ci: use uv dependabot ecosystem instead of pip#699
Open
anxkhn wants to merge 1 commit into
Open
Conversation
Since the migration to hatch and uv, uv.lock is the source of truth and requirements.txt is an autogenerated `uv export` of it. The lint job in .github/workflows/test.yaml enforces this with `uv lock --check` followed by `uv export >requirements.txt` and `git diff --exit-code requirements.txt`. Dependabot's `pip` ecosystem edits requirements.txt directly and never regenerates uv.lock, so on every dependency PR `uv export` rewrites requirements.txt from the unchanged lockfile, reverting Dependabot's change and failing the diff check. Switch to the natively supported `uv` ecosystem, which updates uv.lock so the exported requirements.txt stays consistent and the lint job passes. Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
vaderollama
approved these changes
Jul 14, 2026
vaderollama
left a comment
vaderollama
left a comment
There was a problem hiding this comment.
LGTM — uv.lock is the source of truth and requirements.txt is generated from it. Using the pip ecosystem was updating requirements.txt without touching uv.lock, causing the export verification check to fail on dependency PRs. Switching to uv ecosystem fixes the root cause.
@ParthSareen — ready to merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Switch Python dependency updates in
.github/dependabot.ymlfrom thepipecosystem to the nativeuvecosystem.Why
uv.lockis the source of truth, whilerequirements.txtis generated byuv export. The lint job verifies that the exported requirements file matches the lockfile.The current
pipupdater changesrequirements.txtwithout updatinguv.lock, so the export check fails on dependency PRs such as #657 through #661. Using theuvecosystem makes Dependabot updateuv.lock, keeping the generated requirements file consistent.Verification
uvx hatch fmt --check -fuvx hatch fmt --check -luv lock --checkuv export >requirements.txtfollowed bygit diff --exit-code requirements.txtuv run --no-sync pytest tests/ -q(92 passed)