Files
Vinta Chen 0bf9522e5d chore: add uv supply-chain hardening and enforce locked installs
- Set exclude-newer to 3 days and only-binary/:all: in pyproject.toml to
  limit dependency freshness window and block source builds
- Switch uv sync to --locked in Makefile, ci.yml, and deploy-website.yml
  to enforce the lockfile rather than re-resolving on each install
- Regenerate uv.lock with exclude-newer snapshot recorded

Co-Authored-By: Claude <noreply@anthropic.com>
2026-04-22 02:21:48 +08:00

34 lines
578 B
YAML

name: CI
on:
push:
branches: [master]
pull_request:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install uv
uses: astral-sh/setup-uv@v7
with:
enable-cache: true
- name: Install dependencies
run: uv sync --group build --locked
- name: Run tests
run: make test
- name: Build website
run: make build