fix: address all PR review comments from Gemini and Copilot

- Dockerfile.dev: set UV_PROJECT_ENVIRONMENT=/opt/venv to avoid volume
  mount shadowing .venv, add /opt/venv/bin to PATH, create dir with
  correct ownership
- pyproject.toml: pin uv_build==0.7.6 (exact version), fix build
  exclude path to inference_endpoint/evaluation/livecodebench/_server.py
- .python-version: pin to 3.12.11 for reproducibility
- CI workflows: add python-version-file to setup-uv in both test.yml
  and pre-commit.yml
- .pre-commit-config.yaml: use language: python with
  additional_dependencies: [uv] for uv-lock-check hook
- README.md: add uv installation instructions and uv run usage note
- AGENTS.md: clarify build-system requires also pinned to exact versions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: viraatc

.github/workflows/pre-commit.yml

@@ -16,6 +16,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
+        with:
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: uv sync --frozen --extra dev

.github/workflows/test.yml

@@ -14,6 +14,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
+        with:
+          python-version-file: .python-version
 
       - name: Run tests
         run: uv run --frozen --extra test pytest -xv -m "not slow and not performance" --cov=src --cov-report=xml --cov-report=html
@@ -33,6 +35,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
+        with:
+          python-version-file: .python-version
 
       - name: Audit dependencies for known vulnerabilities
         run: uv run --frozen --extra dev --extra test --extra performance pip-audit

.pre-commit-config.yaml

@@ -66,6 +66,7 @@ repos:
       - id: uv-lock-check
         name: Check uv.lock is up-to-date
         entry: uv lock --check
-        language: system
+        language: python
+        additional_dependencies: [uv]
         pass_filenames: false
         files: ^pyproject\.toml$

.python-version

@@ -1 +1 @@
-3.12
+3.12.11

AGENTS.md

@@ -359,5 +359,5 @@ Known failure modes when AI tools generate code for this project. Reference thes
 
 ### Dependency & Environment
 
-- **Adding new dependencies without justification**: AI may `pip install` or add imports for packages not in `pyproject.toml`. Any new dependency must be justified, added to the correct optional group, and pinned to an exact version (`==`). After adding a dependency, run `pip-audit` (included in `dev` extras) to verify it has no known vulnerabilities. When adding dependencies, use `uv add <package>==<version>` to update both `pyproject.toml` and `uv.lock` atomically, then run `uv run pip-audit` to check for vulnerabilities.
+- **Adding new dependencies without justification**: AI may `pip install` or add imports for packages not in `pyproject.toml`. Any new runtime, dev, or test dependency must be justified, added to the correct optional group, and pinned to an exact version (`==`). After adding a dependency, run `pip-audit` (included in `dev` extras) to verify it has no known vulnerabilities. When adding dependencies, use `uv add <package>==<version>` to update both `pyproject.toml` and `uv.lock` atomically, then run `uv run pip-audit` to check for vulnerabilities. Note: `[build-system] requires` is also pinned to exact versions for reproducibility.
 - **Using `requests`/`aiohttp` for HTTP**: This project has its own HTTP client (`endpoint_client/http.py`) using `httptools`. AI defaults to `requests` or `aiohttp` — these should not appear in production code (test dependencies are fine).

README.md

@@ -15,7 +15,7 @@ git clone https://github.com/mlcommons/endpoints.git
 cd endpoints
 ```
 
-This project uses [uv](https://docs.astral.sh/uv/) for dependency management. All dependencies are pinned in `uv.lock`.
+This project uses [uv](https://docs.astral.sh/uv/) for dependency management. All dependencies are pinned in `uv.lock`. Install uv first: `curl -LsSf https://astral.sh/uv/install.sh | sh` (see [uv installation docs](https://docs.astral.sh/uv/getting-started/installation/) for other methods).
 
 ```bash
 # Install dependencies
@@ -24,6 +24,9 @@ uv sync
 # For development (includes linting, testing, and type-checking tools)
 uv sync --extra dev --extra test
 uv run pre-commit install
+
+# Run project commands with `uv run ...`, or activate the venv directly:
+# source .venv/bin/activate
 ```
 
 <details>

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["uv_build>=0.7.6,<0.8"]
+requires = ["uv_build==0.7.6"]
 build-backend = "uv_build"
 
 [tool.uv]
@@ -14,7 +14,7 @@ environments = [
 [tool.uv-build]
 module-root = "src"
 data = {"inference_endpoint" = ["config/templates/*.yaml"]}
-exclude = ["evaluation/livecodebench/_server.py"]
+exclude = ["inference_endpoint/evaluation/livecodebench/_server.py"]
 
 [project]
 name = "inference-endpoint"

scripts/Dockerfile.dev

@@ -12,7 +12,8 @@ COPY --from=ghcr.io/astral-sh/uv:0.7.6 /uv /uvx /bin/
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     UV_COMPILE_BYTECODE=1 \
-    UV_LINK_MODE=copy
+    UV_LINK_MODE=copy \
+    UV_PROJECT_ENVIRONMENT=/opt/venv
 
 # Install system dependencies
 RUN apt-get update && \
@@ -34,8 +35,9 @@ RUN if ! getent group ${GROUP_ID}; then \
         groupadd -g ${GROUP_ID} appuser; \
     fi && \
     useradd -u ${USER_ID} -g ${GROUP_ID} --create-home --shell /bin/bash appuser --no-log-init && \
-    chown -R ${USER_ID}:${GROUP_ID} /mnt/inference-endpoint
+    chown -R ${USER_ID}:${GROUP_ID} /mnt/inference-endpoint && \
+    mkdir -p /opt/venv && chown ${USER_ID}:${GROUP_ID} /opt/venv
 USER appuser
-ENV PATH="/home/appuser/.local/bin:$PATH"
+ENV PATH="/opt/venv/bin:/home/appuser/.local/bin:$PATH"
 
 RUN uv sync --frozen --extra dev --extra test