-
Notifications
You must be signed in to change notification settings - Fork 1
feat(CI): 👷 Create a reusable workflow for UV and make UV lockfile frozen #94
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
6cb592b to
8ebaf69
Compare
Signed-off-by: Lala Sabathil <aiko@aitsys.dev>
Signed-off-by: Lala Sabathil <aiko@aitsys.dev>
Replaces local sync-uv.yml workflow references with remote workflow from pycord-development/pycord-next repository in all affected GitHub Actions YAML files. This ensures the latest shared workflow is used for setup steps.
Changed the reference for pycord-next/.github/workflows/sync-uv.yml from 'main' to 'master' in all relevant GitHub workflow files to ensure correct branch usage for setup steps.
49005a5 to
0fdf0f6
Compare
Replaces the workflow-based sync-uv implementation with a reusable composite action in .github/actions/sync-uv/action.yml. Updates all workflows to use the new action for dependency synchronization, improving maintainability and modularity.
Updates environment variable assignment to explicitly check for 'true' string values in inputs.no_python_downloads and inputs.frozen, ensuring correct behavior when setting UV_NO_PYTHON_DOWNLOADS and UV_FROZEN.
Refactored the scripts for building group and extra arguments to use explicit if statements for non-empty values and added 'set -x' for debugging. Also added '|| exit 0' to the output commands to prevent failures if output writing fails.
Signed-off-by: Paillat <paillat@pycord.dev>
Signed-off-by: Paillat-dev <paillat@pycord.dev>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR creates a reusable GitHub Actions workflow for UV dependency management and enables frozen lockfile mode to enhance supply chain security. The changes consolidate UV setup and sync operations across multiple workflow files.
Key Changes:
- Created a new reusable action (
.github/actions/sync-uv/action.yml) that handles UV installation and dependency synchronization with configurable groups and extras - Updated all workflow files to use the new reusable action and downgraded Python version from 3.14 to 3.13
- Enabled frozen lockfile mode by default to prevent unexpected dependency updates
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
.github/actions/sync-uv/action.yml |
New reusable action that installs UV and syncs dependencies with frozen lockfile enabled by default |
.github/workflows/sync-guild-features.yml |
Refactored to use new UV action with dev and ci groups |
.github/workflows/lib-checks.yml |
Updated all jobs to use new UV action with dev group |
.github/workflows/docs-localization-upload.yml |
Migrated to new UV action with docs groups and speed/voice extras |
.github/workflows/docs-localization-download.yml |
Migrated to new UV action with docs groups and speed/voice extras |
.github/workflows/docs-checks.yml |
Updated to use new UV action with dev and docs groups |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Summary
Use frozen lockfile to reduce risk of supply chain attacks
Information
examples, ...).
Checklist
type: ignorecomments were used, a comment is also left explaining why.