Switch to uv pip install in workflows

Author: mauvilsa

.github/workflows/manual.yaml

@@ -15,6 +15,13 @@ on:
 permissions:
   contents: read
 
+env:
+  # Only resolve distributions published at least one week ago, reducing the
+  # chance of installing packages affected by undetected supply chain attacks
+  UV_EXCLUDE_NEWER: 7 days
+  # Make uv pip install into the python provided by setup-python
+  UV_SYSTEM_PYTHON: 1
+
 jobs:
   tox-coverage:
     runs-on: ${{ inputs.OS }}
@@ -30,7 +37,11 @@ jobs:
             3.12
             3.13
             3.14
-      - run: pip install -e ".[dev]"
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+        with:
+          enable-cache: true
+          cache-dependency-glob: pyproject.toml
+      - run: uv pip install -e ".[dev]"
       - run: tox -- --cov=../jsonargparse --cov-append
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:

.github/workflows/tests.yaml

@@ -16,6 +16,13 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  # Only resolve distributions published at least one week ago, reducing the
+  # chance of installing packages affected by undetected supply chain attacks
+  UV_EXCLUDE_NEWER: 7 days
+  # Make uv pip install into the python provided by setup-python
+  UV_SYSTEM_PYTHON: 1
+
 jobs:
 
   linux:
@@ -30,17 +37,21 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: ${{ matrix.python }}
-          cache: pip
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+        with:
+          enable-cache: true
+          cache-suffix: py${{ matrix.python }}
+          cache-dependency-glob: pyproject.toml
       - name: Test without optional dependencies and without pyyaml
         run: |
-          pip install .[coverage]
-          pip uninstall -y pyyaml types-PyYAML
+          uv pip install .[coverage]
+          uv pip uninstall pyyaml types-PyYAML
           pytest --cov --cov-report=term --cov-report=xml --junit-xml=junit.xml
           mv coverage.xml coverage_py${{ matrix.python }}_bare.xml
           mv junit.xml junit_py${{ matrix.python }}_bare.xml
       - name: Test with all optional dependencies
         run: |
-          pip install .[test,all]
+          uv pip install .[test,all]
           pytest --cov --cov-report=term --cov-report=xml --junit-xml=junit.xml
           mv coverage.xml coverage_py${{ matrix.python }}_all.xml
           mv junit.xml junit_py${{ matrix.python }}_all.xml
@@ -131,19 +142,22 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: "3.12"
-          cache: pip
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+        with:
+          enable-cache: true
+          cache-dependency-glob: pyproject.toml
       - name: With pydantic<2
         run: |
-          pip install .[coverage]
-          pip install "pydantic<2"
+          uv pip install .[coverage]
+          uv pip install "pydantic<2"
           pytest --cov --cov-report=term --cov-report=xml --junit-xml=junit.xml jsonargparse_tests/test_pydantic.py
           mv coverage.xml coverage_pydantic1.xml
           mv junit.xml junit_pydantic1.xml
       - name: with pydantic>=2
         run: |
           sed -i "s|import pydantic|import pydantic.v1 as pydantic|" jsonargparse_tests/test_pydantic.py
           sed -i "s|^annotated = .*|annotated = False|" jsonargparse_tests/test_pydantic.py
-          pip install "pydantic>=2"
+          uv pip install "pydantic>=2"
           pytest --cov --cov-report=term --cov-report=xml --junit-xml=junit.xml jsonargparse_tests/test_pydantic.py
           mv coverage.xml coverage_pydantic2.xml
           mv junit.xml junit_pydantic2.xml
@@ -157,6 +171,10 @@ jobs:
           path: ./junit_py*
 
   build-package:
+    # This job builds the artifacts that pypi-publish publishes. To protect
+    # against cache poisoning attacks, it must not use any cache (actions/cache,
+    # setup-python's cache or setup-uv's enable-cache) and dependencies must be
+    # installed with --require-hashes from a lock file.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -187,21 +205,24 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: "3.12"
-          cache: pip
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+        with:
+          enable-cache: true
+          cache-dependency-glob: pyproject.toml
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: package
           path: dist
       - name: Test without optional dependencies and without pyyaml
         run: |
           cd dist
-          pip install $(ls jsonargparse-*.whl)[test-no-urls] $(ls jsonargparse_tests-*.whl)
-          pip uninstall -y pyyaml
+          uv pip install $(ls jsonargparse-*.whl)[test-no-urls] $(ls jsonargparse_tests-*.whl)
+          uv pip uninstall pyyaml
           python -m jsonargparse_tests
       - name: Test with all optional dependencies
         run: |
           cd dist
-          pip install $(ls jsonargparse-*.whl)[test,all]
+          uv pip install $(ls jsonargparse-*.whl)[test,all]
           python -m jsonargparse_tests
 
   doctest:
@@ -213,8 +234,11 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: "3.12"
-          cache: pip
-      - run: pip install -e .[all,shtab,doc]
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+        with:
+          enable-cache: true
+          cache-dependency-glob: pyproject.toml
+      - run: uv pip install -e .[all,shtab,doc]
       - name: Run doc tests
         run: sphinx-build -M doctest sphinx sphinx/_build sphinx/index.rst
 
@@ -299,6 +323,8 @@ jobs:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
   pypi-publish:
+    # This job publishes to PyPI the package created by build-package. Same as
+    # there, it must not use any cache to protect against cache poisoning.
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     needs: [linux, windows, macos, argparse-compatibility, omegaconf, pydantic-v1, installed-package, doctest, mypy]