build: add uv exclude-newer, pip uploaded-prior-to and Dependabot cooldown as supply chain guardrails (#11170)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: julian-risch

.github/dependabot.yml

@@ -4,3 +4,12 @@ updates:
     directory: '/'
     schedule:
       interval: 'daily'
+    cooldown:
+      default-days: 1
+
+  - package-ecosystem: 'pip'
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    cooldown:
+      default-days: 1

.github/workflows/check_api_ref.yml

@@ -65,7 +65,9 @@ jobs:
 
       - name: Install Hatch
         if: steps.changed.outputs.needs_check == 'true'
-        run: pip install hatch
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch --uploaded-prior-to=P1D
 
       - name: Generate API references
         if: steps.changed.outputs.needs_check == 'true'

.github/workflows/docs-website-test-docs-snippets.yml

@@ -38,15 +38,17 @@ jobs:
           python-version: '3.11'
 
       - name: Install Hatch
-        run: pip install hatch==${{ env.HATCH_VERSION }}
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D
 
       - name: Generate API reference for Docusaurus
         run: hatch run docs
 
       - name: Install base dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install requests toml
+          pip install requests toml --uploaded-prior-to=P1D
 
       - name: Run snippet tests (verbose)
         shell: bash

.github/workflows/docs_search_sync.yml

@@ -38,7 +38,9 @@ jobs:
       - name: Install script dependencies
         # sniffio is needed because of https://github.com/deepset-ai/deepset-cloud-sdk/issues/286
         # we pin pyrate-limiter due to https://github.com/deepset-ai/deepset-cloud-sdk/issues/295
-        run: pip install deepset-cloud-sdk sniffio requests "pyrate-limiter<4"
+        run: |
+          python -m pip install --upgrade pip
+          pip install deepset-cloud-sdk sniffio requests "pyrate-limiter<4" --uploaded-prior-to=P1D
 
       - name: Update new docs to Search pipeline and remove outdated docs
         env:

.github/workflows/docusaurus_sync.yml

@@ -30,7 +30,9 @@ jobs:
           python-version: "${{ env.PYTHON_VERSION }}"
 
       - name: Install Hatch
-        run: pip install hatch==${{ env.HATCH_VERSION }}
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D
 
       - name: Generate API reference for Docusaurus
         run: hatch run docs

.github/workflows/e2e.yml

@@ -34,7 +34,9 @@ jobs:
         python-version: "${{ env.PYTHON_VERSION }}"
 
     - name: Install Hatch
-      run: pip install hatch==${{ env.HATCH_VERSION }}
+      run: |
+        python -m pip install --upgrade pip
+        pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D
 
     - name: Run tests
       run: hatch run e2e:test

.github/workflows/github_release.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Install reno
         run: |
           python -m pip install --upgrade pip
-          pip install "reno<5"
+          pip install "reno<5" --uploaded-prior-to=P1D
 
       # Remove next version rc0 tag in the CI environment to prevent reno from assigning notes to future releases.
       # This ensures release notes are correctly aggregated for the current version.

.github/workflows/license_compliance.yml

@@ -29,7 +29,8 @@ jobs:
 
       - name: Get direct dependencies
         run: |
-          pip install toml
+          python -m pip install --upgrade pip
+          pip install toml --uploaded-prior-to=P1D
           python .github/utils/pyproject_to_requirements.py pyproject.toml > ${{ env.REQUIREMENTS_FILE }}
 
       - name: Check Licenses

.github/workflows/nightly_testpypi_release.yml

@@ -36,7 +36,9 @@ jobs:
           echo "Building haystack-ai version: ${NIGHTLY_VERSION}"
 
       - name: Install Hatch
-        run: pip install hatch==${{ env.HATCH_VERSION }}
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D
 
       - name: Build Haystack
         run: hatch build

.github/workflows/pypi_release.yml

@@ -22,7 +22,9 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Hatch
-        run: pip install hatch==${{ env.HATCH_VERSION }}
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D
 
       - name: Build Haystack
         run: hatch build