ISSUE #3032: chore(uv): pin uv version to fix CI check-generated-code failure

[jiridanek]

Summary

The check-generated-code CI job is failing on main and all PRs because astral-sh/setup-uv@v7 with version: "latest" now installs uv 0.10.6, which produces different pylock.toml output than committed files.

Root cause: astral-sh/uv#18081 (released in uv 0.10.5, 2026-02-23) started filtering platform-specific wheels from pylock.toml even in --universal mode. This means the lock files regenerated in CI no longer match the ones committed with the older uv.

Fix: Pin the uv version in one place and have everything else read from it.

Tracking issue: #3032

Changes

• uv.toml (new) — single source of truth: required-version = "==0.10.6". setup-uv@v7 auto-detects this when no version: input is specified.
• 4 workflow files — removed version: "latest" from all setup-uv steps so they pick up the pin from uv.toml.
• ci/generate_code.sh — updated the fallback pip install from uv==0.9.6 to uv==0.10.6.
• ./uv (new) — wrapper script for local use. Reads the pinned version from uv.toml and runs it via uv tool run, so your system uv version doesn't matter. Uses the system uv directly if it already matches (fast path, ~16ms).
• README.md — documented ./uv wrapper and alternatives (uvx, uv tool run, direct install).

How it works

uv.toml                          # required-version = "==0.10.6"
  ├── CI: setup-uv@v7            # auto-detects, installs pinned version
  ├── CI: ci/generate_code.sh    # fallback pip install matches
  └── Local: ./uv sync           # wrapper reads toml, delegates via uvx

How Has This Been Tested?

• Ran bash ci/generate_code.sh locally with uv 0.10.6 — regenerated pylocks match, git diff is clean
• Verified ./uv --version outputs uv 0.10.6 with a different system uv installed
• Benchmarked ./uv wrapper overhead: ~16ms (bash with builtin regex), details in #3032 comment

Self checklist (all need to be checked):

• Ensure that you have run make test (gmake on macOS) before asking for review
• Changes to everything except Dockerfile.konflux files should be done in odh/notebooks and automatically synced to rhds/notebooks. For Konflux-specific changes, modify Dockerfile.konflux files directly in rhds/notebooks as these require special attention in the downstream repository and flow to the upcoming RHOAI release.

Merge criteria:

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

Summary by CodeRabbit

• Documentation

  • Expanded setup guide for preparing Python, uv, and pytest environments, with examples and troubleshooting for pinned uv usage.

• New Features

  • Added a project-local uv wrapper that pins and delegates to a project-specified uv version for consistent local runs.
  • Added a config file to declare the pinned uv version.

• Chores

  • CI workflows, pre-commit configuration, and helper scripts updated to use the pinned-version workflow and the new wrapper.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a project-local uv wrapper and uv.toml pin (==0.10.6); updates GitHub workflows to use version-file: uv.toml; switches CI and scripts to invoke the repo-local ./uv (or ${REPO_ROOT}/uv); adjusts pre-commit hooks to local uv invocations; and updates docs.

Changes

Cohort / File(s)	Summary
GitHub workflows .github/workflows/build-notebooks-TEMPLATE.yaml, .github/workflows/code-quality.yaml, .github/workflows/docs.yaml, .github/workflows/piplock-renewal.yaml, .github/workflows/security.yaml	Renames step "Install the latest version of uv" to "Install uv"; replaces version: "latest" with version-file: uv.toml for astral-sh/setup-uv; piplock-renewal switches from pip install to the setup action; security.yaml moves checkout earlier and removes duplicate checkout.
Pre-commit configuration .pre-commit-config.yaml	Replaces remote uv hook with a local repo: local uv-lock hook running ./uv lock --locked; bumps ruff to v0.15.4, renames/adds ruff hooks, and changes Pyright to a local ./uv run pyright invocation.
Documentation README.md	Adds "Prepare Python + uv + pytest env" section; documents uv.toml pin and repo-local ./uv wrapper usage; replaces direct uv commands with ./uv and adds alternative commands and guidance for version mismatches.
Shell scripts ci/generate_code.sh, scripts/pylocks_generator.sh	ci/generate_code.sh computes script/repo roots, bumps pinned uv to 0.10.6, and calls ${REPO_ROOT}/uv; scripts/pylocks_generator.sh introduces UV="${ROOT_DIR}/uv", updates all uv invocations to use that wrapper, adds presence/version checks, uses an array for constraints flags, and documents tag-filter behavior.
uv wrapper & config uv, uv.toml	Adds a new Bash uv wrapper that reads required-version from uv.toml, fast-paths to system uv if versions match, otherwise runs pinned version via uv tool run uv@<version>; adds uv.toml with required-version = "==0.10.6".

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main objective: pinning the uv version to fix a CI failure, with the issue reference (#3032) providing traceability.
Description check	✅ Passed	The description is comprehensive, covering root cause, fix approach, specific changes, testing verification, and completing all required checklist items from the template.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

ci/generate_code.sh (1)

4-8: ⚠️ Potential issue | 🟠 Major

Version gate does not enforce the pinned uv release.

Line 4 only checks that uv exists. If a non-0.10.6 binary is installed, generation still runs with that version, which can reintroduce nondeterministic lockfile output.

Suggested fix

+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-uv --version || pip install "uv==0.10.6"
+command -v uv >/dev/null || pip install "uv==0.10.6"

-uv run scripts/dockerfile_fragments.py
-uv run manifests/tools/generate_kustomization.py
+"${REPO_ROOT}/uv" run scripts/dockerfile_fragments.py
+"${REPO_ROOT}/uv" run manifests/tools/generate_kustomization.py
 bash scripts/pylocks_generator.sh

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@ci/generate_code.sh` around lines 4 - 8, The current check only verifies `uv`
exists but not its version, so update the preflight to enforce the pinned 0.10.6
release: run `uv --version` and verify the output matches the exact version
(e.g., grep/compare to "0.10.6"), and if it does not match, install `uv==0.10.6`
(keep using the existing `pip install "uv==0.10.6"` fallback). Ensure the
verification uses the same `uv --version` command used currently and occurs
before the subsequent `uv run scripts/dockerfile_fragments.py` and `uv run
manifests/tools/generate_kustomization.py` invocations so generation only
proceeds when the exact version is present.

.github/workflows/security.yaml (1)

20-28: ⚠️ Potential issue | 🟠 Major

Move actions/checkout before setup-uv to ensure version pinning from uv.toml is discoverable.

The setup-uv@v7 action auto-detects the pinned version by reading required-version from uv.toml (or pyproject.toml) when no explicit version is provided. Since setup-uv currently runs before actions/checkout, the repository files are not yet in the workspace, causing the action to default to installing the latest version instead of the pinned requirement.

Reorder steps

+      - name: Checkout code
+        uses: actions/checkout@v6
+
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
           activate-environment: false
           ignore-empty-workdir: true
           enable-cache: false
-
-      - name: Checkout code
-        uses: actions/checkout@v6

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/security.yaml around lines 20 - 28, Swap the "Checkout
code" and "Install uv" steps so actions/checkout@v6 runs before
astral-sh/setup-uv@v7; specifically, move the step named "Checkout code" to
precede the step named "Install uv" so setup-uv can read required-version from
uv.toml/pyproject.toml and honor the pinned version when no explicit version is
supplied.

🧹 Nitpick comments (1)

README.md (1)

87-99: Consider adding a note about version synchronization.

The examples hardcode version 0.10.6 in multiple places (lines 87, 91, 96, 98). If the pinned version in uv.toml is updated, these examples would need manual updates to stay accurate.

Consider adding a brief note like: "Replace 0.10.6 with the version specified in uv.toml" to help prevent the examples from becoming stale.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` around lines 87 - 99, Add a short note near the examples that
hardcode "0.10.6" advising readers to replace that version with the one pinned
in uv.toml; specifically update the sections showing "uv tool run uv@0.10.6 sync
--locked", "uv@0.10.6 sync --locked" and the installer examples using
"https://astral.sh/uv/0.10.6/install.sh" and "pip install uv==0.10.6" to include
a sentence like "Replace 0.10.6 with the version specified in uv.toml" so the
examples stay correct when the pinned version changes.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In @.github/workflows/security.yaml:
- Around line 20-28: Swap the "Checkout code" and "Install uv" steps so
actions/checkout@v6 runs before astral-sh/setup-uv@v7; specifically, move the
step named "Checkout code" to precede the step named "Install uv" so setup-uv
can read required-version from uv.toml/pyproject.toml and honor the pinned
version when no explicit version is supplied.

In `@ci/generate_code.sh`:
- Around line 4-8: The current check only verifies `uv` exists but not its
version, so update the preflight to enforce the pinned 0.10.6 release: run `uv
--version` and verify the output matches the exact version (e.g., grep/compare
to "0.10.6"), and if it does not match, install `uv==0.10.6` (keep using the
existing `pip install "uv==0.10.6"` fallback). Ensure the verification uses the
same `uv --version` command used currently and occurs before the subsequent `uv
run scripts/dockerfile_fragments.py` and `uv run
manifests/tools/generate_kustomization.py` invocations so generation only
proceeds when the exact version is present.

---

Nitpick comments:
In `@README.md`:
- Around line 87-99: Add a short note near the examples that hardcode "0.10.6"
advising readers to replace that version with the one pinned in uv.toml;
specifically update the sections showing "uv tool run uv@0.10.6 sync --locked",
"uv@0.10.6 sync --locked" and the installer examples using
"https://astral.sh/uv/0.10.6/install.sh" and "pip install uv==0.10.6" to include
a sentence like "Replace 0.10.6 with the version specified in uv.toml" so the
examples stay correct when the pinned version changes.

---

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 0c62db8 and 35f6347.

📒 Files selected for processing (9)

• .github/workflows/build-notebooks-TEMPLATE.yaml
• .github/workflows/code-quality.yaml
• .github/workflows/docs.yaml
• .github/workflows/security.yaml
• .pre-commit-config.yaml
• README.md
• ci/generate_code.sh
• uv
• uv.toml

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/piplock-renewal.yaml (1)

78-79: Consider making uv version pinning explicit for clarity.

The setup-uv action already defaults to discovering uv.toml automatically, so the current configuration will use your uv.toml (which specifies required-version = "==0.10.6"). However, making this explicit via version-file: uv.toml improves readability and removes reliance on the action's default behavior, which could change in future versions.

Proposed change

       - name: Install uv
         uses: astral-sh/setup-uv@v7
+        with:
+          version-file: uv.toml

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/piplock-renewal.yaml around lines 78 - 79, The workflow
step using the action astral-sh/setup-uv@v7 should explicitly pin the uv tool
version by adding the version-file input; update the step that currently
contains "uses: astral-sh/setup-uv@v7" to include the parameter version-file:
uv.toml so the action reads the required-version from uv.toml explicitly (rather
than relying on the action's default discovery).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@uv`:
- Around line 35-36: Fast-path version check in the shell wrapper uses the
pattern [[ "$current" == "uv $version "* ]] which requires a trailing space and
therefore fails for outputs like "uv 0.10.6"; change the condition in the
wrapper (the if that assigns current with uv --version and then compares it) to
match the version as a prefix without requiring a trailing space (e.g., remove
the literal trailing space in the pattern or use a regex/pattern that accepts
end-of-line or whitespace after the version) so that outputs like "uv 0.10.6"
correctly take the fast path.

---

Nitpick comments:
In @.github/workflows/piplock-renewal.yaml:
- Around line 78-79: The workflow step using the action astral-sh/setup-uv@v7
should explicitly pin the uv tool version by adding the version-file input;
update the step that currently contains "uses: astral-sh/setup-uv@v7" to include
the parameter version-file: uv.toml so the action reads the required-version
from uv.toml explicitly (rather than relying on the action's default discovery).

---

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 0c62db8 and bbaf954.

📒 Files selected for processing (11)

• .github/workflows/build-notebooks-TEMPLATE.yaml
• .github/workflows/code-quality.yaml
• .github/workflows/docs.yaml
• .github/workflows/piplock-renewal.yaml
• .github/workflows/security.yaml
• .pre-commit-config.yaml
• README.md
• ci/generate_code.sh
• scripts/pylocks_generator.sh
• uv
• uv.toml

[atheo89]

/lgtm

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

README.md (1)

80-106: Consider noting that hardcoded versions may need updates.

The alternatives section references version 0.10.6 directly in multiple places (lines 84, 88, 92, 97, 99). While the comment on line 84 says "(replace 0.10.6 below with the version from uv.toml)", these could still become stale over time.

This is acceptable as-is since the note exists, but you might consider adding a brief reminder when updating uv.toml to also update this README section.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` around lines 80 - 106, The README alternatives block currently
hardcodes version "0.10.6" in several places; update the Alternatives section so
it either uses a single visible placeholder referencing uv.toml (e.g., mention
"replace with the version in uv.toml") or add a one-line reminder to update
these examples whenever uv.toml's required-version changes; target the
Alternatives to ./uv, uvx, and "uv tool run" examples and mention
uv.toml/required-version so maintainers know to keep examples in sync.

uv (1)

39-40: Consider adding a fallback for very old system uv versions.

The slow path assumes the system uv supports uv tool run, which was introduced in uv ~0.2.x. If a user has an extremely old uv, this will fail with a confusing error.

This is a minor edge case since most users will have recent uv versions, and the script already requires uv to be installed. The failure message from old uv would still point users in the right direction.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@uv` around lines 39 - 40, The slow-path line exec uv tool run "uv@${version}"
"$@" assumes the system uv supports the "tool run" subcommand; add a detection
branch before that exec which tests whether the installed uv supports "tool run"
(e.g., via checking uv --version or probing uv tool --help) and if it does not,
fall back to a clear error or alternative: either invoke a bundled/downloaded
uvx if available or print a concise, actionable message asking the user to
upgrade uv (or use uvx) and exit. Replace the direct exec of exec uv tool run
"uv@${version}" "$@" with this conditional logic so old uv installs are handled
gracefully.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ci/generate_code.sh`:
- Line 11: The call to scripts/pylocks_generator.sh should use the project's
pinned uv wrapper for consistency; replace the direct invocation with invoking
the wrapper (use "${REPO_ROOT}/uv" run scripts/pylocks_generator.sh) so the
pinned uv (0.10.6) is used like the earlier "${REPO_ROOT}/uv" invocations, or
alternatively update scripts/pylocks_generator.sh to call "${REPO_ROOT}/uv" for
any internal uv usage—locate the invocation in ci/generate_code.sh and the uv
calls in scripts/pylocks_generator.sh (if you choose the latter) and make them
use the "${REPO_ROOT}/uv" wrapper.

---

Nitpick comments:
In `@README.md`:
- Around line 80-106: The README alternatives block currently hardcodes version
"0.10.6" in several places; update the Alternatives section so it either uses a
single visible placeholder referencing uv.toml (e.g., mention "replace with the
version in uv.toml") or add a one-line reminder to update these examples
whenever uv.toml's required-version changes; target the Alternatives to ./uv,
uvx, and "uv tool run" examples and mention uv.toml/required-version so
maintainers know to keep examples in sync.

In `@uv`:
- Around line 39-40: The slow-path line exec uv tool run "uv@${version}" "$@"
assumes the system uv supports the "tool run" subcommand; add a detection branch
before that exec which tests whether the installed uv supports "tool run" (e.g.,
via checking uv --version or probing uv tool --help) and if it does not, fall
back to a clear error or alternative: either invoke a bundled/downloaded uvx if
available or print a concise, actionable message asking the user to upgrade uv
(or use uvx) and exit. Replace the direct exec of exec uv tool run
"uv@${version}" "$@" with this conditional logic so old uv installs are handled
gracefully.

---

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between bbaf954 and eff53b5.

📒 Files selected for processing (11)

• .github/workflows/build-notebooks-TEMPLATE.yaml
• .github/workflows/code-quality.yaml
• .github/workflows/docs.yaml
• .github/workflows/piplock-renewal.yaml
• .github/workflows/security.yaml
• .pre-commit-config.yaml
• README.md
• ci/generate_code.sh
• scripts/pylocks_generator.sh
• uv
• uv.toml

✅ Files skipped from review due to trivial changes (1)

• scripts/pylocks_generator.sh

🚧 Files skipped from review as they are similar to previous changes (6)

• .github/workflows/piplock-renewal.yaml
• .pre-commit-config.yaml
• uv.toml
• .github/workflows/docs.yaml
• .github/workflows/build-notebooks-TEMPLATE.yaml
• .github/workflows/security.yaml

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

scripts/pylocks_generator.sh (1)

93-100: ⚠️ Potential issue | 🟡 Minor

Validate the wrapper path explicitly before version probing.

You execute "$UV" but only preflight-check uv in PATH. If ${ROOT_DIR}/uv is missing or not executable, the script falls through to a misleading version error.

Suggested patch

-if ! command -v uv &>/dev/null; then
+if [[ ! -x "$UV" ]]; then
+  error "Expected uv wrapper at '$UV' but it is missing or not executable."
+  exit 1
+fi
+
+if ! command -v uv &>/dev/null; then
   error "uv command not found. Please install uv: https://github.com/astral-sh/uv"
   exit 1
 fi

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/pylocks_generator.sh` around lines 93 - 100, The script checks for
`uv` in PATH but later runs "$UV" without validating the `UV` wrapper path; add
an explicit validation before probing version: ensure the `UV` variable (used in
the UV_VERSION assignment) is set and points to an executable file (e.g., test
-x "$UV"), and if not, emit a clear error and exit; update the preflight block
that currently uses `command -v uv` and the UV_VERSION assignment to first
resolve and validate the wrapper path stored in `UV` (or fall back to `command
-v uv`) so the version probe never runs against a missing/non-executable path.

🧹 Nitpick comments (1)

scripts/pylocks_generator.sh (1)

291-316: Use an argument array for --constraints to avoid path-splitting edge cases.

constraints_flag is currently a plain string expanded unquoted; paths with spaces will split into multiple args.

Suggested patch

-    local constraints_flag=""
+    local -a constraints_flag=()
     if [[ -f "$CVE_CONSTRAINTS_FILE" ]]; then
       local relative_constraints
       # Use Python for cross-platform relative path computation (realpath --relative-to is GNU-only)
       relative_constraints=$(python3 -c "import os; print(os.path.relpath('$CVE_CONSTRAINTS_FILE', '$PWD'))")
-      constraints_flag="--constraints=$relative_constraints"
+      constraints_flag=(--constraints "$relative_constraints")
     fi
@@
-      $constraints_flag \
+      "${constraints_flag[@]}" \
       $index

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/pylocks_generator.sh` around lines 291 - 316, The constraints_flag
string can split on spaces when expanded unquoted; change it to an array and
pass it as an argument array to the pip compile invocation: when
CVE_CONSTRAINTS_FILE exists, compute relative_constraints and set
constraints_flag as an array like constraints_flag=(
"--constraints=$relative_constraints" ), then invoke the command expanding the
array as "${constraints_flag[@]}" alongside $UPGRADE_FLAG and $index so the
--constraints argument is passed as a single argument; update references to
constraints_flag and the pip call (the "$UV" pip compile ... block) accordingly.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@scripts/pylocks_generator.sh`:
- Around line 93-100: The script checks for `uv` in PATH but later runs "$UV"
without validating the `UV` wrapper path; add an explicit validation before
probing version: ensure the `UV` variable (used in the UV_VERSION assignment) is
set and points to an executable file (e.g., test -x "$UV"), and if not, emit a
clear error and exit; update the preflight block that currently uses `command -v
uv` and the UV_VERSION assignment to first resolve and validate the wrapper path
stored in `UV` (or fall back to `command -v uv`) so the version probe never runs
against a missing/non-executable path.

---

Nitpick comments:
In `@scripts/pylocks_generator.sh`:
- Around line 291-316: The constraints_flag string can split on spaces when
expanded unquoted; change it to an array and pass it as an argument array to the
pip compile invocation: when CVE_CONSTRAINTS_FILE exists, compute
relative_constraints and set constraints_flag as an array like
constraints_flag=( "--constraints=$relative_constraints" ), then invoke the
command expanding the array as "${constraints_flag[@]}" alongside $UPGRADE_FLAG
and $index so the --constraints argument is passed as a single argument; update
references to constraints_flag and the pip call (the "$UV" pip compile ...
block) accordingly.

---

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between eff53b5 and 013a25c.

📒 Files selected for processing (1)

• scripts/pylocks_generator.sh

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/pylocks_generator.sh`:
- Around line 299-301: The current python3 -c call embeds shell-expanded
$CVE_CONSTRAINTS_FILE and $PWD inside single quotes which breaks on paths
containing apostrophes; change the invocation so the shell passes those paths as
argv parameters and the inline Python reads sys.argv[1] and sys.argv[2] and
computes os.path.relpath on them, then assign that output to
relative_constraints and keep constraints_flag=(--constraints
"$relative_constraints"); ensure the shell side quotes the two positional
arguments when calling python3 so spaces and special chars are preserved.

---

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 013a25c and 781d4d3.

📒 Files selected for processing (1)

• scripts/pylocks_generator.sh

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Make relative-path computation safe for apostrophes in paths.

Line 300 embeds shell-expanded paths inside Python single-quoted literals; this breaks if either path contains '. Pass paths as argv instead.

💡 Proposed fix

-      relative_constraints=$(python3 -c "import os; print(os.path.relpath('$CVE_CONSTRAINTS_FILE', '$PWD'))")
+      relative_constraints=$(python3 -c 'import os,sys; print(os.path.relpath(sys.argv[1], sys.argv[2]))' \
+        "$CVE_CONSTRAINTS_FILE" "$PWD")

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	# Use Python for cross-platform relative path computation (realpath --relative-to is GNU-only)
	relative_constraints=$(python3 -c "import os; print(os.path.relpath('$CVE_CONSTRAINTS_FILE', '$PWD'))")
	constraints_flag="--constraints=$relative_constraints"
	constraints_flag=(--constraints "$relative_constraints")
	# Use Python for cross-platform relative path computation (realpath --relative-to is GNU-only)
	relative_constraints=$(python3 -c 'import os,sys; print(os.path.relpath(sys.argv[1], sys.argv[2]))' \
	"$CVE_CONSTRAINTS_FILE" "$PWD")
	constraints_flag=(--constraints "$relative_constraints")

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/pylocks_generator.sh` around lines 299 - 301, The current python3 -c
call embeds shell-expanded $CVE_CONSTRAINTS_FILE and $PWD inside single quotes
which breaks on paths containing apostrophes; change the invocation so the shell
passes those paths as argv parameters and the inline Python reads sys.argv[1]
and sys.argv[2] and computes os.path.relpath on them, then assign that output to
relative_constraints and keep constraints_flag=(--constraints
"$relative_constraints"); ensure the shell side quotes the two positional
arguments when calling python3 so spaces and special chars are preserved.

[jiridanek]

@coderabbitai recheck, fixed

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check the current state of the relative_constraints line in scripts/pylocks_generator.sh
cat scripts/pylocks_generator.sh | sed -n '295,305p'

Length of output: 497

---

@jiridanek, I can see that the array handling for constraints_flag has been fixed (great work on that!), but the apostrophe-in-path vulnerability on line 300 is still present:

Current code (line 300):

relative_constraints=$(python3 -c "import os; print(os.path.relpath('$CVE_CONSTRAINTS_FILE', '$PWD'))")

This still embeds $CVE_CONSTRAINTS_FILE and $PWD inside Python single-quoted strings, which will break if either path contains an apostrophe.

Required fix:

relative_constraints=$(python3 -c 'import os,sys; print(os.path.relpath(sys.argv[1], sys.argv[2]))' \
  "$CVE_CONSTRAINTS_FILE" "$PWD")

This passes the paths as command-line arguments to Python, avoiding string interpolation issues entirely.

[jiridanek]

@coderabbitai this is not worth fixing, rather, rewrite whole script to python

create github issue to do that

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Create a GitHub issue to rewrite pylocks_generator.sh to Python

gh issue create \
  --repo opendatahub-io/notebooks \
  --title "Rewrite scripts/pylocks_generator.sh to Python" \
  --body "## Context

The current \`scripts/pylocks_generator.sh\` bash script is complex and has some edge cases that are difficult to handle correctly in bash (e.g., paths containing apostrophes).

Rewriting it in Python would:
- Make the code more maintainable
- Avoid shell quoting and escaping pitfalls
- Leverage Python's built-in path handling and safer subprocess management
- Improve readability and testability

## References

- Related PR: `#3034`
- Discussion: https://github.com/opendatahub-io/notebooks/pull/3034#discussion_r2864644935
- Requested by: `@jiridanek`

## Scope

Rewrite \`scripts/pylocks_generator.sh\` as a Python script while preserving all existing functionality." \
  --assignee jiridanek

Length of output: 55

---

@jiridanek, understood! I've created issue #3036 to track rewriting scripts/pylocks_generator.sh to Python. The issue has been assigned to you and includes links back to this PR and discussion.

The issue is available at: #3036

[openshift-ci]

@jiridanek: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	781d4d3	link	true	/test images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.