부정문으로
rollback을 언급해도 테스트가 통과할 수 있습니다.정확한
required-version문장과update procedure,rollback and recovery섹션을 확인하세요.uv.toml삭제 또는latest선택을 금지하는 핵심 문장도 검증하세요.핵심 문장 검증 예시
normalized = " ".join(DOCTORING.read_text(encoding="utf-8").lower().split()) + assert 'required-version = "==0.12.3"' in normalized + assert "## update procedure" in normalized + assert "## rollback and recovery" in normalized + assert "do not recover by deleting" in normalized + for phrase in (🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_uv_toolchain_documentation.py` around lines 11 - 27, Strengthen test_uv_toolchain_doctoring_records_reproducibility_and_recovery to assert the exact required-version statement and the distinct “update procedure” and “rollback and recovery” sections, rather than checking isolated keywords. Also assert the documentation explicitly prohibits deleting uv.toml and choosing latest, so negated or title-only mentions cannot satisfy the test.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_uv_toolchain_pin.py`:
- Around line 25-30: Update
test_ci_uses_setup_uv_without_an_explicit_latest_override to inspect each
setup-uv workflow step individually, including the prune-cache step, and assert
that neither version nor version-file is configured. If a setup-uv step has
working-directory, require it to reference only the repository root, while
ignoring version: latest settings in unrelated workflow steps.
---
Nitpick comments:
In `@tests/test_uv_toolchain_documentation.py`:
- Around line 11-27: Strengthen
test_uv_toolchain_doctoring_records_reproducibility_and_recovery to assert the
exact required-version statement and the distinct “update procedure” and
“rollback and recovery” sections, rather than checking isolated keywords. Also
assert the documentation explicitly prohibits deleting uv.toml and choosing
latest, so negated or title-only mentions cannot satisfy the test.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a053b888-f4a5-4e7d-a9a5-a9c3e72694ff
📒 Files selected for processing (4)
docs/doctoring/uv-toolchain-reproducibility.mdtests/test_uv_toolchain_documentation.pytests/test_uv_toolchain_pin.pyuv.toml
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tests/test_uv_toolchain_pin.py (1)
12-12: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
- uses:형식도 처리하도록 보강하세요.
_setup_uv_step_blocks는 현재uses:이전의- name줄을 찾아야 단계로 인식합니다.- uses: astral-sh/setup-uv@...형식에서는 이 탐색이 실패하여AssertionError가 발생합니다.uses:가-로 시작하면step_start = uses_index를 사용하세요.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_uv_toolchain_pin.py` at line 12, Update _setup_uv_step_blocks to recognize setup-uv steps written directly as “- uses:” by setting step_start to uses_index when the uses line begins with “- ”; retain the existing “- name” lookup for named steps and preserve the current assertion behavior for unsupported formats.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tests/test_uv_toolchain_pin.py`:
- Line 12: Update _setup_uv_step_blocks to recognize setup-uv steps written
directly as “- uses:” by setting step_start to uses_index when the uses line
begins with “- ”; retain the existing “- name” lookup for named steps and
preserve the current assertion behavior for unsupported formats.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 1dda10d4-8271-40dc-803d-61098eb61582
📒 Files selected for processing (2)
tests/test_uv_toolchain_documentation.pytests/test_uv_toolchain_pin.py
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/test_uv_toolchain_documentation.py
This was referenced Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RCA
Protected-main CI pins the
astral-sh/setup-uvaction by immutable commit but did not pin theuvexecutable version. With no rootuv.toml/required-versionand no explicit workflowversion, setup-uv logged that it was falling back to latest and resolved uv 0.12.3 at execution time. The same reviewed source could therefore execute dependency locking, environment materialization, and package builds under a different uv release merely because time passed.The smallest non-conflicting remedy is a repository-root exact uv requirement. Official setup-uv behavior discovers
required-versionfrom rootuv.tomlafter checkout when no explicit workflow version overrides it, and uv itself enforces the same PEP 440 requirement.Test-first remediation
be1e314f362471b15b8acb66a3ba208cdcf220c7addedtests/test_uv_toolchain_pin.py. CI31414909820failed exactly because rootuv.tomlwas absent (1 failed, 350 passed, 3 deselectedon the observed Python 3.10 job). The setup log independently showed the missing config, latest fallback, and installation of uv 0.12.3.de19a02207695af65707ad23914401ef0efec21cadded onlyuv.tomlwithrequired-version = "==0.12.3". CI31415048033, Security Scan31415047789, and SAST31415047871all succeeded. The quality log showed setup-uv finding0.12.3in rootuv.toml, then installing exactly that version; Python 3.10/3.12/3.14, 100% owned production statement/branch coverage, 100% public docstrings, Ruff, lock freshness, package builds, Compose, and both container builds passed.a83d547c6466f5762b591c659b0e583d98d4cff8addedtests/test_uv_toolchain_documentation.py. CI31415255835failed exactly becausedocs/doctoring/uv-toolchain-reproducibility.mddid not yet exist (1 failed, 351 passed, 3 deselectedon Python 3.14).5c8996a2c21eee3c3cccc1d2a0afe9b2d2f1dbbeadds the bounded doctoring record with the immutable-action/executable/lock evidence separation, reviewed update procedure, rollback path, Python 3.14 preservation, and APA 7 primary references. CI31415422810, Security Scan31415422788, and SAST31415422726are all completed / success.Current exact state
5c8996a2c21eee3c3cccc1d2a0afe9b2d2f1dbbe.main:bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10.uv.toml, two toolchain contract tests, and one doctoring record.Scope and dependency boundary
This slice does not edit
.github/workflows/ci.yml,pyproject.toml, package source, schema, provider behavior, credentials,uv.lock, release publication, or any stacked product branch. It does not change runtime dependencies or package version. The shared CHANGELOG is intentionally not churned from this branch while multiple active implementation stacks own that integration surface; the doctoring record is the bounded design/recovery authority for this unintegrated tooling slice.Repository exact-source governance #88 remains the only repository-local prerequisite before this branch can rely on PR workflow evidence as exact contributor-head acceptance. Current live organization rules require the central workflow set and review-thread resolution on the default branch, but
required_approving_review_countis 0, code-owner review is disabled, and last-push approval is not required. Therefore absence of an independent formal approval is not a current merge blocker for this leaf unless live policy changes before merge.ContextualWisdomLab/.github#790remains a read-only central change and must not be copied, weakened, triggered, dismissed, resolved, or merged by this repository writer. Its historical review state is not promoted into an extra leaf approval requirement beyond the current live ruleset. Required central workflow results on this PR must instead be evaluated directly on the unchanged final head after #88 reaches protected main.Primary references
Doctoring records APA 7 references to Astral's official setup-uv version-configuration guidance, uv GitHub Actions guidance, and the uv
required-versionsetting.Merge boundary
Keep Draft until #88 reaches protected
main. Then revalidate this unchanged final source against the new protected exact-source contract and the live organization ruleset. Merge only when every required central/repository CI, security, coverage, package, provenance, and release gate is terminal-success, zero valid unresolved findings remain, review threads are resolved, and any approval requirement that live policy actually imposes at that time is satisfied. No predecessor, generated-merge-only, queued, pending, cancelled, skipped, stale, status-only, author-only, infrastructure-only, or failed evidence transfers.Summary by CodeRabbit
개선 사항
문서
테스트