Switch CI from pip to uv with supply chain protection (#85)

Switches pythontests and da_build actions from pip to uv.
(SuffolkLITLab/security#3)

Changes:
- Replaced setup-python and all pip calls with setup-uv and uv sync
- Added UV_EXCLUDE_NEWER=7 days env var so only packages older than 7
days get installed - protects against supply chain attacks
- Added uv audit in pythontests to scan for known CVEs
- pytest, mypy and bandit now run through uv run
- da_build uses uv pip install --system since it doesn't have a project
environment

Note: repos without [dependency-groups] in pyproject.toml fall back to
plain uv sync - still need to figure out how to handle those (like
ALThemeTemplate, ALRecipes, ALAnystate) that have no dev deps at all.

---------

Co-authored-by: Bryce Willey <bryce.willey@suffolk.edu>

Author: rajeswari1301

da_build/action.yml

@@ -20,21 +20,25 @@ runs:
   steps:
     - uses: actions/checkout@v6
 
-    - name: Set up Python
-      uses: actions/setup-python@v6
+    - name: Install uv
+      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
       with:
         python-version: ${{ inputs.python-version }}
 
+    - name: Set uv exclude-newer
+      run: echo "UV_EXCLUDE_NEWER=7 days" >> $GITHUB_ENV
+      shell: bash
+
     - name: Install dependencies
-      run: python -m pip install build "dayamlchecker>=1.2.0" --user
+      run: uv tool install "dayamlchecker>=1.2.0"
       shell: bash
 
     - name: Check syntax for all files
       run: python -m compileall . -q
       shell: bash
 
     - name: Build a binary wheel and a source tarball
-      run: python -m build --sdist --wheel --outdir dist/
+      run: uv build --sdist --wheel --outdir dist/
       shell: bash
 
     - name: Run YAML Checker
@@ -52,6 +56,7 @@ runs:
         if [ "${{ inputs.skip-templates }}" = "true" ]; then
           args+=(--skip-templates)
         fi
+
         if [ -n "${{ inputs.ignore-urls }}" ]; then
           args+=(--ignore-urls "${{ inputs.ignore-urls }}")
         fi
@@ -65,7 +70,7 @@ runs:
         if [ "$checker_status" -ne 0 ]; then
           exit "$checker_status"
         fi
-
+        
         # Surface warning lines as a single GitHub Actions annotation without failing the job.
         in_warning_block=false
         warning_text=""
@@ -80,7 +85,6 @@ runs:
           if [ -z "$line" ]; then
             continue
           fi
-
           if [ -n "$warning_text" ]; then
             warning_text+=$'\n'
           fi
@@ -93,4 +97,4 @@ runs:
           escaped="${escaped//$'\n'/'%0A'}"
           echo "::warning title=URL checker::$escaped"
         fi
-      shell: bash
+      shell: bash

pythontests/action.yml

@@ -1,5 +1,6 @@
 name: Run python only tests
 description: "Sets up running python tests for Assembly Line projects. Should work with both docassemble and non-docassemble projects"
+
 outputs:
   tests-passed:
     description: "If the tests passed"
@@ -10,48 +11,53 @@ runs:
   steps:
     - run: sudo apt-get update && sudo apt-get -y install libcurl4-openssl-dev build-essential python3-dev libldap2-dev libsasl2-dev slapd ldap-utils tox lcov libzbar0 libaugeas0 augeas-lenses
       shell: bash
+
     - run: echo "ISUNITTEST=true" >> $GITHUB_ENV
       shell: bash
+
     - uses: actions/checkout@v6
-    - uses: actions/setup-python@v6
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
       with:
         python-version: '3.12'
-        cache: 'pip'
-        cache-dependency-path: |
-            pyproject.toml
-            **/requirements.txt
-    - run: python -m venv venv
+
+    - name: Set uv exclude-newer config
+      run: echo "UV_EXCLUDE_NEWER=7 days" >> $GITHUB_ENV
       shell: bash
-    - run: source venv/bin/activate
-      shell: bash            
-    - run: pip install wheel pytest
+
+    - name: Install dependencies
+      run: |
+        if grep -q "\[dependency-groups\]" pyproject.toml 2>/dev/null; then
+          uv sync --group dev
+        else
+          uv sync
+        fi
       shell: bash
-    - run: |
-          if [ -n "$(find . -name requirements.txt)" ]; then
-            pip install -v -r $(find . -name requirements.txt)
-          else
-            pip install -v --group dev .
-          fi
-      shell: bash
-    - run: pip install -v --editable . 
-      shell: bash  
+
+    #- name: Run uv audit
+      #run: uv audit
+      #shell: bash
+
     - run: export PYTHONPATH=$PYTHONPATH:$GITHUB_WORKSPACE
       shell: bash
-    - run: python -m mypy . --exclude '^build/' --explicit-package-bases
-      shell: bash
+
     - run: |
         if [[ -f docassemble/__init__.py ]]; then
           mv docassemble/__init__.py docassemble/__init__.py.bak
         fi
       shell: bash
+
+    - run: uv run mypy . --exclude '^build/' --explicit-package-bases
+      shell: bash
+
     - name: Run Bandit security scan
-      run: |
-        pip install bandit
-        bandit -r . --exclude './scripts,./venv,./build' --severity-level=high
+      run: uv tool run bandit -r . --exclude './scripts,./venv,./.venv,./build' --severity-level=high
       shell: bash
-    - run: |
-        pytest
-      shell: bash      
+
+    - run: uv run pytest
+      shell: bash
+
     - id: output-step
       run: echo "test-outputs=$?" >> $GITHUB_OUTPUT
       shell: bash