chore(deps): upgrade actions and uv dependencies

.github/workflows/pr.yml

@@ -53,7 +53,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python and uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Setup just
         uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4

.github/workflows/release.yml

@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python and uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - id: verify
         name: Verify tag matches pyproject.toml and main
@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python and uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Setup just
         uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
@@ -139,7 +139,7 @@ jobs:
           path: dist
 
       - name: Publish package distributions to TestPyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true
@@ -165,7 +165,7 @@ jobs:
           path: dist
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
       - name: Publish GitHub draft release
         uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0

.github/workflows/test.yml

@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup uv and Python
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           python-version: ${{ matrix.python-version }}
 

examples/slim_llm/credentials.example.json

@@ -1,19 +1,19 @@
 {
-  "slim": {
-    "mode": "local",
-    "plugin_folder": ".slim/plugins",
-    "daemon_addr": "",
-    "daemon_key": ""
-  },
   "model_credentials": [
     {
-      "vendor": "openai",
       "values": {
-        "openai_api_key": "<your-api-key>",
+        "api_protocol": "responses",
         "openai_api_base": "",
-        "openai_organization": "",
-        "api_protocol": "responses"
-      }
+        "openai_api_key": "<your-api-key>",
+        "openai_organization": ""
+      },
+      "vendor": "openai"
     }
-  ]
+  ],
+  "slim": {
+    "daemon_addr": "",
+    "daemon_key": "",
+    "mode": "local",
+    "plugin_folder": ".slim/plugins"
+  }
 }

pyproject.toml

@@ -47,11 +47,12 @@ dev = [
 ]
 
 [build-system]
-requires = ['uv_build~=0.11']
+requires = ['uv_build>=0.12.2,<0.13']
 build-backend = 'uv_build'
 
 [tool.uv]
 default-groups = ['dev']
+prerelease = 'disallow'
 
 [tool.ruff]
 fix = true

tests/graph_engine/test_dispatch_patterns.py

@@ -418,21 +418,21 @@ def stop(self) -> None:
     active_worker = WorkerStub(has_current_task=True)
     idle_worker = WorkerStub(has_current_task=False)
     pool = object.__new__(WorkerPool)
-    pool._lock = threading.RLock()
+    pool._lock = cast(Any, threading.RLock())
     pool._task_claim_lock = threading.Lock()
     pool._task_claiming = threading.Event()
     pool._task_claiming.set()
     pool._ready_queue = InMemoryReadyQueue()
     pool._running = True
-    pool._workers = [active_worker, idle_worker]
+    pool._workers = cast(Any, [active_worker, idle_worker])
 
     pool.drain()
 
     assert active_worker.stopped is False
     assert idle_worker.stopped is True
 
 
-def test_worker_pool_drain_observes_task_claimed_during_pause() -> None:  # noqa: C901
+def test_worker_pool_drain_observes_task_claimed_during_pause() -> None:  # ruff: ignore[complex-structure]
     class BlockingReadyQueue:
         def __init__(self) -> None:
             self._queue = InMemoryReadyQueue()
@@ -1363,7 +1363,7 @@ def test_event_handler_processes_tagged_root_frame_success_before_collecting() -
     event_collector.collect.assert_called_once_with(event)
 
 
-def test_parallel_iteration_preserves_aggregate_and_response_order() -> None:  # noqa: PLR0914
+def test_parallel_iteration_preserves_aggregate_and_response_order() -> None:  # ruff: ignore[too-many-locals]
     graph_config = {
         "nodes": [
             {

tests/http/test_executor_secret_masking.py

@@ -24,7 +24,7 @@
 from graphon.runtime.variable_pool import VariablePool
 from graphon.variables import SecretVariable
 
-SECRET = "sk-supersecret-123456"  # noqa: S105
+SECRET = "sk-supersecret-123456"  # ruff: ignore[hardcoded-password-string]
 # The obfuscated form per _obfuscated_token(): first 6 chars + 12 stars + last 2 chars.
 # len(SECRET) = 22 > 8, so: "sk-sup" + "************" + "56"
 OBFUSCATED = "sk-sup" + "*" * 12 + "56"

tests/variables/test_sensitivity.py

@@ -8,7 +8,7 @@
 )
 from graphon.variables.sensitivity import is_sensitive
 
-SECRET = "sk-1234567890abcdef"  # noqa: S105
+SECRET = "sk-1234567890abcdef"  # ruff: ignore[hardcoded-password-string]
 
 
 def test_secret_variable_is_sensitive() -> None:

tests/variables/test_workflow_type_encoder_secret.py

@@ -1,7 +1,7 @@
 from graphon.variables import SecretVariable, SegmentGroup, StringSegment
 from graphon.workflow_type_encoder import WorkflowRuntimeTypeConverter
 
-SECRET = "sk-1234567890abcdef"  # noqa: S105
+SECRET = "sk-1234567890abcdef"  # ruff: ignore[hardcoded-password-string]
 MASKED = "sk-123" + "*" * 12 + "ef"  # _obfuscated_token(SECRET)
 
 

tests/workflows/test_full_graph_events.py

@@ -156,7 +156,7 @@ def _run_with_timeout(engine: GraphEngine) -> list[GraphEngineEvent]:
     def run() -> None:
         try:
             events.extend(engine.run())
-        except Exception as error:  # noqa: BLE001 - re-raised in the test thread.
+        except Exception as error:  # ruff: ignore[blind-except] - re-raised in the test thread.
             errors.append(error)
         finally:
             finished.set()
@@ -266,7 +266,7 @@ def test_resume_replays_tasks_through_a_bounded_ready_queue() -> None:
     def start_execution() -> None:
         try:
             engine._start_execution(resume=True)
-        except Exception as error:  # noqa: BLE001 - re-raised in the test thread.
+        except Exception as error:  # ruff: ignore[blind-except] - re-raised in the test thread.
             errors.append(error)
         finally:
             finished.set()