Merge branch 'y-scope:main' into slackButton

Author: AVMatthews

.github/workflows/clp-artifact-build.yaml

@@ -463,8 +463,10 @@ jobs:
         run: "chown $(id -u):$(id -g) -R ."
         shell: "bash"
 
-      # NOTE: We don't use the cache for scheduled runs so that they run lint:check-cpp-static-full
-      # on all files.
+      # NOTE: We don't restore the cache for `schedule` runs so that below,
+      # `lint:check-cpp-static-full` runs on all files. If we don't do this periodically,
+      # `lint:check-cpp-static-full` could miss issues in files that haven't changed but depend on
+      # files which have changed.
       - if: "'schedule' != github.event_name"
         name: "Restore lint:check-cpp-static-full cache"
         id: "cache-restore-lint-check-cpp-static-full"
@@ -475,9 +477,10 @@ jobs:
             .task/checksum/utils-cpp-lint-clang-tidy-*
             build/lint-clang-tidy
 
-          # NOTE: We use a per-OS cache since different OSes may trigger different clang-tidy
-          # violations.
-          key: "main-branch-ubuntu-jammy-lint:check-cpp-static-full"
+          # NOTE: This key must be kept in-sync with the key prefix in the `actions/cache/save` step
+          # below (we can't use the output of the current step since `schedule` workflow runs don't
+          # run this step).
+          key: "lint:check-cpp-static-full-on-ubuntu-24.04"
 
       - uses: "./.github/actions/run-on-image"
         env:
@@ -505,7 +508,15 @@ jobs:
             .task/checksum/lint-check-cpp-static-full
             .task/checksum/utils-cpp-lint-clang-tidy-*
             build/lint-clang-tidy
-          key: "${{steps.cache-restore-lint-check-cpp-static-full.outputs.cache-primary-key}}"
+
+          # NOTE: This key prefix (without the hash) must be kept in-sync with the
+          # `actions/cache/restore` step above.
+          key: >-
+            lint:check-cpp-static-full-on-ubuntu-24.04-${{hashFiles(
+              '.task/checksum/lint-check-cpp-static-full',
+              '.task/checksum/utils-cpp-lint-clang-tidy-*',
+              'build/lint-clang-tidy/**/*'
+            )}}
 
   package-image:
     name: "package-image"

.github/workflows/clp-core-build-macos.yaml

@@ -94,8 +94,10 @@ jobs:
           --num-jobs $(getconf _NPROCESSORS_ONLN)
           --test-spec "~[Stopwatch]"
 
-      # NOTE: We don't use the cache for scheduled runs so that they run lint:check-cpp-static-full
-      # on all files.
+      # NOTE: We don't restore the cache for `schedule` runs so that below,
+      # `lint:check-cpp-static-full` runs on all files. If we don't do this periodically,
+      # `lint:check-cpp-static-full` could miss issues in files that haven't changed but depend on
+      # files which have changed.
       - if: "'schedule' != github.event_name"
         name: "Restore lint:check-cpp-static-full cache"
         id: "cache-restore-lint-check-cpp-static-full"
@@ -106,9 +108,11 @@ jobs:
             .task/checksum/utils-cpp-lint-clang-tidy-*
             build/lint-clang-tidy
 
-          # NOTE: We use a per-OS cache since different OSes may trigger different clang-tidy
-          # violations.
-          key: "main-branch-${{matrix.os}}-lint:check-cpp-static-full"
+          # NOTE: This key must be kept in-sync with the key prefix in the `actions/cache/save` step
+          # below (we can't use the output of the current step since `schedule` workflow runs don't
+          # run this step).
+          key: "lint:check-cpp-static-full-on-${{matrix.os}}-with\
+          -${{matrix.use_shared_libs == true && 'shared' || 'static'}}-libs"
 
       # TODO: When enough files are passing clang-tidy, switch to a full pass on schedule only.
       # - run: >-
@@ -129,4 +133,14 @@ jobs:
             .task/checksum/lint-check-cpp-static-full
             .task/checksum/utils-cpp-lint-clang-tidy-*
             build/lint-clang-tidy
-          key: "${{steps.cache-restore-lint-check-cpp-static-full.outputs.cache-primary-key}}"
+
+          # NOTE: This key prefix (without the hash) must be kept in-sync with the
+          # `actions/cache/restore` step above.
+          key: >-
+            lint:check-cpp-static-full-on-${{matrix.os}}-with-${{
+              matrix.use_shared_libs == true && 'shared' || 'static'
+            }}-libs-${{hashFiles(
+              '.task/checksum/lint-check-cpp-static-full',
+              '.task/checksum/utils-cpp-lint-clang-tidy-*',
+              'build/lint-clang-tidy/**/*'
+            )}}

.github/workflows/clp-rust-checks.yaml

@@ -2,7 +2,17 @@ name: "clp-rust-checks"
 
 on:
   pull_request:
+    paths: &monitored_paths
+      - ".cargo/**"
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - ".github/workflows/clp-rust-checks.yaml"
+      - "components/clp-rust-utils/**"
+      - "components/log-ingestor/**"
+      - "taskfile.yaml"
+      - "taskfiles/**"
   push:
+    paths: *monitored_paths
   schedule:
     # Run daily at 00:15 UTC (the 15 is to avoid periods of high load)
     - cron: "15 0 * * *"
@@ -31,6 +41,10 @@ jobs:
         shell: "bash"
         run: "npm install -g @go-task/cli@3.44.0"
 
+      - name: "Validate lock files"
+        shell: "bash"
+        run: "task deps:lock:check-rust"
+
       - name: "Lint"
         shell: "bash"
         run: "task lint:check-rust"

.github/workflows/clp-uv-checks.yaml

@@ -0,0 +1,52 @@
+name: "clp-uv-checks"
+
+on:
+  pull_request:
+    paths: &monitored_paths
+      - ".github/workflows/clp-uv-checks.yaml"
+      - "components/clp-mcp-server/pyproject.toml"
+      - "components/clp-mcp-server/uv.lock"
+      - "components/clp-package-utils/pyproject.toml"
+      - "components/clp-package-utils/uv.lock"
+      - "components/clp-py-utils/pyproject.toml"
+      - "components/clp-py-utils/uv.lock"
+      - "components/job-orchestration/pyproject.toml"
+      - "components/job-orchestration/uv.lock"
+      - "integration-tests/pyproject.toml"
+      - "integration-tests/uv.lock"
+  push:
+    paths: *monitored_paths
+  schedule:
+    # Run daily at 00:15 UTC (the 15 is to avoid periods of high load)
+    - cron: "15 0 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: "${{github.workflow}}-${{github.ref}}"
+  # Cancel in-progress jobs for efficiency
+  cancel-in-progress: true
+
+jobs:
+  uv-checks:
+    strategy:
+      matrix:
+        os:
+          - "macos-15"
+          - "ubuntu-22.04"
+          - "ubuntu-24.04"
+    runs-on: "${{matrix.os}}"
+    steps:
+      - uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8"  # v5.0.0
+        with:
+          submodules: "recursive"
+
+      - name: "Install task"
+        shell: "bash"
+        run: "npm install -g @go-task/cli@3.44.0"
+
+      - name: "Install the latest version of uv"
+        uses: "astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41"  # v7.1.2
+
+      - name: "Validate lock files"
+        shell: "bash"
+        run: "task deps:lock:check-uv"