chore: pin uv version and drop --verbose from deploy logs

[gkrimer]

Problem

setup-uv's working-directory defaults to the consumer's checkout, not the action's. So on every deploy it probed e.g. filing-service's Rails root for a uv version pin, found nothing, and installed uv latest (real log, filing-service run 30319696325):

Trying to find version for uv in: /home/runner/work/filing-service/filing-service/uv.toml
Could not find file: /home/runner/work/filing-service/filing-service/uv.toml
Trying to find version for uv in: /home/runner/work/filing-service/filing-service/pyproject.toml
Could not find file: /home/runner/work/filing-service/filing-service/pyproject.toml
Could not determine uv version from uv.toml or pyproject.toml. Falling back to latest.
Fetching version data from https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson ...
Downloading uv from ".../uv/releases/download/0.11.32/uv-x86_64-unknown-linux-gnu.tar.gz" ...

uv.lock + --frozen pin the 17 dependencies and #12 added --locked to gate lockfile drift — then the tool doing the installing floated to whatever shipped that morning, across all 11 repos consuming this action at @main, with no PR to review.

Nothing was broken: setup-uv puts the binary on PATH globally (/opt/hostedtoolcache/uv/0.11.32/x86_64/uv), and the sync/run steps already set working-directory. But the version pin and the cache key both came from the wrong project.

Second, --verbose was hardcoded into action.yml. It hits logging.basicConfig, which configures the root logger — so GitPython and urllib3 inherit DEBUG and log every subprocess and API call into the deploy output, around 3 useful lines of our own.

Changes

File	Change
action.yml	working-directory: ${{ github.action_path }} on the setup-uv step
pyproject.toml	required-version = "==0.11.32"
.tool-versions	uv 0.10.9 → 0.11.32 — local was two minors behind the runner
action.yml, smoke-test.sh	drop --verbose

0.11.32 is what CI and both production runs have already been passing with. ci.yml needs no change: its workspace is this repo, so setup-uv now picks up required-version automatically — meaning this PR's own CI run validates the mechanism.

Pointing setup-uv at the action also drops the consumer's Python version from the cache key. It was keyed on an irrelevant dimension — filing-service unknown, instrumentl 3.12.3 — while the action always runs on its own 3.11:

filing-service: setup-uv-2-x86_64-unknown-linux-gnu-ubuntu-24.04-unknown-pruned-e075f184…
instrumentl:    setup-uv-2-x86_64-unknown-linux-gnu-ubuntu-24.04-3.12.3-pruned-e075f184…

How to test this

Before — the deploy log for every consumer:

❯ ./smoke-test.sh
==> step 2: uv run --frozen --no-dev python create_tag.py ...
DEBUG:git.util:sys.platform='darwin', git_executable='git'
DEBUG:git.cmd:Popen(['git', 'cat-file', '--batch-check'], cwd=/var/folders/.../tmp.2kK1GBETYP, stdin=<valid stream>, shell=False, universal_newlines=False)
DEBUG:root:scanning all existing tags
DEBUG:git.cmd:Popen(['git', 'cat-file', '--batch'], cwd=/var/folders/.../tmp.2kK1GBETYP, stdin=<valid stream>, shell=False, universal_newlines=False)
DEBUG:root:found last tag of v2.202604010000.1
DEBUG:git.cmd:Popen(['git', 'merge-base', 'v2.202604010000.1', 'ad6dd2b...'], cwd=..., stdin=None, shell=False, universal_newlines=False)
DEBUG:git.cmd:Popen(['git', 'rev-list', '62d4e5b..ad6dd2b', '--'], cwd=..., stdin=None, shell=False, universal_newlines=False)
DEBUG:root:examining commit ad6dd2b1151129e29fd6fae0562b6c0b9e26a453
DEBUG:root:examining commit 5e139a4cdb73da85e9e58dc0769c94bb5981126d
DEBUG:root:examining commit c268582935598f827d41d9385b2e17dc866c8f1e
DEBUG:git.cmd:Popen(['git', 'tag', '-m', 'deployment of ad6dd2b... to production at ...'], cwd=..., stdin=None, shell=False, universal_newlines=False)
tag_name=v2.202604241844.4477349984
release_body_path=release_notes-v2.202604241844.4477349984.txt
commit_authors=
==> asserting outputs
==> smoke test OK

After:

❯ mise exec -- ./smoke-test.sh
==> step 2: uv run --frozen --no-dev python create_tag.py ...
tag_name=v2.202604241844.4477349984
release_body_path=release_notes-v2.202604241844.4477349984.txt
commit_authors=
==> asserting outputs
==> smoke test OK

Full local suite against the pinned uv:

❯ mise exec -- uv --version
uv 0.11.32 (3010295ae 2026-07-23 aarch64-apple-darwin)

❯ mise exec -- uv sync --locked
Resolved 27 packages in 5ms
Checked 25 packages in 7ms

❯ mise exec -- bash -c 'uv run python -m py_compile create_tag.py && uv run ruff check && uv run ruff format --check && uv run pyright && uv run pytest -q'
ok
All checks passed!
2 files already formatted
0 errors, 0 warnings, 0 informations
.........                                                                [100%]
9 passed in 0.98s

Notes for the reviewer

• The action.yml half is not verified by CI. CI never runs the composite action, so working-directory finding required-version is only proven on a real consumer deploy. Expect Trying to find version for uv in: /home/runner/work/_actions/.../pyproject.toml and an exact 0.11.32 install instead of the manifest fetch.
• required-version is enforced by uv itself on every invocation, which is why .tool-versions moves in lockstep. Upgrades now need both files edited together, and Dependabot won't propose them — deliberate review over silent drift.

🤖 Generated with Claude Code