From da60fb9f0b978feab473afe05dd7c93331fbdd19 Mon Sep 17 00:00:00 2001 From: Trevor Walker Date: Fri, 18 Sep 2026 10:51:30 -0600 Subject: [PATCH] fix(ci): provision uv for Prime artifact graduation --- .github/workflows/prime-artifact-graduation.yml | 7 +++++++ docs/operations/prime-artifact-graduation.md | 5 +++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/prime-artifact-graduation.yml b/.github/workflows/prime-artifact-graduation.yml index 3d285255f0..1c70751340 100644 --- a/.github/workflows/prime-artifact-graduation.yml +++ b/.github/workflows/prime-artifact-graduation.yml @@ -142,6 +142,13 @@ jobs: "$PYLON_PRIME_STOCK_TARBALL" test -x "$PYLON_PRIME_AGENT_STOCK_ARTIFACT_BIN" + - name: Set up the Python kernel bootstrap prerequisite + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + with: + version: "0.9.26" + checksum: "30ccbf0a66dc8727a02b0e245c583ee970bdafecf3a443c1686e1b30ec4939e8" + enable-cache: false + - name: Run real bridge, managed store, restart, crash-receipt, and native multi evidence run: | set -euo pipefail diff --git a/docs/operations/prime-artifact-graduation.md b/docs/operations/prime-artifact-graduation.md index d406eb64f6..f59513a443 100644 --- a/docs/operations/prime-artifact-graduation.md +++ b/docs/operations/prime-artifact-graduation.md @@ -61,6 +61,11 @@ the preview with the server-owned Sigstore and frozen source policy before a pre extracted, imported, or executed. The production managed tool store then installs the bundled CLI without a package manager or lifecycle script. +The native background-command proof starts a real IPython kernel. The workflow installs a pinned, +checksum-verified `uv` bootstrap prerequisite before running the proofs; a clean runner cannot rely on +a developer machine's `uv` installation. Prime then provisions Python in the isolated fixture home. +This does not enable package lifecycle scripts for managed Prime installation. + The cases cover stock and signed-preview bridge capability, side-by-side installation, real start/use, update or exact no-op, rollback, stock switch-back, unchanged stock bytes, receipt-owned-only cleanup, repeated Pylon restart/crash receipt recovery, and native multiple-instance evidence. The native multi