From c7a90701dbb3cbfb70d36331ba46cf3a41872b48 Mon Sep 17 00:00:00 2001
From: Greg Krimer <greg.krimer@instrumentl.com>
Date: Mon, 27 Jul 2026 19:15:50 -0700
Subject: [PATCH] chore: pin uv version and drop --verbose from deploy logs

setup-uv's working-directory defaults to the *consumer's* checkout, so every
deploy probed e.g. filing-service's Rails root for a uv version pin, found
nothing, and installed uv latest:

  Trying to find version for uv in: /home/runner/work/filing-service/filing-service/pyproject.toml
  Could not find file: /home/runner/work/filing-service/filing-service/pyproject.toml
  Could not determine uv version from uv.toml or pyproject.toml. Falling back to latest.

uv.lock + --frozen pin the 17 dependencies, but the tool installing them
floated to whatever shipped that morning -- across all 11 repos consuming this
action at @main, with no PR to review. Nothing was broken (setup-uv puts the
binary on PATH globally; the sync/run steps already set working-directory), but
the version pin and the cache key both came from the wrong project.

- action.yml: working-directory -> github.action_path, so setup-uv reads our
  pyproject.toml. Also drops the consumer's Python version from the cache key
  (filing-service keyed on "unknown", instrumentl on "3.12.3", both irrelevant
  -- the action always runs on its own 3.11)
- pyproject.toml: required-version = "==0.11.32", the version CI and both
  production runs have been passing with
- .tool-versions: uv 0.10.9 -> 0.11.32; local was two minors behind the runner
- action.yml, smoke-test.sh: drop --verbose. It set the *root* logger to DEBUG,
  so GitPython logged every subprocess and urllib3 every API call into the
  deploy log alongside our own three lines

ci.yml needs no change: its workspace is this repo, so setup-uv now picks up
required-version automatically.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .tool-versions | 2 +-
 action.yml     | 6 +++++-
 pyproject.toml | 4 ++++
 smoke-test.sh  | 1 -
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.tool-versions b/.tool-versions
index f5146e4..b504ac0 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
-uv 0.10.9
+uv 0.11.32
 nodejs 20.19.4
diff --git a/action.yml b/action.yml
index 2d12475..6775658 100644
--- a/action.yml
+++ b/action.yml
@@ -32,6 +32,10 @@ runs:
   steps:
     - uses: astral-sh/setup-uv@v7
       with:
+        # Defaults to the consumer's checkout, where setup-uv looks for a uv version
+        # and a Python version that have nothing to do with this action. Pointing it
+        # here lets it find our required-version instead of installing uv latest.
+        working-directory: ${{ github.action_path }}
         enable-cache: true
         cache-dependency-glob: ${{ github.action_path }}/uv.lock
     - name: Install dependencies
@@ -42,7 +46,7 @@ runs:
       id: create-tag
       shell: bash
       working-directory: ${{ github.action_path }}
-      run: uv run --frozen --no-dev python create_tag.py --verbose --prefix ${{ inputs.prefix }} --timestamp-format ${{ inputs.timestamp_format }} --token ${{ inputs.token }} --repository ${{ github.repository }} ${{ inputs.timestamp }} ${{ inputs.deployment_id }}
+      run: uv run --frozen --no-dev python create_tag.py --prefix ${{ inputs.prefix }} --timestamp-format ${{ inputs.timestamp_format }} --token ${{ inputs.token }} --repository ${{ github.repository }} ${{ inputs.timestamp }} ${{ inputs.deployment_id }}
       env:
         GIT_AUTHOR_NAME: "Instrumentl GitHub Actions Bot"
         GIT_COMMITTER_NAME: "Instrumentl GitHub Actions Bot"
diff --git a/pyproject.toml b/pyproject.toml
index 9e23262..c034b78 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,6 +18,10 @@ dev = [
 
 [tool.uv]
 package = false
+# uv.lock + --frozen pin the dependencies; this pins the tool that installs them.
+# setup-uv reads it, so the runner stops falling back to "whatever shipped today"
+# across every repo consuming this action at @main. Keep in sync with .tool-versions.
+required-version = "==0.11.32"
 
 [tool.ruff]
 line-length = 100
diff --git a/smoke-test.sh b/smoke-test.sh
index a40086f..4e1e84b 100755
--- a/smoke-test.sh
+++ b/smoke-test.sh
@@ -41,7 +41,6 @@ GITHUB_SHA="$HEAD_SHA" \
 GITHUB_ACTOR="smoke-test" \
 GITHUB_OUTPUT="$SANDBOX/github_output.txt" \
 uv run --frozen --no-dev python create_tag.py \
-  --verbose \
   --prefix v2. \
   --timestamp-format "%Y%m%d%H%M" \
   --token none \