chore: migrate CI from Hatch to uv native (uv sync / uv run)

[julian-risch]

Summary

Migrates all CI workflows from Hatch to uv's native project interface, so that the exclude-newer supply chain guardrail (introduced in the base PR) is actually enforced during dependency installation.

Depends on: #11170

Background

Hatch uses uv pip install under the hood when installer = "uv" is set, but the uv pip interface does not read [tool.uv] project-level settings — including exclude-newer. This means the 24-hour age guardrail added in the base PR had no effect on what Hatch actually installed in CI. Switching to uv sync + uv run fixes this: uv's project interface reads [tool.uv] on every resolve.

See uv dependency cooldowns docs.

Changes

pyproject.toml

• Add [dependency-groups] with dev, test, and e2e groups, mirroring the existing [tool.hatch.envs.*] dependency lists
• Add required-version = ">=0.9.17" to [tool.uv] — relative duration strings in exclude-newer require at least this version (released 2025-12-09)

All 8 Hatch-based workflows — replace actions/setup-python + pip install hatch with astral-sh/setup-uv@v8.1.0, and translate every hatch run command:

Before	After
hatch run fmt-check	uv sync --group dev + uv run ruff check && uv run ruff format --check
hatch run test:unit	uv sync --group test + uv run pytest -m "not integration" test
hatch run test:integration-only-fast	uv sync --group test + uv run pytest -m "integration and not slow" test
hatch run test:integration-only-slow	uv sync --group test + uv run pytest -m "integration and slow" test
hatch run test:types	uv sync --group test + uv run mypy ...
hatch run e2e:test	uv sync --group e2e + uv run pytest e2e
hatch run docs	uv sync --group dev + uv run haystack-pydoc pydoc tmp_api_reference
hatch build	uv build

AGENTS.md — updated to document uv sync + uv run as the primary workflow

Notes

• The [tool.hatch.envs.*] sections are kept in pyproject.toml for local development compatibility
• uv.lock is gitignored (this is a library, not an application), so CI resolves fresh each run — the exclude-newer constraint is enforced on every uv sync

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
haystack-docs	Ignored	Preview	Apr 23, 2026 6:53am

[coveralls]

Coverage Report for CI Build 24821394718

Warning

No base build found for commit 7e49095 on supply-chain-exclude-newer.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 92.857%

Details

• Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	17177
Covered Lines:	15950
Line Coverage:	92.86%
Coverage Strength:	0.93 hits per line

---

💛 - Coveralls