fix: refresh isolated Python projects with published tooling 0.2.3

.github/workflows/audit.yml

@@ -8,12 +8,18 @@ on:
       - "**/Cargo.toml"
       - "**/Cargo.lock"
       - rust-toolchain.toml
+      - "**/pyproject.toml"
+      - "**/uv.lock"
+      - .github/actions/setup-tools/action.yml
   pull_request:
     paths:
       - .github/workflows/audit.yml
       - "**/Cargo.toml"
       - "**/Cargo.lock"
       - rust-toolchain.toml
+      - "**/pyproject.toml"
+      - "**/uv.lock"
+      - .github/actions/setup-tools/action.yml
   schedule:
     - cron: "0 6 * * 1" # Monday at 6 AM UTC
   workflow_dispatch:
@@ -28,13 +34,37 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  actions: read
   contents: read
-  security-events: write
 
 jobs:
+  python-audit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up declared tools
+        uses: ./.github/actions/setup-tools # zizmor: ignore[self-repository] actionlint 1.7.12 does not accept $/...
+
+      - name: Audit root and independent Python locks
+        run: uv run --locked --group dev research-repo-tools security osv uv.lock tooling/semgrep/uv.lock
+
+      - name: Retain dependency audit reports
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: python-audit-results
+          path: target/security/osv-*
+
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     env:
       CARGO_AUDIT_VERSION: "0.22.2"
     steps:

.github/workflows/release-benchmarks.yml

@@ -54,7 +54,7 @@ jobs:
             echo "::error::Dispatch with --ref $RELEASE_TAG and the matching tag input"
             exit 1
           fi
-          target="$(uvx --python 3.15 --from research-repo-tools==0.2.2 research-repo-tools \
+          target="$(uvx --python 3.15 --from research-repo-tools==0.2.3 research-repo-tools \
             --root "$RUNNER_TEMP" performance release-draft "$GH_REPO" "$RELEASE_TAG" \
             --commit "$GITHUB_SHA" --expected-title "$RELEASE_TAG" | jq -c .)"
           echo "target=$target" >> "$GITHUB_OUTPUT"
@@ -194,7 +194,7 @@ jobs:
 
           [[ "$RELEASE_ASSET" == "la-stack-${RELEASE_TAG}-criterion-baseline.tar.gz" ]] || exit 1
           printf '%s\n' "$RELEASE_TARGET" > "$RUNNER_TEMP/release-target.json"
-          uvx --python 3.15 --from research-repo-tools==0.2.2 research-repo-tools \
+          uvx --python 3.15 --from research-repo-tools==0.2.3 research-repo-tools \
             --root "$RUNNER_TEMP" performance release-upload "$GH_REPO" "$RELEASE_TAG" \
             "$GITHUB_WORKSPACE/$RELEASE_ASSET" --target "$RUNNER_TEMP/release-target.json"
 

CONTRIBUTING.md

@@ -39,7 +39,7 @@ change files. Run bare `just` for the complete generated command list, including
 arguments and descriptions. The [command policy](docs/dev/docs.md#command-discovery-and-placement)
 owns recipe naming and documentation placement.
 
-Setup, tool checks, updates, changelog, and opt-in CodeRabbit review use the published `research-repo-tools==0.2.2` package,
+Setup, tool checks, updates, changelog, and opt-in CodeRabbit review use the published `research-repo-tools==0.2.3` package,
 locked in the `tooling` dependency group and included by `dev`. Normal setup
 and CI install it from PyPI through `uv sync --locked --group dev`; a sibling
 checkout is unnecessary. To upgrade it deliberately, review the exact
@@ -66,6 +66,12 @@ Then `just update-dependencies` upgrades Cargo requirements and refreshes Cargo'
 lock, resolves exact direct Python `dev` pins, refreshes the complete `uv.lock`,
 and explicitly synchronizes `dev` with managed Rust available for native builds.
 Included groups retain their constraints, including the exact shared-package pin.
+The shared Python updater also refreshes `tooling/semgrep/uv.lock` and syncs its
+separate environment through `deps.python-projects`. It retains the scanner's
+exact Semgrep pin, Python 3.14 selector, and dependency overrides. Declare future
+independent uv projects in the same list so they participate in `just update`.
+The hosted dependency audit checks both Python lockfiles with the shared OSV
+adapter; its existing Cargo audit retains the native Rust advisory policy.
 `just update-cargo-dependencies` excludes `num-bigint` and `num-rational` from
 incompatible requirement upgrades because their public types must advance
 together; Cargo can still refresh locked versions within those requirements.

docs/RELEASING.md

@@ -337,7 +337,7 @@ release ID and tag commit before attaching
 the archive. Do not edit the draft, move the tag,
 or publish manually while the workflow is running.
 
-The privileged jobs install the exact published `research-repo-tools==0.2.2`
+The privileged jobs install the exact published `research-repo-tools==0.2.3`
 package on Python 3.15 without repository checkout. Preflight emits versioned
 target JSON with the captured ID, commit and title assertion. Its trusted job
 output passes directly to the publisher, separately from the producer's inert

docs/code_organization.md

@@ -213,7 +213,7 @@ Original artifacts, including the v0.5.0/v0.4.6 complete run, remain frozen
 without regeneration or invented acquisition records. New complete runs
 support offline rendering through the declared eligibility policy.
 
-`tooling/semgrep/` owns a locked Python 3.14 environment for Semgrep 1.180.0
+`tooling/semgrep/` owns a locked Python 3.14 environment for Semgrep 1.182.0
 while its wheels exclude Python 3.15. Local scans, shared fixture validation
 and hosted SARIF use it; ordinary support scripts use Python 3.15.
 The root `.semgrepignore` keeps ordinary Rust and Python tests in those scans

docs/dev/performance-tooling-adoption.md

@@ -8,23 +8,25 @@ belong to research-repo-tools.
 
 ## Publication boundary
 
-The dependency-only environment pins the published `research-repo-tools==0.2.2`
+The dependency-only environment pins the published `research-repo-tools==0.2.3`
 package, including the release workflow's isolated installations.
-Upstream [#118](https://github.com/acgetchell/research-repo-tools/pull/118)
-adds the missing minimum-release acquisition contract; release
-[#119](https://github.com/acgetchell/research-repo-tools/pull/119) published it
-from commit `e9310163d2789532bdcb155ef93b721473dc5523`. v0.2.1 supplied the declarative workflow interfaces but could
-not express the consumer's v0.5.0 measurement floor.
-
-[PyPI v0.2.2](https://pypi.org/project/research-repo-tools/0.2.2/) lists both
+Upstream [#123](https://github.com/acgetchell/research-repo-tools/pull/123)
+adds trusted main-validation artifact reuse for release promotion; v0.2.3
+was published from commit `4085125526e21b2855eb7c61a52ee312782ae31a`.
+It also refreshes explicitly declared independent Python projects while
+preserving their selectors, exact pins, overrides, and separate environments.
+The minimum-release acquisition contract introduced by v0.2.2 remains in place:
+v0.2.1 could not express the consumer's v0.5.0 measurement floor.
+
+[PyPI v0.2.3](https://pypi.org/project/research-repo-tools/0.2.3/) lists both
 distributions as unyanked. Their SHA-256 hashes match the signed
-[GitHub release assets](https://github.com/acgetchell/research-repo-tools/releases/tag/v0.2.2)
+[GitHub release assets](https://github.com/acgetchell/research-repo-tools/releases/tag/v0.2.3)
 and the exact registry lock entries:
 
 | Distribution | SHA-256 |
 | --- | --- |
-| Wheel | `b82e11ef8265f0b03c37cac93f59d5854a63543c29ee378f5980623af57d9381` |
-| Source distribution | `4937f202a55c5678af30bae915e01ddbc17f9dd8dd9e143b2f430331b42e8f50` |
+| Wheel | `da5f0259027662e7706b7f2b8a38d8e1f1d8a5dce314e2c996177b2947514fc6` |
+| Source distribution | `13700b174656ffad265ecb926dd66013949853b7a39c088ab6d3852aba72df95` |
 
 Runtime imports and acceptance checks use this installed package. No sibling
 checkout, private API, or release-candidate installation supplies final evidence.
@@ -143,7 +145,7 @@ reruns or new performance claims are needed.
 
 The dependency-only environment remains Python 3.15. Python supports shared
 tools and consumer tests; deleting production scripts does not remove it.
-Semgrep 1.180.0 still requires its separately locked Python 3.14 environment
+Semgrep 1.182.0 still requires its separately locked Python 3.14 environment
 under `tooling/semgrep/`. Retire that exception only when published scanner
 wheels support Python 3.15 and native gates pass.
 

justfile

@@ -719,11 +719,9 @@ update-cargo-tools:
 # Dependency-only updates leave uv and managed Cargo tool pins unchanged.
 update-dependencies: update-cargo-dependencies update-python-dependencies
 
-# Advance direct dev pins, refresh the whole lock, and explicitly synchronize dev.
+# Advance main dev pins, then refresh and sync the root and Semgrep environments.
 update-python-dependencies:
-    uv run --locked --only-group tooling --inexact research-repo-tools deps update-python
-    uv lock --upgrade
-    {{ _run }} uv sync --locked --managed-python --group dev
+    uv run --locked --only-group tooling --inexact research-repo-tools deps update-python --all-projects
 
 alias update-python-deps := update-python-dependencies
 

pyproject.toml

@@ -86,25 +86,28 @@ line-length = 160
 
 [tool.uv]
 package = false
-required-version = "==0.13.3"
+required-version = "==0.13.4"
 # Semgrep has its own locked Python 3.14 environment under tooling/semgrep.
 
 [dependency-groups]
-tooling = [ "research-repo-tools==0.2.2" ]
+tooling = [ "research-repo-tools==0.2.3" ]
 dev = [
     { include-group = "tooling" },
     "actionlint-py==1.7.12.25",
     "pytest==9.1.1",
     "ruff==0.17.1",
     "shellcheck-py==0.11.0.1",
     "shfmt-py==4.2.0",
-    "ty==0.0.89",
+    "ty==0.0.90",
     "yamllint==1.38.0",
 ]
 
 [tool.research-repo-tools]
 schema = 1
 
+[tool.research-repo-tools.deps]
+python-projects = [ "tooling/semgrep" ]
+
 [tool.research-repo-tools.toolchain.binaries]
 gitleaks = "8.30.1"
 osv-scanner = "2.7.0"
@@ -113,9 +116,9 @@ osv-scanner = "2.7.0"
 cargo-edit = "0.13.13"
 cargo-llvm-cov = "0.9.1"
 cargo-machete = "0.9.2"
-cargo-nextest = "0.9.148"
+cargo-nextest = "0.9.149"
 clippy-sarif = "0.8.0"
-dprint = "0.64.0"
+dprint = "0.64.1"
 git-cliff = "2.14.2"
 rumdl = "0.3.0"
 sarif-fmt = "0.8.0"

tooling/README.md

@@ -14,7 +14,7 @@ runs the installed-package integration tests. `just ci` is the final
 repository validation. Native Linux, macOS and Windows CI is required for
 adoption; local macOS results do not establish the other platforms.
 
-Semgrep 1.180.0 retains its separate locked Python 3.14 environment in
+Semgrep 1.182.0 retains its separate locked Python 3.14 environment in
 `tooling/semgrep/` while its wheels exclude Python 3.15. Ordinary Rust and
 Python tests remain scan targets; deliberate `tests/semgrep/` fixtures are
 checked separately by `just semgrep-test`.

tooling/semgrep/pyproject.toml

@@ -2,7 +2,7 @@
 name = "la-stack-semgrep"
 version = "0.0.0"
 requires-python = ">=3.14,<3.15"
-dependencies = [ "semgrep==1.180.0" ]
+dependencies = [ "semgrep==1.182.0" ]
 
 [tool.uv]
 package = false