build: pin Python deps with uv.lock for reproducible releases

.github/workflows/ci.yml

@@ -13,10 +13,13 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Install
+      - name: Install uv
         run: |
           python -m pip install --upgrade pip
-          pip install -e ".[messaging,dev,bedrock]"
+          pip install uv
+      - name: Install
+        run: |
+          uv sync --frozen --extra messaging --extra dev --extra bedrock
       - name: Test
         run: pytest tests -q
 

.github/workflows/release.yml

@@ -76,12 +76,14 @@ jobs:
         # The build scripts expect a venv at .venv with the package + PyInstaller.
         # typer/tzdata are build-time-only (PyInstaller walks mcp.cli, which needs typer;
         # tzdata ships zoneinfo for Windows). aisuite installs like any other dependency
-        # (git-pinned in pyproject.toml).
+        # (git-pinned in pyproject.toml). uv sync --frozen installs the exact pinned set
+        # from uv.lock so release builds are reproducible.
         run: |
           python -m venv .venv
+          python -m pip install --upgrade pip
+          pip install uv
           if [ "$RUNNER_OS" = "Windows" ]; then VPY=.venv/Scripts/python; else VPY=.venv/bin/python; fi
-          "$VPY" -m pip install --upgrade pip
-          "$VPY" -m pip install -e ".[bedrock]" pyinstaller typer tzdata
+          uv sync --frozen --extra bedrock --extra build
           "$VPY" -c "import aisuite, coworker"  # fail fast if either import breaks
 
       - name: npm ci

packaging/build_dmg.sh

@@ -12,10 +12,10 @@
 #   - A Python venv at .venv (repo root) with this package installed editable, plus the
 #     build-only deps:
 #       python3 -m venv .venv
-#       .venv/bin/pip install -e '.[bedrock]' pyinstaller tzdata typer
-#     `typer` is needed only at BUILD time: PyInstaller walks the `mcp` package and
-#     `mcp.cli` calls sys.exit() at import if typer is absent, which aborts the freeze.
-#     (aisuite installs like any other dependency — git-pinned in pyproject.toml.)
+#       uv sync --frozen --extra bedrock --extra build
+#     (`build` = pyinstaller + typer, pinned in uv.lock; typer is needed only at BUILD
+#     time: PyInstaller walks the `mcp` package and `mcp.cli` calls sys.exit() at import
+#     if typer is absent, which aborts the freeze. tzdata rides the win32 marker.)
 #
 # SIGNING: set APPLE_SIGNING_IDENTITY to a "Developer ID Application: … (TEAMID)" identity and
 # `tauri build` signs the .app + the bundled sidecar with it. Left unset → UNSIGNED (first launch
@@ -36,9 +36,7 @@
 # the spec strips coworker.connectors.experimental. Self-builders can opt in with:
 #   COWORKER_EXPERIMENTAL=1 ./build_dmg.sh
 # VENV PREREQS (a fresh worktree's venv, discovered the hard way 2026-08-21):
-#   .venv/bin/pip install -e ".[dev,messaging,browser,bedrock]" pyinstaller typer
-# (`typer` because PyInstaller's submodule collection imports mcp.cli, which
-# sys.exit(1)s without it.)
+#   uv sync --frozen --extra dev --extra messaging --extra browser --extra bedrock --extra build
 set -euo pipefail
 
 HERE="$(cd "$(dirname "$0")" && pwd)"

packaging/build_windows.ps1

@@ -15,7 +15,8 @@
     - A Python venv at platform\.venv with this package installed editable, plus pyinstaller.
       `typer` is needed only at build time: PyInstaller walks the `mcp` package and `mcp.cli`
       calls sys.exit() at import if typer is absent, which aborts the freeze.
-        py -m venv .venv ; .\.venv\Scripts\pip install -e ".[bedrock]" pyinstaller tzdata typer
+        py -m venv .venv ; uv sync --frozen --extra bedrock --extra build
+      (`build` = pyinstaller + typer, pinned in uv.lock; tzdata rides the win32 marker.)
 
   The result is UNSIGNED — first launch shows a SmartScreen warning ("More info" -> "Run anyway").
   Authenticode signing is a later step.

packaging/setup_dev_env.sh

@@ -13,9 +13,15 @@ VENV="$ROOT/.venv"
 python3 -m venv "$VENV"
 # The coworker package (server, engine, connectors) + inbound-messaging extras.
 # aisuite comes in as a regular dependency (git-pinned in pyproject.toml until
-# the next PyPI release).
-"$VENV/bin/pip" install --quiet --upgrade pip
-"$VENV/bin/pip" install --quiet -e "$ROOT[messaging,dev]"
+# the next PyPI release). Install from the committed uv.lock so a fresh checkout
+# resolves the exact same dependency set every time (supply-chain reproducibility).
+if command -v uv >/dev/null 2>&1; then
+  UV="uv"
+else
+  "$VENV/bin/pip" install --quiet uv
+  UV="$VENV/bin/uv"
+fi
+"$UV" sync --project "$ROOT" --frozen --extra messaging --extra dev
 
 "$VENV/bin/python" -c 'import aisuite, coworker' # fail loudly if the wiring broke
 echo "Ready: $VENV"

pyproject.toml

@@ -48,6 +48,10 @@ messaging = ["python-telegram-bot>=21", "slack-bolt>=1.18", "aiohttp>=3.9"]
 browser = ["playwright>=1.44"]
 # AWS Bedrock provider (lazy-imported; desktop builds bundle it, pip users opt in).
 bedrock = ["boto3>=1.34"]
+# Build-time-only deps for the desktop bundles (PyInstaller freezes the sidecar; typer is
+# needed because PyInstaller walks mcp.cli, which sys.exit(1)s without it). Kept in an
+# extra so `uv lock` pins them too — release builds must be reproducible.
+build = ["pyinstaller", "typer"]
 
 [project.scripts]
 openworker = "coworker.cli:main"