Skip to content

Manage Python with uv + 7-day minimum release age - #23

Open
akan72 wants to merge 1 commit into
akan72/ssh-configfrom
akan72/uv-python-management
Open

Manage Python with uv + 7-day minimum release age#23
akan72 wants to merge 1 commit into
akan72/ssh-configfrom
akan72/uv-python-management

Conversation

@akan72

@akan72 akan72 commented May 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

  • Manage Python installations with uv and prefer uv-managed interpreters.
  • Apply a rolling seven-day package release-age policy through uv.toml.
  • Stack position 14 of 15, after Add hardened SSH client config #22.

Test Plan

  • Ran the complete installer in a fresh synthetic home on the Mac mini.
  • Parsed uv/uv.toml with real uv 0.11.8 and confirmed the installer invoked uv python install.
  • Ran bash -n assimilate.sh, uv --config-file uv/uv.toml --version, and git diff --check.
  • Screenshots: not applicable; validation was CLI-based.

@akan72 akan72 mentioned this pull request Jul 5, 2026
Open
@akan72 akan72 mentioned this pull request Jul 21, 2026
Open
88 tasks
@akan72
akan72 changed the base branch from main to akan72/ssh-config August 22, 2026 19:29
@akan72
akan72 force-pushed the akan72/uv-python-management branch from 8c87bfa to 1702334 Compare August 22, 2026 19:29
akan72 added a commit that referenced this pull request Aug 22, 2026
@akan72
Set 7-day minimum release age for npm and bun installs
2dbbaaf 
Extends the supply-chain protection uv got in #23 to the JS package
managers actually in use:

- npm: min-release-age=7 (days) appended to ~/.npmrc by assimilate.sh,
  append-only since npm login writes auth tokens there. Enforced by
  npm >= 11.10; older npms warn about the unknown key and ignore it.
- bun: [install].minimumReleaseAge = 604800 (seconds) in .bunfig.toml at
  the repo root — bun's global config path is $XDG_CONFIG_HOME/.bunfig.toml
  and XDG_CONFIG_HOME points at this repo. Also symlinked to ~/.bunfig.toml
  for contexts without XDG_CONFIG_HOME.

Verified on this machine: with vite@8.1.3 published 3 days ago, both npm
and bun resolve vite to 8.1.0, the newest version older than 7 days.
@akan72
akan72 force-pushed the akan72/uv-python-management branch from 1702334 to 3152f60 Compare August 22, 2026 19:36
akan72 added a commit that referenced this pull request Aug 22, 2026
@akan72 Alex Kan
Set 7-day minimum release age for npm and bun installs
74abeb6 
Extends the supply-chain protection uv got in #23 to the JS package
managers actually in use:

- npm: min-release-age=7 (days) appended to ~/.npmrc by assimilate.sh,
  append-only since npm login writes auth tokens there. Enforced by
  npm >= 11.10; older npms warn about the unknown key and ignore it.
- bun: [install].minimumReleaseAge = 604800 (seconds) in .bunfig.toml at
  the repo root — bun's global config path is $XDG_CONFIG_HOME/.bunfig.toml
  and XDG_CONFIG_HOME points at this repo. Also symlinked to ~/.bunfig.toml
  for contexts without XDG_CONFIG_HOME.

Verified on this machine: with vite@8.1.3 published 3 days ago, both npm
and bun resolve vite to 8.1.0, the newest version older than 7 days.
@akan72
akan72 force-pushed the akan72/uv-python-management branch from 3152f60 to 16c975a Compare August 22, 2026 19:42
akan72 added a commit that referenced this pull request Aug 22, 2026
@akan72
Set 7-day minimum release age for npm and bun installs
bda5fad 
Extends the supply-chain protection uv got in #23 to the JS package
managers actually in use:

- npm: min-release-age=7 (days) appended to ~/.npmrc by assimilate.sh,
  append-only since npm login writes auth tokens there. Enforced by
  npm >= 11.10; older npms warn about the unknown key and ignore it.
- bun: [install].minimumReleaseAge = 604800 (seconds) in .bunfig.toml at
  the repo root — bun's global config path is $XDG_CONFIG_HOME/.bunfig.toml
  and XDG_CONFIG_HOME points at this repo. Also symlinked to ~/.bunfig.toml
  for contexts without XDG_CONFIG_HOME.

Verified on this machine: with vite@8.1.3 published 3 days ago, both npm
and bun resolve vite to 8.1.0, the newest version older than 7 days.
@akan72
akan72 force-pushed the akan72/uv-python-management branch from 16c975a to fd11260 Compare August 22, 2026 19:46
akan72 added a commit that referenced this pull request Aug 22, 2026
@akan72
Set 7-day minimum release age for npm and bun installs
a6fdf28 
Extends the supply-chain protection uv got in #23 to the JS package
managers actually in use:

- npm: min-release-age=7 (days) appended to ~/.npmrc by assimilate.sh,
  append-only since npm login writes auth tokens there. Enforced by
  npm >= 11.10; older npms warn about the unknown key and ignore it.
- bun: [install].minimumReleaseAge = 604800 (seconds) in .bunfig.toml at
  the repo root — bun's global config path is $XDG_CONFIG_HOME/.bunfig.toml
  and XDG_CONFIG_HOME points at this repo. Also symlinked to ~/.bunfig.toml
  for contexts without XDG_CONFIG_HOME.

Verified on this machine: with vite@8.1.3 published 3 days ago, both npm
and bun resolve vite to 8.1.0, the newest version older than 7 days.
@akan72
akan72 force-pushed the akan72/uv-python-management branch from fd11260 to c71da39 Compare August 22, 2026 19:50
akan72 added a commit that referenced this pull request Aug 22, 2026
@akan72
Set 7-day minimum release age for npm and bun installs
6bc2af5 
Extends the supply-chain protection uv got in #23 to the JS package
managers actually in use:

- npm: min-release-age=7 (days) appended to ~/.npmrc by assimilate.sh,
  append-only since npm login writes auth tokens there. Enforced by
  npm >= 11.10; older npms warn about the unknown key and ignore it.
- bun: [install].minimumReleaseAge = 604800 (seconds) in .bunfig.toml at
  the repo root — bun's global config path is $XDG_CONFIG_HOME/.bunfig.toml
  and XDG_CONFIG_HOME points at this repo. Also symlinked to ~/.bunfig.toml
  for contexts without XDG_CONFIG_HOME.

Verified on this machine: with vite@8.1.3 published 3 days ago, both npm
and bun resolve vite to 8.1.0, the newest version older than 7 days.
@akan72
Manage Python with uv + 7-day rolling minimum release age
5f56e69 
- Add uv/uv.toml with exclude-newer = "7 days" (rolling supply-chain window:
  never resolve a package release younger than a week) and
  python-preference = "managed" so uv owns Python version management
- Symlink uv/uv.toml -> ~/.config/uv/uv.toml in assimilate.sh (also discovered
  via $XDG_CONFIG_HOME)
- Add brew "uv" to the Brewfile and run 'uv python install' during assimilate
  to install a uv-managed CPython on fresh machines
@akan72
akan72 force-pushed the akan72/uv-python-management branch from c71da39 to 5f56e69 Compare August 22, 2026 19:54
akan72 added a commit that referenced this pull request Aug 22, 2026
@akan72
Set 7-day minimum release age for npm and bun installs
2399176 
Extends the supply-chain protection uv got in #23 to the JS package
managers actually in use:

- npm: min-release-age=7 (days) appended to ~/.npmrc by assimilate.sh,
  append-only since npm login writes auth tokens there. Enforced by
  npm >= 11.10; older npms warn about the unknown key and ignore it.
- bun: [install].minimumReleaseAge = 604800 (seconds) in .bunfig.toml at
  the repo root — bun's global config path is $XDG_CONFIG_HOME/.bunfig.toml
  and XDG_CONFIG_HOME points at this repo. Also symlinked to ~/.bunfig.toml
  for contexts without XDG_CONFIG_HOME.

Verified on this machine: with vite@8.1.3 published 3 days ago, both npm
and bun resolve vite to 8.1.0, the newest version older than 7 days.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@akan72