fix(ci): download pinned uv 0.12.1 from GitHub Releases

[cursor]

Buyer-visible gap

Org-wide OpenCode coverage-evidence was failing before any product test ran. The pinned uv 0.12.1 archive at releases.astral.sh now returns HTTP 403, so required review evidence could not be measured. That blocked formal OpenCode verdicts on live product heads, including ContextualWisdomLab/fast-mlsirm#928, ContextualWisdomLab/fast-mlsirm#959, ContextualWisdomLab/fast-mlsirm#971, and ContextualWisdomLab/scopeweave#490.

What to do next

Review this exact-head change, then let the independent non-author approval and current-head checks land it on protected main. After merge, re-dispatch OpenCode on those product heads so they receive a real semantic verdict instead of an infrastructure CHANGES_REQUESTED.

Bounded change

• Keep TRUSTED_UV_VERSION = 0.12.1 and the existing SHA-256 pin 90b2f223fb69d19db49e117da601f64978593417988530aa733d456141b4bcbb.
• Move the literal urlopen sink to https://github.com/astral-sh/uv/releases/download/0.12.1/uv-x86_64-unknown-linux-gnu.tar.gz.
• Allow exactly one hop from github.com onto release-assets.githubusercontent.com or objects.githubusercontent.com.
• Still reject userinfo, non-HTTPS, nondefault or malformed ports, internal hosts, and any second hop.
• Do not use COPILOT_GITHUB_TOKEN. Do not change the review-agent key scheme.

Verification

• Test-first: the GitHub URL contract failed against the old Astral sink, then passed after the production change.
• Local gate: 1132 passed, 16 subtests, scripts/ci statement/branch coverage 100%, interrogate 100%.
• Live download from this runner: 21,760,555 bytes, SHA-256 matches the existing pin.
• This environment reproduced releases.astral.sh as HTTP 403 with no Location header.

Closes #1109.

Refs ContextualWisdomLab/fast-mlsirm#971, ContextualWisdomLab/scopeweave#490.

  

Summary by CodeRabbit

• 버그 수정

  • uv 다운로드 경로를 공식 GitHub Releases로 변경했습니다.
  • 공식 릴리스 및 자산 호스트로의 안전한 HTTPS 리디렉션만 허용합니다.
  • 비표준 포트, 사용자 인증 정보, 외부 호스트 및 안전하지 않은 연결을 차단합니다.

• 문서

  • uv 다운로드 출처와 리디렉션 보안 요구사항을 최신 동작에 맞게 업데이트했습니다.
  • 품질 검증 조건과 관련 참고자료를 보강했습니다.

• 테스트

  • 허용 및 차단되는 다운로드 URL과 리디렉션 동작에 대한 검증을 확대했습니다.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Pull request is closed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Independent last-push review of exact head c1f388737e0684312644aac4191b44803100cfe0.

Org-wide coverage-evidence was dying because releases.astral.sh 403s the pinned uv 0.12.1 archive. This keeps TRUSTED_UV_VERSION and the SHA-256 pin, moves the sink to GitHub Releases, and allows exactly one github.com hop onto release-assets.githubusercontent.com or objects.githubusercontent.com. Second hops, userinfo, non-HTTPS, and nondefault ports fail closed. Product CI on this SHA is green: Python 3.10/3.14 quality gates, coverage-evidence, pip-audit, Strix, CodeQL. Last-pusher cursoragent, author cursor[bot]. No COPILOT token.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e935cf3-f75e-4bc2-8df4-82a849b59778

📥 Commits

Reviewing files that changed from the base of the PR and between c47afc2 and c1f3887.

📒 Files selected for processing (8)

• ARCHITECTURE.md
• CHANGELOG.md
• docs/doctoring/trusted-uv-lock-materialization.md
• scripts/ci/materialize_base_python_requirements.py
• tests/test_materialize_base_python_requirements.py
• tests/test_trusted_uv_download_contract.py
• tests/test_uv_redirect_and_coverage_contract.py
• tests/test_uv_redirect_boundary.py

---

📝 Walkthrough

Walkthrough

고정된 uv 0.12.1 아카이브의 출처를 GitHub Releases로 변경했습니다. 공식 자산 호스트로의 단일 HTTPS 리디렉션만 허용하고, 최종 URL과 포트 및 인증 정보를 검증하도록 다운로드 로직과 테스트, 문서를 갱신했습니다.

Changes

신뢰된 uv 다운로드 경로

Layer / File(s)	Summary
다운로드 출처 및 리디렉션 검증 scripts/ci/materialize_base_python_requirements.py	고정 URL을 GitHub Releases로 변경했습니다. 공식 자산 호스트로의 단일 리디렉션과 허용된 HTTPS 최종 URL만 허용합니다. 사용자 정보와 비표준 포트도 거부합니다.
다운로드 및 리디렉션 계약 테스트 tests/test_materialize_base_python_requirements.py, tests/test_trusted_uv_download_contract.py, tests/test_uv_redirect_and_coverage_contract.py, tests/test_uv_redirect_boundary.py	GitHub 자산 호스트와 명시적 기본 포트를 허용하는 사례를 추가했습니다. 외부 호스트, 후속 리디렉션, 잘못된 URL 형식, 오프너 구성을 검증합니다.
품질 게이트 및 검증 문서 갱신 ARCHITECTURE.md, CHANGELOG.md, docs/doctoring/trusted-uv-lock-materialization.md	GitHub Releases 출처, SHA-256 고정, 리디렉션 제한 및 URL 검증 계약을 문서화했습니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Downloader as _download_trusted_uv_archive
  participant Opener as urllib opener
  participant Redirects as _TrustedUvReleaseAssetRedirects
  participant CDN as GitHub release asset CDN
  Downloader->>Opener: 고정 GitHub Releases URL 요청
  Opener->>Redirects: Location 리디렉션 전달
  Redirects->>CDN: 공식 asset 호스트로 단일 홉 허용
  CDN-->>Downloader: 최종 응답 URL과 아카이브 반환
  Downloader->>Downloader: 최종 HTTPS 출처 검증 및 SHA-256 확인

Loading

Possibly related PRs

• ContextualWisdomLab/.github#1008: 동일한 trusted uv downloader와 테스트를 수정하지만, 이 PR은 리디렉션 및 호스트 검증을 다룹니다.

Suggested reviewers: seonghobae

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/bc-b44b73ce-cf3c-412f-b476-78db4bdf0665-64d5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}