feat: 使用 uv 锁定主程序依赖并强化插件恢复边界 (#6364)

.github/workflows/test.yml

@@ -28,36 +28,29 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
+          version: '0.12.5'
           python-version: '3.12'
-          cache: 'pip'
-
-      - name: Cache pip dependencies
-        uses: actions/cache@v5
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.in', '**/requirements-dev.in', '**/requirements.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
 
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip setuptools wheel
-          # 单测需要开发/测试依赖；运行时入口 requirements.in 不携带测试与构建辅助工具。
-          pip install -r requirements-dev.in
+        run: uv sync --locked
 
       - name: Run tests
         timeout-minutes: 10
         run: |
           # tests/run.py 以 pytest 跑 tests 全量；tests/conftest.py 在收集前把 CONFIG_DIR
           # 指向临时库并建表；CI 额外生成覆盖率报告，便于后续补测和回归分析。
-          python -m coverage erase
-          python -m coverage run tests/run.py
-          python -m coverage report
-          python -m coverage json
-          python -m coverage xml
+          uv run --locked --no-sync python -m coverage erase
+          uv run --locked --no-sync python -m coverage run tests/run.py
+          uv run --locked --no-sync python -m coverage report
+          uv run --locked --no-sync python -m coverage json
+          uv run --locked --no-sync python -m coverage xml
 
       - name: Upload coverage report
         if: always()