fix(renovate): store exact Python version, migrate devfile images to uv (#804)

## Summary
- Switch `.py-version` from `MAJOR.MINOR` (`3.12`) to
`MAJOR.MINOR.PATCH` (`3.12.11`) and update the Renovate regex to match
three version segments -- fixes the `renovate/python-3.x` branch
creation failure where the two-segment regex couldn't verify a
three-segment replacement (`expectedValue: "3.14.6", foundValue:
"14.6"`)
- Migrate both devfile Containerfiles from `dnf install python3.X` /
`pip install` to `uv python install` / `uv pip install`, reading the
Python version from `.py-version` instead of hardcoding it
- Add `python-base` intermediary stage in `Containerfile.client` for
layer caching (system deps cached separately from wheel installation)
- Replace bash alias (`alias python='uv run python'`) with `uv venv` +
`ENV PATH` so `python` is available in all contexts (scripts, podman
exec, Makefiles), not just interactive bash shells
- Pin the builder stage to the same `.py-version` Python via `uv python
install` + `UV_PYTHON_PREFERENCE=only-managed` so wheels are built with
the same interpreter as the runtime
- Set group ownership (GID 0) on `.local`, `.cache`, and `.venv` in both
Containerfiles for OpenShift arbitrary UID support
- Update `name` labels from `udi9` to `udi10` to match the
`ubi10-latest` base image

## Test plan
- [x] Validated `renovate.jsonc` parses correctly (`npx json5`)
- [x] Ran Renovate v43.218.0 dry-run against fork -- confirmed
`.py-version` matched, `currentValue: "3.12.11"` extracted, and
`DRY-RUN: Would commit files to branch renovate/python-3.x` (no "Value
is not updated" error)
- [x] Build `python/.devfile/Containerfile.client` and verify `uv python
install` succeeds
- [x] Build `python/.devfile/Containerfile.client` and verify wheel +
pytest installation into venv
- [x] `podman run --rm jumpstarter-client:test python --version` returns
Python 3.12.11
- [x] `podman run --rm jumpstarter-client:test uv pip list --python
/home/user/.venv/bin/python | grep jumpstarter` lists all packages
- [x] Verified builder stage uses Python 3.12.11 (via `UV_VERBOSE=1`)
with and without `UV_PYTHON_PREFERENCE=only-managed`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: raballew

.py-version

@@ -1 +1 @@
-3.12
+3.12.11

e2e/compat/setup.sh

@@ -63,7 +63,7 @@ install_dependencies() {
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
 
-    grep -qxE '[0-9]+\.[0-9]+' "$REPO_ROOT/.py-version" || { log_error "Invalid .py-version"; exit 1; }
+    grep -qxE '[0-9]+\.[0-9]+\.[0-9]+' "$REPO_ROOT/.py-version" || { log_error "Invalid .py-version"; exit 1; }
     PY_VERSION="$(cat "$REPO_ROOT/.py-version")"
     log_info "Installing Python ${PY_VERSION}..."
     uv python install "$PY_VERSION"

e2e/setup-e2e.sh

@@ -48,7 +48,7 @@ install_dependencies() {
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
 
-    grep -qxE '[0-9]+\.[0-9]+' "$REPO_ROOT/.py-version" || { log_error "Invalid .py-version"; exit 1; }
+    grep -qxE '[0-9]+\.[0-9]+\.[0-9]+' "$REPO_ROOT/.py-version" || { log_error "Invalid .py-version"; exit 1; }
     PY_VERSION="$(cat "$REPO_ROOT/.py-version")"
     log_info "Installing Python ${PY_VERSION}..."
     uv python install "$PY_VERSION"

python/.devfile/Containerfile

@@ -1,22 +1,25 @@
 FROM quay.io/devfile/base-developer-image:ubi10-latest@sha256:6b9d2a3b90798e6d92c1c6b05cd2ce733b989cc6f0b3ff4e0820b45ad19fe474
 LABEL maintainer="Jumpstarter.dev"
 
-LABEL name="devfile/udi9/jumpstarter"
+LABEL name="devfile/udi10/jumpstarter"
 
-#labels for container catalog
 LABEL summary="devfile jumpstarter developer image"
 LABEL description="Image with developers tools."
 LABEL io.k8s.display-name="jumpstarter-developer-universal"
 
-USER root
-
 COPY --from=ghcr.io/astral-sh/uv:0.11.21@sha256:ff07b86af50d4d9391d9daf4ff89ce427bc544f9aae87057e69a1cc0aa369946 /uv /uvx /bin/
 
+USER root
 COPY .py-version /tmp/.py-version
-RUN grep -qxE '[0-9]+\.[0-9]+' /tmp/.py-version && \
-    PY=$(cat /tmp/.py-version) && \
-    dnf -y install make git "python${PY}" libusbx python3-pyusb golang podman && dnf clean all
+RUN dnf -y install make git libusbx golang podman && dnf clean all
 
 USER 10001
+ENV UV_PYTHON_PREFERENCE=only-managed
+RUN uv python install "$(cat /tmp/.py-version)" && \
+    uv venv /home/user/.venv
+ENV PATH="/home/user/.venv/bin:${PATH}"
 
-RUN echo "alias python='uv run python'" >> /home/user/.bashrc
+USER root
+RUN chown 10001:0 -R /home/user/{.local,.cache,.venv} && chmod g+rwx -R /home/user/{.local,.cache,.venv}
+
+USER 10001

python/.devfile/Containerfile.client

@@ -3,41 +3,38 @@ COPY --from=ghcr.io/astral-sh/uv:0.11.21@sha256:ff07b86af50d4d9391d9daf4ff89ce42
 RUN dnf install -y make git && \
     dnf clean all && \
     rm -rf /var/cache/dnf
+COPY .py-version /tmp/.py-version
+RUN uv python install "$(cat /tmp/.py-version)"
+ENV UV_PYTHON_PREFERENCE=only-managed
 ADD . /src
 RUN make -C /src/python build
 
-
-FROM quay.io/devfile/base-developer-image:ubi10-latest@sha256:6b9d2a3b90798e6d92c1c6b05cd2ce733b989cc6f0b3ff4e0820b45ad19fe474
+FROM quay.io/devfile/base-developer-image:ubi10-latest@sha256:6b9d2a3b90798e6d92c1c6b05cd2ce733b989cc6f0b3ff4e0820b45ad19fe474 AS python-base
 LABEL maintainer="jumpstarter.dev"
 
-LABEL name="devfile/udi9/jumpstarter-client"
+LABEL name="devfile/udi10/jumpstarter-client"
 
-#labels for container catalog
 LABEL summary="devfile jumpstarter developer image"
 LABEL description="Devspaces image for consuming jumpstarter as a client"
 LABEL io.k8s.display-name="jumpstarter-client-developer"
 
-USER root
+COPY --from=ghcr.io/astral-sh/uv:0.11.21@sha256:ff07b86af50d4d9391d9daf4ff89ce427bc544f9aae87057e69a1cc0aa369946 /uv /uvx /bin/
 
+USER root
 COPY .py-version /tmp/.py-version
-RUN grep -qxE '[0-9]+\.[0-9]+' /tmp/.py-version && \
-    PY=$(cat /tmp/.py-version) && \
-    rm -rf /usr/bin/python && ln -s "/usr/bin/python${PY}" /usr/bin/python
-
-RUN PY=$(cat /tmp/.py-version) && \
-    dnf -y install make git "python${PY}" libusbx python3-pyusb "python${PY}-pip" golang && dnf clean all
+RUN dnf -y install make git libusbx golang && dnf clean all
 
 USER 10001
+RUN uv python install "$(cat /tmp/.py-version)"
 
+FROM python-base
 RUN --mount=from=builder,source=/src/python/dist,target=/dist \
-    PY=$(cat /tmp/.py-version) && "python${PY}" -m pip install /dist/*.whl
-
-RUN PY=$(cat /tmp/.py-version) && \
-    "python${PY}" -m pip install pytest
+    uv venv /home/user/.venv && \
+    VIRTUAL_ENV=/home/user/.venv uv pip install /dist/*.whl pyusb pytest
+ENV PATH="/home/user/.venv/bin:$PATH"
 
 USER root
-
 RUN mkdir -p /home/user/.config/jumpstarter/clients
-RUN chown 10001:0 -R /home/user/{.config,.local,.cache} && chmod g+rwx -R /home/user/{.config,.local,.cache}
+RUN chown 10001:0 -R /home/user/{.config,.local,.cache,.venv} && chmod g+rwx -R /home/user/{.config,.local,.cache,.venv}
 
 USER 10001

renovate.jsonc

@@ -50,7 +50,7 @@
         "/(^|/)\\.py-version$/"
       ],
       "matchStrings": [
-        "(?<currentValue>\\d+\\.\\d+)\\n"
+        "(?<currentValue>\\d+\\.\\d+\\.\\d+)\\n"
       ],
       "depNameTemplate": "python",
       "datasourceTemplate": "python-version",