chore: hermetic CI with a pinned uv, locked syncs and a dependency cooldown

Author: azmeuk

.github/renovate.json

@@ -1,4 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>python-scim/renovate-config#1.0.1"]
+  "extends": ["github>python-scim/renovate-config#1.0.3"]
 }

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - '*'
 
+env:
+  UV_LOCKED: 1
+
 permissions:
   contents: read
 
@@ -17,6 +20,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.12.13"
       - name: build dist
         run: uv build
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/tests.yaml

@@ -10,6 +10,9 @@ on:
       - main
       - '*.*.*'
 
+env:
+  UV_LOCKED: 1
+
 permissions:
   contents: read
 
@@ -31,6 +34,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install Python ${{ matrix.python }}
         run: uv python install ${{ matrix.python }}
@@ -44,6 +48,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install Python 3.14
         run: uv python install 3.14
@@ -73,6 +78,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Checkout downstream pyproject
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -98,11 +104,13 @@ jobs:
     runs-on: ubuntu-latest
     env:
       UV_RESOLUTION: lowest-direct
+      UV_LOCKED: 0
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install minimum dependencies
         run: uv sync
@@ -116,6 +124,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Run style checks
         run: uv run --python 3.14 prek run --all-files --show-diff-on-failure
@@ -127,6 +136,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install dependencies
         run: uv sync --group doc

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["uv_build>=0.12.16,<0.13.0"]
+requires = ["uv_build>=0.12.13,<0.13.0"]
 build-backend = "uv_build"
 
 [project]
@@ -37,6 +37,10 @@ repository = "https://github.com/python-scim/scim2-models"
 changelog = "https://scim2-models.readthedocs.io/en/latest/changelog.html"
 funding = "https://github.com/sponsors/python-scim"
 
+[tool.uv]
+exclude-newer = "14 days"
+exclude-newer-package = { scim2-models = false, scim2-client = false, scim2-server = false, scim2-cli = false, scim2-tester = false, pytest-scim2-server = false }
+
 [tool.uv.build-backend]
 module-root = ""