Use uv-managed Python for the CI jobs by reaperhulk · Pull Request #15572 · pyca/cryptography

reaperhulk · 2026-09-02T04:11:19Z

actions/setup-python on macOS downloads the python.org pkg and runs the installer, and the "Install Python binaries from prebuilt package" step takes 30–50s per job. On Windows the download and extraction is similarly the slowest part of the job. astral-sh/setup-uv installs a python-build-standalone interpreter in a few seconds.

Applies to every job that used actions/setup-python in ci.yml: linux, macOS, windows (x64 and arm64) and downstream.

The uv version comes from ci-constraints-requirements.txt via version-file, so it stays in lockstep with the pinned uv== that dependabot bumps.
activate-environment puts a venv on that interpreter first on PATH; nox is installed into it with uv pip install.
The matrix names use uv's spellings: 3.15 / 3.15t (uv resolves an unreleased minor to its latest prerelease) and pypy3.11. The cargo cache key uses the resolved version, read from the interpreter, as before.
The linux job puts the interpreter's LIBDIR on LD_LIBRARY_PATH for the rust session, whose cargo test binaries link libpython.
The uv cache replaces setup-python's pip cache, keyed on the same constraints file.

The trade-off is that these jobs no longer exercise the python.org framework build on macOS; the wheel builder still installs and uses the python.org pkg.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

setup-python installs the python.org pkg, and that installer runs for 30-50s per job on the macOS runners. uv installs a python-build-standalone interpreter in a few seconds. The uv version comes from the constraints file, and the matrix names drop the -dev suffix because uv resolves an unreleased minor to its latest prerelease. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

reaperhulk · 2026-09-02T04:20:08Z

Timing for the macOS jobs. "Before" is the two most recent warm main runs (33562151532 and the re-run of 33588967176); "after" is this PR's run (33589841415). The setup step is the direct effect; the build and test steps are unchanged by this PR and vary ±10s run to run.

Job	Setup python, before	Setup python, after	Job total, before	Job total, after
3.9	25s / 30s	3s	156s / 146s	137s
3.14	3s / 4s	2s	142s / 115s	158s
3.14t	57s / 51s	6s	215s / 188s	148s
3.15 (was 3.15-dev)	50s / 45s	4s	215s / 198s	115s
3.15t (was 3.15t-dev)	36s / 32s	9s	173s / 133s	167s

3.14 was already fast because that version is preinstalled in the runner image's toolcache; every other version paid for the pkg installer. Summed over the five jobs the setup step goes from about 170s to about 24s per run. The 3.15 / 3.15t caches were cold in this run because their key changed (matrix name and resolved version), so their build and total numbers will settle on the next run.

Generated by Claude Code

alex

@reaperhulk let's chat about this one

alex · 2026-09-02T11:16:52Z

+          - {VERSION: "3.15", NOXSESSION: "tests"}
+          - {VERSION: "3.15t", NOXSESSION: "tests"}


-dev isn't required for pre-releases?

Right: uv has no -dev spelling (3.15-dev is rejected as an executable name), and a bare minor resolves to the latest prerelease when no stable release exists. Checked with the pinned uv 0.12.8: uv python install 3.15 gives cpython-3.15.0rc1, 3.15t gives cpython-3.15.0rc1+freethreaded, 3.14t gives 3.14.7+freethreaded. The run on this PR used those.

Generated by Claude Code

alex · 2026-09-02T11:17:21Z

+          cache-dependency-glob: ci-constraints-requirements.txt
        timeout-minutes: 3
+      - id: python-version
+        run: echo "version=$(python -c 'import platform; print(platform.python_version())')" >> $GITHUB_OUTPUT


@woodruffw can you give us this as an output :-) Surely setup-uv already has this value internally

Yeah, I can look into this. I thought we did have this as a version output.

In case it helps: in v10.0.1 the python-version output is the input string echoed back (getPythonVersion in src/setup-uv.ts returns inputs.pythonVersion when set), so 3.15t comes out as 3.15t rather than 3.15.0rc1. uv python find --show-version after the venv is created would give the resolved value.

Generated by Claude Code

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

alex · 2026-09-02T23:19:32Z

Notes:

We want a uv fix for the output stuff
We'd lke but won't block on a -dev thing from uv
We want this for all OS

…-uv-o7pqs0

The windows arm64 job stays on setup-python: uv has no Windows arm64 interpreters. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

reaperhulk · 2026-09-02T23:33:30Z

Extended to the linux, windows x64 and downstream jobs (c4c8e9f, plus 6932c44 which puts the interpreter's LIBDIR on LD_LIBRARY_PATH for the rust session: its cargo test binaries link libpython, which setup-python had been making findable implicitly). Windows arm64 stays on setup-python because uv has no Windows arm64 interpreters, so its matrix entries keep the -dev spelling.

Setup step times, last warm main run (33588967176) versus this head (33695131695); for Windows the whole windows-tests action, since the composite hides its steps:

Job group	Before, median (max)	After, median (max)
linux "Setup python", 30 jobs	5s (13s)	3s (5s)
macos "Setup python", 5 jobs	32s (51s)	7s (11s)
windows x64, whole action, 5 jobs	218s (241s)	177s (185s)
downstream "Setup python", 10 jobs	4.5s (7s)	3s (3s)

Linux was already fast because the runner image preinstalls those versions; macOS and Windows x64 are where the time was.

Generated by Claude Code

uv does ship Windows arm64 interpreters; they just don't appear in `uv python list --all-platforms`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

Left to a bare version request, uv on Windows arm64 downloads the x86_64 build, and maturin then targets x86_64-pc-windows-msvc. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

alex reviewed Sep 2, 2026

View reviewed changes

Drop comment

e268b89

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

alex reviewed Sep 2, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml Outdated

Restore the cache key comment

e876df4

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

claude added 3 commits September 2, 2026 23:21

Merge remote-tracking branch 'origin/main' into claude/ci-macos-setup…

4ae4441

…-uv-o7pqs0

Use uv-managed Python for the linux, windows x64 and downstream jobs too

c4c8e9f

The windows arm64 job stays on setup-python: uv has no Windows arm64 interpreters. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

Put libpython on the loader path for the rust session

6932c44

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

reaperhulk changed the title ~~Use uv-managed Python for the macOS CI jobs~~ Use uv-managed Python for the CI jobs Sep 2, 2026

reaperhulk commented Sep 2, 2026

View reviewed changes

Comment thread .github/actions/windows-tests/action.yml Outdated

claude added 2 commits September 2, 2026 23:44

Use uv-managed Python for the windows arm64 job as well

ede2731

uv does ship Windows arm64 interpreters; they just don't appear in `uv python list --all-platforms`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

Navigation Menu

Uh oh!

Use uv-managed Python for the CI jobs - #15572

Use uv-managed Python for the CI jobs#15572
reaperhulk wants to merge 8 commits into
mainfrom
claude/ci-macos-setup-uv-o7pqs0

reaperhulk commented Sep 2, 2026 •

edited

Loading

Uh oh!

reaperhulk commented Sep 2, 2026

Uh oh!

alex left a comment

Uh oh!

Uh oh!

alex Sep 2, 2026

Uh oh!

reaperhulk Sep 2, 2026

Uh oh!

alex Sep 2, 2026

Uh oh!

woodruffw Sep 2, 2026

Uh oh!

reaperhulk Sep 2, 2026

Uh oh!

Uh oh!

alex commented Sep 2, 2026

Uh oh!

reaperhulk commented Sep 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

		- {VERSION: "3.15", NOXSESSION: "tests"}
		- {VERSION: "3.15t", NOXSESSION: "tests"}

Uh oh!

Conversation

reaperhulk commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

reaperhulk commented Sep 2, 2026

Uh oh!

alex left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alex Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

reaperhulk Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

alex Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

woodruffw Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

reaperhulk Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alex commented Sep 2, 2026

Uh oh!

reaperhulk commented Sep 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

reaperhulk commented Sep 2, 2026 •

edited

Loading