feat: 使用 uv 锁定主程序依赖并强化插件恢复边界 (#6364)

.github/workflows/beta.yml

@@ -14,6 +14,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: '0.12.5'
+
+      - name: Verify dependency lock
+        run: uv lock --check
+
       - name: Release version
         id: release_version
         run: |

.github/workflows/build-v3.yml

@@ -22,6 +22,14 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: '0.12.5'
+
+      - name: Verify dependency lock
+        run: uv lock --check
+
       - name: Release version
         id: release_version
         run: |

.github/workflows/dependency-compat.yml

@@ -0,0 +1,164 @@
+name: Dependency Compatibility
+
+on:
+  pull_request:
+    branches:
+      - v3
+    paths:
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'docker/Dockerfile'
+      - 'docker/entrypoint.sh'
+      - 'docker/update.sh'
+      - '.github/workflows/dependency-compat.yml'
+  push:
+    branches:
+      - v3
+    paths:
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'docker/Dockerfile'
+      - 'docker/entrypoint.sh'
+      - 'docker/update.sh'
+      - '.github/workflows/dependency-compat.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-compat-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  install:
+    name: ${{ matrix.name }} / Python ${{ matrix.python-version }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux x64
+            runner: ubuntu-24.04
+            python-version: '3.12'
+            expected-system: Linux
+            expected-machine: x86_64
+          - name: Linux x64
+            runner: ubuntu-24.04
+            python-version: '3.13'
+            expected-system: Linux
+            expected-machine: x86_64
+          - name: Linux ARM64
+            runner: ubuntu-24.04-arm
+            python-version: '3.12'
+            expected-system: Linux
+            expected-machine: aarch64
+          - name: macOS Intel
+            runner: macos-15-intel
+            python-version: '3.12'
+            expected-system: Darwin
+            expected-machine: x86_64
+          - name: macOS ARM
+            runner: macos-15
+            python-version: '3.12'
+            expected-system: Darwin
+            expected-machine: arm64
+          - name: Windows x64
+            runner: windows-2025
+            python-version: '3.12'
+            expected-system: Windows
+            expected-machine: AMD64
+          - name: Linux x64
+            runner: ubuntu-24.04
+            python-version: '3.14'
+            expected-system: Linux
+            expected-machine: x86_64
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: '0.12.5'
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
+
+      - name: Install locked runtime dependencies
+        run: uv sync --locked --inexact --no-dev --python ${{ matrix.python-version }}
+
+      - name: Verify environment and core imports
+        env:
+          EXPECTED_SYSTEM: ${{ matrix.expected-system }}
+          EXPECTED_MACHINE: ${{ matrix.expected-machine }}
+        run: >-
+          uv run --locked --no-sync python -c
+          "import os, platform;
+          assert platform.system() == os.environ['EXPECTED_SYSTEM'], (platform.system(), os.environ['EXPECTED_SYSTEM']);
+          assert platform.machine() == os.environ['EXPECTED_MACHINE'], (platform.machine(), os.environ['EXPECTED_MACHINE']);
+          import alembic, fastapi, pydantic, pydantic_settings, sqlalchemy, starlette, uvicorn"
+
+      - name: Verify installed dependency consistency
+        run: uv pip check
+
+  docker-dependencies:
+    name: Docker dependencies / ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            platform: linux/amd64
+            cache-scope: linux-amd64
+            image-tag: moviepilot-dependency-gate:linux-amd64
+            expected-machine: x86_64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64
+            cache-scope: linux-arm64
+            image-tag: moviepilot-dependency-gate:linux-arm64
+            expected-machine: aarch64
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Build locked dependency stage
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          target: prepare_venv
+          platforms: ${{ matrix.platform }}
+          load: true
+          push: false
+          tags: ${{ matrix.image-tag }}
+          cache-from: type=gha,scope=dependency-compat-${{ matrix.cache-scope }}
+          cache-to: type=gha,scope=dependency-compat-${{ matrix.cache-scope }},mode=max
+
+      - name: Verify dependency image
+        env:
+          IMAGE_TAG: ${{ matrix.image-tag }}
+          EXPECTED_MACHINE: ${{ matrix.expected-machine }}
+        run: >-
+          docker run --rm
+          -e EXPECTED_MACHINE
+          "${IMAGE_TAG}"
+          /opt/venv/bin/python -c
+          "import os, platform;
+          assert platform.machine() == os.environ['EXPECTED_MACHINE'], (platform.machine(), os.environ['EXPECTED_MACHINE']);
+          import alembic, fastapi, pydantic, pydantic_settings, sqlalchemy, starlette, uvicorn"
+
+      - name: Verify pinned uv version
+        env:
+          IMAGE_TAG: ${{ matrix.image-tag }}
+        run: docker run --rm "${IMAGE_TAG}" uv --version | grep -F 'uv 0.12.5'

.github/workflows/pylint.yml

@@ -4,6 +4,9 @@ on:
   # 允许手动触发
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   pylint:
     runs-on: ubuntu-latest
@@ -13,25 +16,18 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Set up Python
-      uses: actions/setup-python@v5
+    - name: Set up uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       with:
+        version: '0.12.5'
         python-version: '3.12'
-        cache: 'pip'
-
-    - name: Cache pip dependencies
-      uses: actions/cache@v4
-      with:
-        path: ~/.cache/pip
-        key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.in', '**/requirements-dev.in', '**/requirements.txt') }}
-        restore-keys: |
-          ${{ runner.os }}-pip-
+        enable-cache: true
+        cache-dependency-glob: |
+          pyproject.toml
+          uv.lock
 
     - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip setuptools wheel
-        # Pylint 属于开发/静态检查依赖，统一通过 dev 入口安装。
-        pip install -r requirements-dev.in
+      run: uv sync --locked
 
     - name: Verify pylint config
       run: |
@@ -51,22 +47,22 @@ jobs:
 
         # 检查主要目录 - 只关注错误，如果有错误则退出
         echo "📂 检查 app/ 目录..."
-        pylint app/ --output-format=colorized --reports=yes --score=yes
+        uv run --locked --no-sync pylint app/ --output-format=colorized --reports=yes --score=yes
 
         # 检查根目录的Python文件
         echo "📂 检查根目录 Python 文件..."
         for file in $(find . -name "*.py" -not -path "./.*" -not -path "./.venv/*" -not -path "./build/*" -not -path "./dist/*" -not -path "./tests/*" -not -path "./docs/*" -not -path "./__pycache__/*" -maxdepth 1); do
           echo "检查文件: $file"
-          pylint "$file" --output-format=colorized || exit 1
+          uv run --locked --no-sync pylint "$file" --output-format=colorized || exit 1
         done
 
         # 生成详细报告
         echo "📊 生成 Pylint 详细报告..."
-        pylint app/ --output-format=json > pylint-report.json || true
+        uv run --locked --no-sync pylint app/ --output-format=json > pylint-report.json || true
 
         # 显示评分（仅供参考）
         echo "📈 Pylint 评分（仅供参考）:"
-        pylint app/ --score=yes --reports=no | tail -2 || true
+        uv run --locked --no-sync pylint app/ --score=yes --reports=no | tail -2 || true
 
     - name: Upload pylint report
       uses: actions/upload-artifact@v4

.github/workflows/site-adapter-collector.yml

@@ -50,13 +50,16 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version: '3.12'
-          cache: pip
-          cache-dependency-path: scripts/site_adapter_collector_requirements.txt
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: '0.12.5'
+          enable-cache: true
+          cache-dependency-glob: scripts/site_adapter_collector_requirements.txt
 
       - name: Install build dependencies
-        run: |
-          python -m pip install --upgrade pip setuptools wheel
-          pip install -r scripts/site_adapter_collector_requirements.txt
+        run: uv pip install --system --requirement scripts/site_adapter_collector_requirements.txt
 
       - name: Build single-file collector
         run: |

.github/workflows/test.yml

@@ -28,36 +28,29 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: '0.12.5'
           python-version: '3.12'
-          cache: 'pip'
-
-      - name: Cache pip dependencies
-        uses: actions/cache@v5
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.in', '**/requirements-dev.in', '**/requirements.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
 
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip setuptools wheel
-          # 单测需要开发/测试依赖；运行时入口 requirements.in 不携带测试与构建辅助工具。
-          pip install -r requirements-dev.in
+        run: uv sync --locked
 
       - name: Run tests
         timeout-minutes: 10
         run: |
           # tests/run.py 以 pytest 跑 tests 全量；tests/conftest.py 在收集前把 CONFIG_DIR
           # 指向临时库并建表；CI 额外生成覆盖率报告，便于后续补测和回归分析。
-          python -m coverage erase
-          python -m coverage run tests/run.py
-          python -m coverage report
-          python -m coverage json
-          python -m coverage xml
+          uv run --locked --no-sync python -m coverage erase
+          uv run --locked --no-sync python -m coverage run tests/run.py
+          uv run --locked --no-sync python -m coverage report
+          uv run --locked --no-sync python -m coverage json
+          uv run --locked --no-sync python -m coverage xml
 
       - name: Upload coverage report
         if: always()