Skip to content

chore: bump uv to 0.12.17 - #1331

Merged
max-sixty merged 1 commit into
mainfrom
chore/bump-uv
Sep 20, 2026
Merged

max-sixty merged 1 commit into
mainfrom
chore/bump-uv

Conversation

@tend-agent

Copy link
Copy Markdown
Collaborator

Moves uv from 0.12.13 to 0.12.17 in both harness actions and in the generator's UV_VERSION, which renders the setup-uv step of every generated workflow. mitmproxy stays at 12.2.3 — already the latest release — so this moves alone rather than as the usual uv-plus-mitmproxy pair.

uv matters on two paths tend owns: it installs the pinned mitmproxy that holds the bot PAT and the model credential, and it is the agent's pinned fallback inside the sandbox. Two changes in this range touch those directly:

  • 0.12.16 verifies downloaded wheels and source distributions against the hashes the package index supplies (#21562), and extends hash verification to build-constraint-dependencies (#21467). Every uv download in a tend job goes through the credential proxy, so index-supplied hash checking is checked at the far end of exactly that hop.
  • 0.12.16 redacts Azure shared access signatures from displayed and logged URLs (#21755). Not a path tend takes — no Azure index — but it is a credentials-in-logs fix, and tend's session logs upload as artifacts.

0.12.15 is the reason not to stop at 0.12.14: it fixes 0.12.14 regressions when installing to symlinked destinations and under uv pip install --target . (#21699).

The rest is resolver performance, error rendering, and preview features tend does not enable. Nothing changes uv run --script, which is how the shipped skills invoke their helpers.

uv_build>=0.12,<0.13 in generator/pyproject.toml already contains 0.12.17, so the build backend range needs no move.

Regenerated regtest outputs carry the same one-line change; the full Python suite passes apart from the two test_refresh_consumers.py cases that need DNS, which no tend session has.

Releases crossed

0.12.14, 0.12.15, 0.12.16, 0.12.17.

The uv-pre-commit hook rev moves to 0.12.17 too, but in the repo-only pin PR rather than here — it runs in this repo's lint, not in a consumer's job.

Weekly pin sweep.

Both harness action defaults and the generator's UV_VERSION, which
renders setup-uv in every generated workflow. mitmproxy stays at 12.2.3,
already the latest, so uv moves alone this week.

0.12.16 verifies downloads against index-supplied hashes; 0.12.15 fixes
0.12.14's symlinked-destination install regression.
@max-sixty
max-sixty merged commit f90fee1 into main Sep 20, 2026
11 of 12 checks passed
@max-sixty
max-sixty deleted the chore/bump-uv branch September 20, 2026 17:37
max-sixty pushed a commit to max-sixty/worktrunk that referenced this pull request Sep 21, 2026
Regenerates the `tend-*` workflows with tend 0.2.13 (from 0.2.11).
Mechanically the diff is the action pin `max-sixty/tend/claude@0.2.11` →
`@0.2.13` in the eight workflows that run the agent, the
`astral-sh/setup-uv` pin `0.12.13` → `0.12.17` in the two that install
uv directly (`tend-mention`, `tend-notifications`), and a regenerated
header comment in all nine.

The upgrade that matters for this repo is in CI polling.
`poll_pr_checks.py` previously treated any gating check that settled
without a red conclusion as green — so a required check belonging to a
**cancelled** or **stale** run, or a `COMPLETED` check carrying no
conclusion at all, let the bot report a PR as green when nothing had
actually verified it. 0.2.13 splits those out as `unverified` and gives
`poll` a distinct exit code for them (max-sixty/tend#1323). Practically:
fewer "checks went green" claims on PRs whose required jobs were
cancelled, at the cost of some polls ending unverified rather than
green.

The rest, in rough order of how visible it is here:

- **Sandbox reliability** — the sandbox runtime now retries past a
transient bridge-socket failure at launch (max-sixty/tend#1327). That
failure is one of the shapes that produces a `tend-outage` issue, so it
should show up as fewer of those.
- **Sandbox environment** — root `/tmp` is writable inside the sandbox
(max-sixty/tend#1324); the `run-tend` skill's note that it was read-only
is gone. This repo's `running-tend` skill still restates that note, so
it goes stale when this merges — I'll follow up separately rather than
mix a skill edit into the generated-workflow diff.
- **Instruction-path pinning** — the `run-tend` skill's description of
which paths get restored from the PR base, and on which events, was
wrong in 0.2.11; `.agents/` is now named alongside `.claude/`, and the
event list is corrected (max-sixty/tend#1311). The restore behavior
itself is unchanged.
- **Auth hygiene** — the bot's claude.ai account is kept out of CI
sessions (max-sixty/tend#1328).
- **Harness pins** — claude-code 2.1.278 (max-sixty/tend#1330), uv
0.12.17 (max-sixty/tend#1331).

`.config/tend.yaml` pins no model, so the harness-default check found
nothing to adjust.

Full comparison:
max-sixty/tend@0.2.11...0.2.13

<details><summary>Copy-on-write sandbox view: landed and reverted within
this range</summary>

max-sixty/tend#1333 and max-sixty/tend#1334 moved the agent into the
job's own checkout and home through a copy-on-write view;
max-sixty/tend#1339 reverted both before 0.2.13. Nothing from that work
is in this diff — noted so a later reader doesn't chase it out of the
commit list.

</details>

Co-authored-by: worktrunk-bot <254187624+worktrunk-bot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants