Merge branch 'main' into sd-db/chore/dependabot-security-only

Author: sd-db

.github/actions/setup-python-deps/action.yml

@@ -18,6 +18,7 @@ runs:
         path: |
           ~/.cache/uv
           ~/.cache/pip
+          ~/.cache/pip-wheelhouse
         key: python-deps-${{ hashFiles('uv.lock', 'pyproject.toml') }}-latest
         restore-keys: python-deps-${{ hashFiles('uv.lock', 'pyproject.toml') }}-
 
@@ -33,6 +34,6 @@ runs:
       shell: bash
       run: |
         echo "UV_OFFLINE=true" >> "$GITHUB_ENV"
+        echo "UV_INDEX_URL=https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV"
         echo "PIP_NO_INDEX=1" >> "$GITHUB_ENV"
-        mkdir -p ~/.config/pip
-        printf '[global]\nno-index = true\n' > ~/.config/pip/pip.conf
+        echo "PIP_FIND_LINKS=$HOME/.cache/pip-wheelhouse" >> "$GITHUB_ENV"

.github/workflows/main.yml

@@ -52,7 +52,6 @@ jobs:
 
     env:
       UV_FROZEN: "1"
-      UV_CACHE_DIR: /home/runner/.cache/uv
 
     steps:
       - name: Check out the repository
@@ -73,6 +72,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+        with:
+          cache-local-path: ~/.cache/uv
 
       - name: Install Hatch
         uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
@@ -100,7 +101,6 @@ jobs:
 
     env:
       UV_FROZEN: "1"
-      UV_CACHE_DIR: /home/runner/.cache/uv
 
     strategy:
       fail-fast: false
@@ -126,6 +126,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+        with:
+          cache-local-path: ~/.cache/uv
 
       - name: Install Hatch
         uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
@@ -156,7 +158,6 @@ jobs:
 
     env:
       UV_FROZEN: "1"
-      UV_CACHE_DIR: /home/runner/.cache/uv
 
     steps:
       - name: Check out the repository
@@ -177,6 +178,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+        with:
+          cache-local-path: ~/.cache/uv
 
       - name: Install Hatch
         uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install

.github/workflows/warmDepsCache.yml

@@ -18,7 +18,6 @@ on:
       - "uv.lock"
       - "pyproject.toml"
       - ".pre-commit-config.yaml"
-  pull_request: # TEMPORARY: remove after testing
   schedule:
     - cron: "0 6 * * *" # Daily at 06:00 UTC
   workflow_dispatch:
@@ -41,9 +40,6 @@ jobs:
 
     env:
       UV_FROZEN: "1"
-      # Pin cache dir so setup-uv doesn't override it to a temp path.
-      # Must match the path in setup-python-deps/action.yml cache restore.
-      UV_CACHE_DIR: /home/runner/.cache/uv
 
     steps:
       - name: Checkout main branch
@@ -65,8 +61,6 @@ jobs:
 
           echo "Warming cache for PR #${{ inputs.pr_number }} from ${FORK_REPO}@${FORK_REF}"
 
-          # Fetch only lockfiles from the fork — .github/actions/ always
-          # comes from main to prevent code injection from forks.
           git remote add fork "https://github.com/${FORK_REPO}.git"
           git fetch --depth=1 fork "${FORK_REF}"
           git checkout FETCH_HEAD -- uv.lock pyproject.toml .pre-commit-config.yaml
@@ -81,14 +75,16 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
+        with:
+          cache-local-path: ~/.cache/uv
 
       - name: Install Hatch
         uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
 
       - name: Install Python versions for test matrix
-        run: uv python install 3.10 3.11 3.12 3.13
+        run: uv python install 3.11 3.12 3.13
 
-      - name: Create all hatch environments (populates uv cache)
+      - name: Create hatch environments (populates uv cache)
         run: |
           set -euo pipefail
           hatch env create default
@@ -101,21 +97,31 @@ jobs:
       - name: Warm pre-commit cache
         run: hatch run pre-commit install-hooks
 
-      - name: Build and warm pip cache for verify environment
+      - name: Create pip wheelhouse
         run: |
           set -euo pipefail
-          hatch -v build
-          # Run verify to populate ~/.cache/pip/ with runtime transitive deps.
-          # Allow failure — we only care about populating the cache.
-          hatch run verify:check-all || true
+          mkdir -p ~/.cache/pip-wheelhouse
+          hatch run python -c "
+          try:
+              import tomllib
+          except ImportError:
+              import tomli as tomllib
+          with open('pyproject.toml', 'rb') as f:
+              data = tomllib.load(f)
+          for dep in data['project']['dependencies']:
+              print(dep)
+          " > /tmp/runtime-deps.txt
+          hatch run pip download --dest ~/.cache/pip-wheelhouse \
+            setuptools wheel twine check-wheel-contents \
+            -r /tmp/runtime-deps.txt
+
+      - name: Build package
+        run: hatch -v build
 
       - name: Generate cache key
         id: cache-key
         shell: bash
         run: |
-          # Hash first so consumers can prefix-match on the hash alone.
-          # Timestamp suffix ensures each run creates a new immutable entry;
-          # consumers pick the latest timestamp for a given hash.
           TIMESTAMP=$(date -u +%Y%m%d%H%M%S)
           LOCK_HASH="${{ hashFiles('uv.lock', 'pyproject.toml') }}"
           echo "python-deps-key=python-deps-${LOCK_HASH}-${TIMESTAMP}" >> "$GITHUB_OUTPUT"
@@ -129,6 +135,7 @@ jobs:
           path: |
             ~/.cache/uv
             ~/.cache/pip
+            ~/.cache/pip-wheelhouse
           key: ${{ steps.cache-key.outputs.python-deps-key }}
 
       - name: Save pre-commit cache