From 661946dfc1989181b06c3f52302d9a45a098a46c Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Mon, 10 Aug 2026 14:57:09 +0900 Subject: [PATCH] fix(ci): use locked tooling for image verification --- .github/workflows/publish-image.yml | 8 +++++--- tests/release/test_image_contracts.py | 13 +++++++++++++ 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml index 200bf29..61511f2 100644 --- a/.github/workflows/publish-image.yml +++ b/.github/workflows/publish-image.yml @@ -29,13 +29,15 @@ jobs: cache: pip - name: Install repository checks - run: python -m pip install ".[dev]" + run: | + python -m pip install "uv==0.11.14" + uv sync --extra dev --locked - name: Run repository lint - run: ruff check . + run: uv run ruff check . - name: Run repository tests - run: pytest + run: uv run pytest - name: Create excluded synthetic canary run: | diff --git a/tests/release/test_image_contracts.py b/tests/release/test_image_contracts.py index 8e596ba..c18b358 100644 --- a/tests/release/test_image_contracts.py +++ b/tests/release/test_image_contracts.py @@ -73,6 +73,19 @@ exit "${scan_status}"''' ) +def test_repository_checks_use_the_locked_uv_environment(): + steps = _workflow()["jobs"]["verify"]["steps"] + install = steps[_step_index(steps, "Install repository checks")]["run"] + lint = steps[_step_index(steps, "Run repository lint")]["run"] + tests = steps[_step_index(steps, "Run repository tests")]["run"] + + assert 'python -m pip install "uv==0.11.14"' in install + assert "uv sync --extra dev --locked" in install + assert lint == "uv run ruff check ." + assert tests == "uv run pytest" + assert 'pip install ".[dev]"' not in install + + def test_tested_image_id_is_recorded_after_smoke_and_transferred_to_publish(): workflow = _workflow() verify_steps = workflow["jobs"]["verify"]["steps"]