chore: harden supply chain — exclude-newer, pin actions and uv

[everettVT]

Summary

• Add exclude-newer = "2026-03-25T00:00:00Z" to [tool.uv] — prevents uv from resolving any Python package published in the last 7 days during fresh resolves, giving the community time to detect and yank malicious releases (motivated by recent Axios npm and litellm supply chain attacks).
• Pin jlumbroso/free-disk-space from mutable @main to @v1.3.1 across all CI workflows.
• Pin docker-practice/actions-setup-docker from mutable @master to @v1.
• Pin pip install uv in .readthedocs.yaml to uv==0.9.2.

Context

Recent supply chain attacks (Axios npm hijack, litellm poisoned scanner) highlighted gaps in our dependency resolution and CI action pinning. This PR addresses the lowest-hanging fruit. Follow-up PRs planned for:

• SBOM generation via syft in the release pipeline
• CodeQL / SAST scanning workflow

Test plan

• CI workflows pass with pinned action versions
• uv lock still works with exclude-newer set (only affects fresh resolves, not existing lockfile)
• ReadTheDocs builds succeed with pinned uv version

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR hardens the supply chain by pinning mutable CI action tags to specific versions and adding a uv exclude-newer date to restrict package resolution. The action-pinning changes are a clear improvement, but the exclude-newer approach has a design flaw worth addressing before merging.

Key changes:

• jlumbroso/free-disk-space pinned from @main → @v1.3.1 across build-docs.yml, nightly-publish-s3.yml, and pr-test-suite.yml (10 usages total)
• docker-practice/actions-setup-docker pinned from @master → @v1 in nightly-publish-s3.yml
• pip install uv pinned to uv==0.9.2 in .readthedocs.yaml
• exclude-newer = "2026-03-25T00:00:00Z" added to [tool.uv] in pyproject.toml

Issues found:

• The exclude-newer timestamp in pyproject.toml is a static date, not a rolling window. The comment correctly describes the intent (prevent packages from the last 7 days), but uv's exclude-newer is a hard cutoff — it will block all package versions published after 2026-03-25 indefinitely. Within weeks this will prevent legitimate dependency updates and security-patch upgrades. This needs a process to bump the date regularly or a different approach entirely.
• docker-practice/actions-setup-docker@v1 is still a mutable floating major-version tag; commit-SHA pinning would give the supply-chain guarantee the PR title promises. The same applies to jlumbroso/free-disk-space@v1.3.1.

Confidence Score: 4/5

• Safe to merge with caution — the action-pinning changes are correct improvements, but the static exclude-newer date should be addressed soon to avoid blocking dependency updates.
• One P1 finding: the hardcoded exclude-newer date does not implement the stated rolling-window intent and will actively block legitimate package resolution as it ages. The P2 finding (mutable @v1 tag) is a best-practice gap but not immediately harmful. The rest of the changes are straightforward and correct.
• pyproject.toml — the exclude-newer static timestamp needs a maintenance strategy; .github/workflows/nightly-publish-s3.yml — docker action still uses a mutable tag.

Important Files Changed

Filename	Overview
pyproject.toml	Adds [tool.uv] section with a static exclude-newer timestamp that does not implement the intended rolling 7-day window and will increasingly block legitimate dependency updates over time.
.github/workflows/nightly-publish-s3.yml	Pins jlumbroso/free-disk-space to @v1.3.1 and docker-practice/actions-setup-docker from @master to @v1; @v1 is still a mutable floating tag that does not fully achieve supply-chain hardening.
.github/workflows/pr-test-suite.yml	Pins all eight jlumbroso/free-disk-space usages (including one commented-out instance) from @main to @v1.3.1; straightforward and correct.
.github/workflows/build-docs.yml	Pins jlumbroso/free-disk-space from @main to @v1.3.1; straightforward one-line change.
.readthedocs.yaml	Pins uv to uv==0.9.2 in the ReadTheDocs post-install step; will require periodic manual bumps but is otherwise a correct hardening change.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Developer runs uv lock or uv add] --> B{exclude-newer check}
    B -->|Published on or before 2026-03-25| C[Allowed into lockfile]
    B -->|Published after 2026-03-25| D[Excluded by uv]
    D --> E[Static cutoff - window grows over time]
    E --> F[Legitimate updates and CVE fixes blocked]

    G[CI Workflow triggers] --> H{Action ref type}
    H -->|Semver tag v1.3.1| I[Mutable but relatively stable]
    H -->|Floating major tag v1| J[Mutable - same risk as master]
    H -->|Full commit SHA| K[Immutable - ideal for supply chain]

Loading

_{Reviews (1): Last reviewed commit: "chore: harden supply chain — exclude-new..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.13%. Comparing base (e97a24d) to head (87880e6).
⚠️ Report is 348 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6565      +/-   ##
==========================================
+ Coverage   75.12%   75.13%   +0.01%     
==========================================
  Files        1047     1047              
  Lines      141838   141829       -9     
==========================================
+ Hits       106549   106558       +9     
+ Misses      35289    35271      -18     

see 12 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.