build: add supply chain hardening via uv exclude-newer and pip uploaded-prior-to#3258

Draft

julian-risch wants to merge 2 commits intomainfrom

supply-chain-hardening

Member

julian-risch commented Apr 30, 2026

Related Issues

fixes #issue-number

Proposed Changes:

Add uv.toml with exclude-newer = "24 hours" so all uv pip installs skip packages published within the last day
Add Dependabot cooldown (default-days: 1) for github-actions and pip
Upgrade pip before each pip install step and add --uploaded-prior-to=P1D (pip 26.1 relative duration) to all direct pip install commands in CI

How did you test it?

Notes for the reviewer

Checklist

I have read the contributors guidelines and the code of conduct
I have updated the related issue with new insights and changes
I added unit tests and updated the docstrings
I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test:.


          chore: add supply chain hardening via uv exclude-newer and pip cooldowns

a838929

- Add uv.toml with exclude-newer = "24 hours" so all uv pip installs
  skip packages published within the last day
- Add Dependabot cooldown (default-days: 1) for github-actions and pip
- Upgrade pip before each pip install step and add --uploaded-prior-to=P1D
  (pip 26.1 relative duration) to all direct pip install commands in CI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions Bot added topic:CI integration:chroma integration:elasticsearch integration:opensearch integration:unstructured-fileconverter integration:cohere integration:jina integration:qdrant integration:pinecone integration:amazon-bedrock integration:ollama integration:llama_cpp integration:weaviate integration:astra integration:amazon-sagemaker integration:supabase integration:pgvector integration:deepeval integration:fastembed integration:ragas integration:mongodb-atlas integration:mistral integration:optimum integration:nvidia integration:anthropic integration:langfuse integration:snowflake integration:azure-ai-search integration:weave labels

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (unstructured)

This PR does not seem to contain any modification to coverable code.


          chore: fix Dependabot pip config to cover all integration packages

bf7a1b6

The previous pip entry pointed at '/' (root has no Python packages).
Switch to directories: ["integrations/*"] so Dependabot actually scans
all 62 integration pyproject.toml files in the monorepo.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (qdrant)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (mongodb_atlas)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (meta_llama)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (togetherai)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (kreuzberg)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (pgvector)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (amazon_sagemaker)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (deepeval)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (stackit)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (snowflake)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (mcp)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (supabase)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (google_genai)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (valkey)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (oracle)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (opensearch)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (ragas)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (elasticsearch)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (paddleocr)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (libreoffice)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (ollama)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (hanlp)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (optimum)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (docling)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (chonkie)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (llama_cpp)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (vllm)

This PR does not seem to contain any modification to coverable code.

Contributor

github-actions Bot commented Apr 30, 2026

Coverage report (unstructured)

This PR does not seem to contain any modification to coverable code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment