feat: 使用 uv 锁定主程序依赖并强化插件恢复边界 (#6364)

.github/workflows/pylint.yml

@@ -4,6 +4,9 @@ on:
   # 允许手动触发
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   pylint:
     runs-on: ubuntu-latest
@@ -13,25 +16,18 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Set up Python
-      uses: actions/setup-python@v5
+    - name: Set up uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       with:
+        version: '0.12.5'
         python-version: '3.12'
-        cache: 'pip'
-
-    - name: Cache pip dependencies
-      uses: actions/cache@v4
-      with:
-        path: ~/.cache/pip
-        key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.in', '**/requirements-dev.in', '**/requirements.txt') }}
-        restore-keys: |
-          ${{ runner.os }}-pip-
+        enable-cache: true
+        cache-dependency-glob: |
+          pyproject.toml
+          uv.lock
 
     - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip setuptools wheel
-        # Pylint 属于开发/静态检查依赖，统一通过 dev 入口安装。
-        pip install -r requirements-dev.in
+      run: uv sync --locked
 
     - name: Verify pylint config
       run: |
@@ -51,22 +47,22 @@ jobs:
 
         # 检查主要目录 - 只关注错误，如果有错误则退出
         echo "📂 检查 app/ 目录..."
-        pylint app/ --output-format=colorized --reports=yes --score=yes
+        uv run --locked --no-sync pylint app/ --output-format=colorized --reports=yes --score=yes
 
         # 检查根目录的Python文件
         echo "📂 检查根目录 Python 文件..."
         for file in $(find . -name "*.py" -not -path "./.*" -not -path "./.venv/*" -not -path "./build/*" -not -path "./dist/*" -not -path "./tests/*" -not -path "./docs/*" -not -path "./__pycache__/*" -maxdepth 1); do
           echo "检查文件: $file"
-          pylint "$file" --output-format=colorized || exit 1
+          uv run --locked --no-sync pylint "$file" --output-format=colorized || exit 1
         done
 
         # 生成详细报告
         echo "📊 生成 Pylint 详细报告..."
-        pylint app/ --output-format=json > pylint-report.json || true
+        uv run --locked --no-sync pylint app/ --output-format=json > pylint-report.json || true
 
         # 显示评分（仅供参考）
         echo "📈 Pylint 评分（仅供参考）:"
-        pylint app/ --score=yes --reports=no | tail -2 || true
+        uv run --locked --no-sync pylint app/ --score=yes --reports=no | tail -2 || true
 
     - name: Upload pylint report
       uses: actions/upload-artifact@v4