uv installation shenanigans

[anantshri]

We have requirements-uv.txt

but we are still directly installing it in buildscripts

https://github.com/cyfinoid/keychecker/blob/main/.github/workflows/ci.yml#L24
https://github.com/cyfinoid/keychecker/blob/main/.github/workflows/publish.yml#L39
https://github.com/cyfinoid/keychecker/blob/main/.github/workflows/publish.yml#L71

This should ideally be abstracted out to pip install of uv with hashes and then the #1 kind of requests would make sense to update

[ai-anant]

🤖 Watchdog analysis

Issue: cyfinoid/keychecker#3 — uv installation shenanigans

Root cause

The issue was filed (2025-08-23) when ci.yml/publish.yml directly installed uv via pip inside the workflow steps while a requirements-uv.txt hash-pinned file existed separately. Since then the repo has evolved:

• The GitHub Actions workflows already migrated to the astral-sh/setup-uv action with a pinned version: "0.12.0" (ci.yml lines 24-27, 46-49, 74-77, 109-112; publish.yml lines 38-41, 70-73, 103-106, 204-207). So the CI part of the original complaint is resolved.
• However, the local/script install path was left inconsistent, which is the remaining "shenanigans":
  • scripts/install.sh still had a stale fallback pip install uv==0.11.32 (Windows branch, line 46) — this violates pyproject.toml [tool.uv] required-version = ">=0.12.0,<0.13.0" and would make uv sync fail if the fallback were ever hit.
  • macOS/Linux branches used the unpinned https://astral.sh/uv/install.sh (installs latest uv, not the project-pinned 0.12.0).
  • scripts/README.md still documented "Version: 0.11.32".
  • scripts/setup-dev.sh suggested the unpinned curl installer.

Existing PR status

No PR addressed issue #3 before this run. The only open PR at the time, #5 "uv Cache Integration" (by prgyn8), is about uv caching/ruff and references issue #4, not #3. Note: dependabot's closed "Bump uv" PRs (#36/#37/#44) bumped versions in workflows but did not touch install.sh or the hashed requirements file.

Fix — PR #46 (opened by this watchdog)

PR: #46 (Fixes #3)

Changes:

• scripts/install.sh
  • Added a single UV_VERSION="0.12.0" variable at the top as the source of truth (matches requirements-uv.txt and pyproject.toml's required-version).
  • macOS/Linux now use the versioned installer https://astral.sh/uv/${UV_VERSION}/install.sh instead of the unpinned latest installer.
  • Windows fallback fixed from stale uv==0.11.32 to uv==${UV_VERSION}.
  • Fixed minor indentation in the success message block.
• scripts/setup-dev.sh — curl hint now points at the versioned 0.12.0 installer.
• scripts/README.md — updated "Version: 0.11.32" → "Version: 0.12.0".

Verification

• bash -n scripts/install.sh scripts/setup-dev.sh → syntax OK
• pytest tests/ → 6 passed
• https://astral.sh/uv/0.12.0/install.sh → HTTP 200 (verified the versioned URL is valid)
• grep confirms no remaining 0.11.32 or unpinned astral.sh/uv/install.sh references in scripts/ or .github/
• PR CI: all jobs pass (test matrix 3.10–3.13, lint, security/Bandit, build, osv-scanner).

Suggested follow-ups (not blocking)

• requirements-uv.txt is the hashed pin for the pip-based install path; UV_VERSION in install.sh and the version: pins in the GitHub Actions (setup-uv action) should be kept in sync whenever uv is bumped. Consider adding a tiny CI check that asserts UV_VERSION == $(grep '^uv==' requirements-uv.txt) to prevent drift.
• The setup-uv action (used in workflows) also accepts a version input — if you want a single source of truth across CI and scripts, you could read UV_VERSION from an env var / file, but that's a larger refactor than this quick fix.