Install the deployment venv with uv

.github/workflows/build.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.12"]
+        python-version: ["3.14"]
 
     steps:
       - name: Check out repository

.github/workflows/docs.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install docs dependencies
         run: |

.github/workflows/pylint.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.12"]
+        python-version: ["3.14"]
     steps:
     - uses: actions/checkout@v4
 

.gitignore

@@ -151,3 +151,7 @@ cython_debug/
 
 # MacOS
 .DS_Store
+
+# Resolved dependency set, recorded per host. Committed at integration, when
+# both hosts have to match.
+uv.lock

.python-version

@@ -0,0 +1 @@
+3.14

README.md

@@ -47,13 +47,22 @@ cd hispec
 git submodule sync --recursive
 git submodule update --init --recursive
 
-# 3) (Recommended) Create a Python env
-python -m venv .venv
-source .venv/bin/activate  # Windows: .venv\Scripts\activate
+# 3) Create the environment and install, editable
+uv sync
+```
+
+`uv sync` builds `.venv` on the Python named in `.python-version`, installs
+every dependency and puts this package in it editable, so a `git pull` changes
+behaviour without reinstalling. Run commands through `uv run <command>`, or
+activate `.venv` if you prefer.
 
-# 4) Install package(s) for development
-pip install -U pip
-pip install -e ".[dev]"    # falls back to requirements.txt if no pyproject
+`uv.lock` is not committed while the git dependencies deliberately track their
+default branches. It still records which commit of libby, bamboo and the rest
+your checkout resolved to, which is how to tell what you are running. `uv sync`
+reuses that lock once it exists, so pick up a merged dependency change with:
+
+```bash
+uv lock --upgrade && uv sync
 ```
 
 ## Submodules

pyproject.toml

@@ -16,7 +16,7 @@ authors = [
     { name="Prakriti Gupta", email="pgupta@astro.caltech.edu" }
 ]
 readme = "README.md"
-requires-python = ">=3.7"
+requires-python = ">=3.10"
 dependencies = [
     "keyring",
     "pipython",

systemd/install.sh

@@ -20,6 +20,18 @@ set -euo pipefail
 REPO_DIR="${HISPEC_REPO_DIR:-/opt/hispec/app}"
 VENV_DIR="${HISPEC_VENV_DIR:-/opt/hispec/venv}"
 OPS_USERS="${HISPEC_OPS_USERS:-} $*"
+UV_VERSION="${HISPEC_UV_VERSION:-0.12.23}"
+# Its own copy rather than whatever uv is on PATH, since a snap refreshes
+# itself and would unpin the resolver
+UV_BIN=/usr/local/bin/uv
+
+# Keeps uv out of .venv and on the path every unit already references
+export UV_PROJECT_ENVIRONMENT="$VENV_DIR"
+
+# The daemons run as `hispec`, and this script runs as root, so a uv-managed
+# interpreter would land under root's home where they could not read it. Use
+# the system Python, as `python3 -m venv` did.
+export UV_NO_MANAGED_PYTHON=1
 
 if [[ $EUID -ne 0 ]]; then
     echo "Run as root (sudo)." >&2
@@ -96,14 +108,22 @@ fi
 chown root:hispec-ops /etc/hispec/host
 chmod 0644 /etc/hispec/host
 
-# Python environment (editable install so `git pull` picks up code changes
-# without reinstalling).
-if [[ ! -x "$VENV_DIR/bin/python3" ]]; then
-    python3 -m venv "$VENV_DIR"
-    echo "created venv at $VENV_DIR"
+# Pinned, so re-running the installer cannot resolve with a different uv
+if [[ "$("$UV_BIN" --version 2>/dev/null)" != "uv $UV_VERSION"* ]]; then
+    curl -LsSf "https://astral.sh/uv/$UV_VERSION/install.sh" |
+        env UV_INSTALL_DIR=/usr/local/bin UV_NO_MODIFY_PATH=1 sh
+    echo "installed uv $UV_VERSION at $UV_BIN"
 fi
-"$VENV_DIR/bin/pip" install -U pip
-"$VENV_DIR/bin/pip" install -e "$REPO_DIR"
+
+# Python environment (editable install so `git pull` picks up code changes
+# without reinstalling). Upgrade the lock first: the git dependencies track
+# their default branch deliberately, and a reinstall is how a merged libby fix
+# reaches a host.
+(
+    cd "$REPO_DIR"
+    "$UV_BIN" lock --upgrade
+    "$UV_BIN" sync
+)
 chown -R hispec:hispec "$VENV_DIR"
 
 # Unit file + polkit rule (grants hispec-ops members start/stop/restart on