chore(ci): pin onyx-devtools to the pyproject version (#14496)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/audit.yml

@@ -61,7 +61,7 @@ jobs:
         if: github.event_name == 'pull_request'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: uv run --no-sync --with 'onyx-devtools[audit]' ods audit --fail-on=critical
+        run: uv run --no-sync --with 'onyx-devtools[audit]==0.13.2' ods audit --fail-on=critical
 
       - name: Run audit (SARIF report)
         if: github.event_name != 'pull_request'
@@ -70,7 +70,7 @@ jobs:
         # Don't fail the report job on findings; the SARIF upload surfaces them.
         # SARIF goes to stdout (the uploaded file); the text report goes to stderr
         # so the run's findings are also readable in the log.
-        run: uv run --no-sync --with 'onyx-devtools[audit]' ods audit --format=sarif,text > audit.sarif || true
+        run: uv run --no-sync --with 'onyx-devtools[audit]==0.13.2' ods audit --format=sarif,text > audit.sarif || true
 
       - name: Upload SARIF file
         if: github.event_name != 'pull_request'

.github/workflows/deployment.yml

@@ -114,7 +114,7 @@ jobs:
           # Determine if this tag should get the "latest" Docker tag.
           # Only the highest semver stable tag (vX.Y.Z exactly) gets "latest".
           if [[ "$IS_STABLE" == "true" ]]; then
-            HIGHEST_STABLE=$(uv run --no-sync --with onyx-devtools ods latest-stable-tag) || {
+            HIGHEST_STABLE=$(uv run --no-sync --with onyx-devtools==0.13.2 ods latest-stable-tag) || {
               echo "::error::Failed to determine highest stable tag via 'ods latest-stable-tag'"
               exit 1
             }
@@ -184,7 +184,7 @@ jobs:
       - name: Run dependency audit
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: uv run --no-sync --with 'onyx-devtools[audit]' ods audit --fail-on=critical
+        run: uv run --no-sync --with 'onyx-devtools[audit]==0.13.2' ods audit --fail-on=critical
 
   # Validate that a pushed release tag is versioned correctly, via
   # `ods release --check`. A cloud tag must be the tag `ods release cloud`
@@ -216,7 +216,7 @@ jobs:
 
       - name: Validate the tag is versioned correctly
         run: |
-          uv run --no-sync --with onyx-devtools ods release --check --ref "$GITHUB_REF_NAME"
+          uv run --no-sync --with onyx-devtools==0.13.2 ods release --check --ref "$GITHUB_REF_NAME"
 
   notify-slack-on-tag-check-failure:
     needs:
@@ -2084,7 +2084,7 @@ jobs:
         # hard scan failure nothing is written, so seed a valid empty SARIF to keep
         # the always() upload below from choking.
         run: |
-          uv run --no-sync --with 'onyx-devtools[audit]' ods audit image "$IMAGE" \
+          uv run --no-sync --with 'onyx-devtools[audit]==0.13.2' ods audit image "$IMAGE" \
             --fail-on=critical --format=sarif,text > image-audit.sarif || status=$?
           if [ ! -s image-audit.sarif ]; then
             # $schema is a literal SARIF key, not a shell variable.

.github/workflows/post-merge-beta-cherry-pick.yml

@@ -184,7 +184,7 @@ jobs:
             release_args+=(--release "${RELEASE}")
           fi
           set +e
-          uv run --no-sync --with onyx-devtools ods cherry-pick "${MERGE_COMMIT_SHA}" "${release_args[@]}" --yes --no-verify 2>&1 | tee "$output_file"
+          uv run --no-sync --with onyx-devtools==0.13.2 ods cherry-pick "${MERGE_COMMIT_SHA}" "${release_args[@]}" --yes --no-verify 2>&1 | tee "$output_file"
           pipe_statuses=("${PIPESTATUS[@]}")
           exit_code="${pipe_statuses[0]}"
           tee_exit="${pipe_statuses[1]:-0}"

.github/workflows/pr-playwright-tests.yml

@@ -1036,7 +1036,7 @@ jobs:
           PLAYWRIGHT_S3_BUCKET: ${{ env.PLAYWRIGHT_S3_BUCKET }}
           BASELINE_REV: ${{ steps.baseline-rev.outputs.rev }}
         run: |
-          uv run --no-sync --with onyx-devtools ods screenshot-diff compare \
+          uv run --no-sync --with onyx-devtools==0.13.2 ods screenshot-diff compare \
             --project "${PROJECT}" \
             --rev "${BASELINE_REV}"
 
@@ -1107,7 +1107,7 @@ jobs:
           BASELINE_REV: ${{ steps.baseline-rev.outputs.rev }}
         run: |
           if [ -d "web/output/screenshots/" ] && [ "$(ls -A web/output/screenshots/)" ]; then
-            uv run --no-sync --with onyx-devtools ods screenshot-diff upload-baselines \
+            uv run --no-sync --with onyx-devtools==0.13.2 ods screenshot-diff upload-baselines \
               --project "${PROJECT}" \
               --rev "${BASELINE_REV}" \
               --delete

.github/workflows/release-devtools.yml

@@ -61,7 +61,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
-      PYPROJECT_FILE: pyproject.toml
       DEV_REQUIREMENTS_FILE: backend/requirements/dev.txt
     steps:
       - name: Mint GitHub App installation token
@@ -72,6 +71,10 @@ jobs:
           private-key: ${{ secrets.CHERRY_PICK_APP_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write
+          # The upgrade commit also rewrites the `onyx-devtools==` pins in
+          # .github/workflows/. GitHub rejects a push that touches a workflow
+          # file unless the App token carries this permission.
+          permission-workflows: write
 
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v6
@@ -107,19 +110,38 @@ jobs:
             exit 1
           fi
 
-          sed -i -E \
-            "s|(onyx-devtools==)[0-9]+\.[0-9]+\.[0-9]+|\1${new_version}|" \
-            "${PYPROJECT_FILE}"
+          # Every hand-written pin moves together: pyproject.toml, the `ods`
+          # pre-commit hooks, and the CI workflows that run `uv run --with`.
+          # uv.lock and the requirements exports are generated below instead.
+          # The optional extras group is part of the pin (`onyx-devtools[audit]`),
+          # so match it too -- otherwise an extras-only file is skipped.
+          pin_re='onyx-devtools(\[[a-z0-9,._-]+\])?==[0-9]+\.[0-9]+\.[0-9]+'
+          mapfile -t pinned_files < <(
+            git grep -lE "${pin_re}" -- ':!uv.lock' ':!backend/requirements/'
+          )
+          if [ "${#pinned_files[@]}" -eq 0 ]; then
+            echo "::error::Found no onyx-devtools pins to update."
+            exit 1
+          fi
+          printf 'Updating pin in: %s\n' "${pinned_files[@]}"
 
-          if git diff --quiet -- "${PYPROJECT_FILE}"; then
+          sed -i -E \
+            "s|(onyx-devtools(\[[a-z0-9,._-]+\])?==)[0-9]+\.[0-9]+\.[0-9]+|\1${new_version}|" \
+            "${pinned_files[@]}"
+
+          if git diff --quiet -- "${pinned_files[@]}"; then
             echo "onyx-devtools already pinned to ${new_version}. Nothing to do."
             exit 0
           fi
 
           # Regenerate the lockfile so pyproject.toml and uv.lock stay consistent.
+          # Both packages release under one version from this tag, so refresh
+          # both: the `[audit]` extra resolves onyx-devtools-audit, and a stale
+          # cached index entry for it would hold the lock on the old version.
           # Retry to tolerate PyPI index propagation lag right after publish.
           for attempt in 1 2 3 4 5; do
-            if uv lock --refresh-package onyx-devtools; then
+            if uv lock --refresh-package onyx-devtools \
+              --refresh-package onyx-devtools-audit; then
               break
             fi
             if [ "${attempt}" = 5 ]; then
@@ -144,14 +166,14 @@ jobs:
           fi
 
           git switch -c "${branch}"
-          git add "${PYPROJECT_FILE}" uv.lock "${DEV_REQUIREMENTS_FILE}"
+          git add "${pinned_files[@]}" uv.lock "${DEV_REQUIREMENTS_FILE}"
           git commit -m "chore(dev): upgrade onyx-devtools to ${new_version}"
           git push --force origin "${branch}"
 
           body="$(cat <<EOF
           Automated upgrade of \`onyx-devtools\` to \`${new_version}\`, published by [this release run](${RUN_URL}).
 
-          Regenerated \`uv.lock\` and \`backend/requirements/dev.txt\` to match the new pin.
+          Updates every \`onyx-devtools\` pin, extras included (\`pyproject.toml\`, the \`ods\` pre-commit hooks, and the CI workflows), then regenerates \`uv.lock\` and \`backend/requirements/dev.txt\` to match.
 
           Generated by the Release Devtools workflow.
           EOF

.pre-commit-config.yaml

@@ -60,13 +60,16 @@ repos:
         files: ^(pyproject\.toml|uv\.lock|backend/requirements/.*\.txt)$
       - id: uv-run
         name: Check getattr
-        args: ["--no-project", "--with=onyx-devtools", "ods", "check-getattr"]
+        # Keep the pinned version in sync with `onyx-devtools` in the dev
+        # dependency group in pyproject.toml, here and in every `ods` hook
+        # below. Without the pin, `--with` resolves the latest published wheel.
+        args: ["--no-project", "--with=onyx-devtools==0.13.2", "ods", "check-getattr"]
         pass_filenames: true
         files: ^backend/.*\.py$
       - id: uv-run
         name: Check lazy imports
         args:
-          ["--no-project", "--with=onyx-devtools", "ods", "check-lazy-imports"]
+          ["--no-project", "--with=onyx-devtools==0.13.2", "ods", "check-lazy-imports"]
         pass_filenames: true
         files: ^backend/(?!\.venv/|scripts/).*\.py$
       - id: uv-run
@@ -81,7 +84,7 @@ repos:
         # release that adds the embedded-copy sync, the extra trigger paths below
         # are harmless no-ops (the cli module's drift test still gates staleness).
         args:
-          ["--no-project", "--with=onyx-devtools", "ods", "generate-compose", "--write"]
+          ["--no-project", "--with=onyx-devtools==0.13.2", "ods", "generate-compose", "--write"]
         pass_filenames: false
         files: >-
           (?x)^(
@@ -147,9 +150,10 @@ repos:
         # the result matches terraform byte for byte without needing the
         # binary on PATH. Replaces the pre-commit-terraform terraform_fmt hook.
         # `ods fmt tf` and `ods lint tf` ship in onyx-devtools (tools/ods), and
-        # `--with=onyx-devtools` resolves the published wheel, so both hooks
-        # need an ods release before they can run. Tag `ods/` first.
-        args: ["--no-project", "--with=onyx-devtools", "ods", "fmt", "tf"]
+        # `--with=onyx-devtools==` resolves a published wheel, so both hooks
+        # need an ods release and a version bump before they can run. Tag
+        # `ods/` first.
+        args: ["--no-project", "--with=onyx-devtools==0.13.2", "ods", "fmt", "tf"]
         pass_filenames: true
         files: \.tf$
       - id: uv-run
@@ -159,7 +163,7 @@ repos:
         # an internal value can travel across by accident. Fails on account
         # ids, access key ids, routable IPv4 CIDRs, and email addresses.
         # Append '# public-safe: ok' to accept a line.
-        args: ["--no-project", "--with=onyx-devtools", "ods", "lint", "tf"]
+        args: ["--no-project", "--with=onyx-devtools==0.13.2", "ods", "lint", "tf"]
         pass_filenames: true
         files: ^deployment/terraform/.*\.tf$
       - id: uv-run

pyproject.toml

@@ -142,6 +142,8 @@ dev = [
     "manygo==0.2.0",
     "matplotlib==3.10.8",
     "ty==0.0.63",
+    # Keep in sync with the pinned `onyx-devtools==` in the `ods` hooks in
+    # .pre-commit-config.yaml, which install ods into an isolated overlay.
     "onyx-devtools[audit]==0.13.2",
     "openapi-generator-cli==7.17.0",
     "pre-commit==3.2.2",