chore: hermetic CI with a pinned uv, locked syncs and a dependency cooldown

Author: azmeuk

.github/renovate.json

@@ -1,4 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>python-scim/renovate-config#1.0.1"]
+  "extends": ["github>python-scim/renovate-config#1.0.3"]
 }

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - '*'
 
+env:
+  UV_LOCKED: 1
+
 permissions:
   contents: read
 
@@ -17,6 +20,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install uv
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          version: "0.12.13"
       - name: install dependencies
         run: uv sync --group bundle
       - name: build dist

.github/workflows/tests.yaml

@@ -10,6 +10,9 @@ on:
       - main
       - '*.*.*'
 
+env:
+  UV_LOCKED: 1
+
 permissions:
   contents: read
 
@@ -31,6 +34,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install Python ${{ matrix.python }}
         run: uv python install ${{ matrix.python }}
@@ -42,11 +46,13 @@ jobs:
     runs-on: ubuntu-latest
     env:
       UV_RESOLUTION: lowest-direct
+      UV_LOCKED: 0
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install uv
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install minimum dependencies
         run: uv sync
@@ -66,6 +72,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install dependencies
         run: uv sync --group doc
@@ -78,6 +85,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
+          version: "0.12.13"
           enable-cache: true
       - name: Install dependencies
         run: uv sync --group bundle

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["uv_build>=0.12.16,<0.13.0"]
+requires = ["uv_build>=0.12.13,<0.13.0"]
 build-backend = "uv_build"
 
 [project]
@@ -68,6 +68,10 @@ bundle = [
 scim = "scim2_cli:cli"
 scim2 = "scim2_cli:cli"
 
+[tool.uv]
+exclude-newer = "14 days"
+exclude-newer-package = { scim2-models = false, scim2-client = false, scim2-server = false, scim2-cli = false, scim2-tester = false, pytest-scim2-server = false }
+
 [tool.uv.build-backend]
 module-root = ""