Skip to content

adds integration for tox-uv and updates workflows to use tox-uv #676

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RobotSail wants to merge 1 commit into
base: main
Choose a base branch
from
Open

adds integration for tox-uv and updates workflows to use tox-uv #676

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 12 additions & 14 deletions .github/actions/run-smoke/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,19 @@ runs:
export PATH="${PATH}:${CUDA_HOME}/bin"
nvidia-smi

- name: "Install uv"
uses: astral-sh/setup-uv@v4
with:
enable-cache: true
Comment on lines +25 to +28
Copy link

@coderabbitai coderabbitai bot Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Pin the third-party action to a commit SHA for security.

The astral-sh/setup-uv@v4 action uses a mutable tag reference. For security best practices, pin it to a specific commit SHA to ensure immutable and auditable dependencies.

🔎 Verification script to find the latest commit SHA for v4 
#!/bin/bash
# Fetch the latest commit SHA for the v4 tag of astral-sh/setup-uv
gh api repos/astral-sh/setup-uv/git/refs/tags/v4 --jq '.object.sha // .object.url' | \
  xargs -I {} sh -c 'if [[ {} == https://* ]]; then gh api {} --jq .object.sha; else echo {}; fi'
🤖 Prompt for AI Agents 
.github/actions/run-smoke/action.yml around lines 25 to 28: the workflow is
referencing the third‑party action using a mutable tag (astral-sh/setup-uv@v4);
replace the tag with the specific commit SHA for the v4 release to pin the
action immutably. Determine the correct commit SHA for the v4 tag (for example
via the provided gh api snippet), then update the uses line to use
astral-sh/setup-uv@<commit-sha> and keep the existing with: enable-cache: true
unchanged.


# installs in $GITHUB_WORKSPACE/venv.
# only has to install Tox because Tox will do the other virtual environment management.
- name: "Setup Python virtual environment"
shell: bash
run: |
python${{ inputs.python-version }} -m venv --upgrade-deps venv
uv venv venv --python python${{ inputs.python-version }}
. venv/bin/activate
pip install tox -c constraints-dev.txt
uv pip install tox tox-uv -c constraints-dev.txt

# flash-attn has a bug in the setup.py that causes pip to attempt
# installing it before torch is installed. This is a bug because their
Expand All @@ -41,22 +46,15 @@ runs:
run: |
source venv/bin/activate
# The list is taken from the pull request linked above
pip install torch packaging setuptools wheel psutil ninja -c constraints-dev.txt

- name: "Install tox-current-env to reuse the venv with pre-installed build dependencies"
shell: bash
run: |
source venv/bin/activate
pip install tox-current-env
uv pip install torch packaging setuptools wheel psutil ninja -c constraints-dev.txt

- name: "Install dependencies from tox.ini in the current venv, using current venv installed deps"
- name: "Install dependencies from tox.ini in the current venv"
shell: bash
run: |
source venv/bin/activate
tox -e py3-smoke --print-deps-to-file=./deps.txt
pip_install="pip install -c constraints-dev.txt"
$pip_install -r ./deps.txt --no-build-isolation
$pip_install .
uv pip install -c constraints-dev.txt -r ./deps.txt --no-build-isolation
uv pip install -c constraints-dev.txt .

- name: "Show disk utilization BEFORE tests"
shell: bash
Expand All @@ -68,7 +66,7 @@ runs:
shell: bash
run: |
source venv/bin/activate
tox --current-env -e py3-smoke
tox -e py3-smoke

- name: "Show disk utilization AFTER tests"
shell: bash
Expand Down
15 changes: 9 additions & 6 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,18 +69,21 @@ jobs:
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: 3.11
cache: pip
cache-dependency-path: |
**/pyproject.toml
**/requirements*.txt

- name: Install uv
uses: astral-sh/setup-uv@v4
with:
enable-cache: true
Comment on lines +73 to +76
Copy link

@coderabbitai coderabbitai bot Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Pin the third-party action to a commit SHA for security.

The astral-sh/setup-uv@v4 action uses a mutable tag reference. For consistency with other actions in this workflow (lines 63, 69) and security best practices, pin it to a specific commit SHA.

🔎 Verification script to find the latest commit SHA for v4 
#!/bin/bash
# Fetch the latest commit SHA for the v4 tag of astral-sh/setup-uv
gh api repos/astral-sh/setup-uv/git/refs/tags/v4 --jq '.object.sha // .object.url' | \
  xargs -I {} sh -c 'if [[ {} == https://* ]]; then gh api {} --jq .object.sha; else echo {}; fi'
🤖 Prompt for AI Agents 
.github/workflows/lint.yml lines 73 to 76: the workflow references the external
action using a mutable tag `astral-sh/setup-uv@v4`; replace this with the action
pinned to the specific commit SHA for the v4 tag (e.g.,
`astral-sh/setup-uv@<commit-sha>`). Obtain the latest commit SHA for the v4 tag
(using the provided verification script or `gh`/GitHub API), then update the
`uses:` line to use that SHA so the action is immutable and consistent with
other pinned actions in the file.


- name: Install tox
run: |
python -m pip install --upgrade pip
python -m pip install tox tox-gh -c constraints-dev.txt
uv venv venv
source venv/bin/activate
uv pip install tox tox-uv -c constraints-dev.txt

- name: "${{ matrix.lint.name }}"
run: |
source venv/bin/activate
${{ matrix.lint.commands }}
env:
RUFF_OUTPUT_FORMAT: github
Expand Down
9 changes: 7 additions & 2 deletions .github/workflows/unit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,13 +62,18 @@ jobs:
with:
fetch-depth: 0

- name: "Install uv"
uses: astral-sh/setup-uv@v4
with:
enable-cache: true
Comment on lines +65 to +68
Copy link

@coderabbitai coderabbitai bot Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Pin the third-party action to a commit SHA for security.

The astral-sh/setup-uv@v4 action uses a mutable tag reference. For consistency with other actions in this workflow (lines 56, 61) and security best practices, pin it to a specific commit SHA.

🔎 Verification script to find the latest commit SHA for v4 
#!/bin/bash
# Fetch the latest commit SHA for the v4 tag of astral-sh/setup-uv
gh api repos/astral-sh/setup-uv/git/refs/tags/v4 --jq '.object.sha // .object.url' | \
  xargs -I {} sh -c 'if [[ {} == https://* ]]; then gh api {} --jq .object.sha; else echo {}; fi'
🤖 Prompt for AI Agents 
.github/workflows/unit.yaml lines 65-68: the workflow pins astral-sh/setup-uv to
the mutable tag v4; replace the tag with the specific commit SHA (e.g.,
astral-sh/setup-uv@<commit-sha>) to avoid mutable references — run the provided
gh script to fetch the current v4 commit SHA, update the uses field to that SHA,
and ensure formatting matches the surrounding actions pinned earlier in the
file.


# installs in $GITHUB_WORKSPACE/venv.
# only has to install Tox because Tox will do the other virtual environment management.
- name: "Setup Python virtual environment"
run: |
python -m venv --upgrade-deps venv
uv venv venv
. venv/bin/activate
pip install tox -c constraints-dev.txt
uv pip install tox tox-uv -c constraints-dev.txt

- name: "Show disk utilization BEFORE tests"
if: always()
Expand Down
4 changes: 2 additions & 2 deletions constraints-dev.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,8 +185,8 @@ tokenizers==0.22.0 # via transformers
tomlkit==0.13.3 # via pylint
torch==2.6.0 # via accelerate, bitsandbytes, deepspeed, flash-attn, liger-kernel, peft, -c constraints-dev.txt.in, -r requirements.txt
tornado==6.5.2 # via ipykernel, jupyter-client, jupyter-server, jupyterlab, notebook, terminado
tox==4.29.0 # via tox-current-env, -r requirements-dev.txt
tox-current-env==0.0.16 # via -r requirements-dev.txt
tox==4.29.0 # via tox-uv, -r requirements-dev.txt
tox-uv==1.25.0 # via -r requirements-dev.txt
tqdm==4.67.1 # via datasets, deepspeed, huggingface-hub, peft, transformers
traitlets==5.14.3 # via ipykernel, ipython, ipywidgets, jupyter-client, jupyter-console, jupyter-core, jupyter-events, jupyter-server, jupyterlab, matplotlib-inline, nbclient, nbconvert, nbformat
transformers==4.56.0 # via peft, trl, -r requirements.txt
Expand Down
4 changes: 2 additions & 2 deletions requirements-dev.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ pylint>=2.16.2
pylint-pydantic
pytest
ruff
tox>=4.4.2
tox-current-env
tox>=4
tox-uv

mypy>=1.10.0
types-tqdm
Expand Down
18 changes: 16 additions & 2 deletions tox.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,37 @@
# SPDX-License-Identifier: Apache-2.0

[tox]
requires =
tox>=4
tox-uv
envlist = ruff, lint, mypy, py3-unit
minversion = 4.4

[testenv]
description = run tests
package = wheel
wheel_build_env = pkg

# Use uv for package installation and management
runner = uv-venv-runner
uv_seed = true

deps =
pytest
install_command = pip install \
install_command = uv pip install \
-c constraints-dev.txt \
{opts} {packages}
passenv =
PATH

[testenv:py3]
basepython = python3.11

[testenv:py3-unit]
description = run unit tests with pytest
basepython = python3.11
passenv =
PATH
HF_HOME
INSTRUCTLAB_NCCL_TIMEOUT_MS
CMAKE_ARGS
Expand All @@ -39,9 +51,11 @@ commands = {envpython} -m pytest tests/unit {posargs}

[testenv:py3-smoke]
description = run accelerated smoke tests with pytest
basepython = python3.11
passenv =
PATH
HF_HOME
INSTRUCTLAB_NCCL_TIMEOUT_MS
INSTRUCTLAB_NCCL_TIMEOUT_MS
deps =
-r requirements-dev.txt
-r requirements-cuda.txt
Expand Down
Loading