Switch to uv for all of our Python scripts (#7242)

This removes the need to install any specific version of Python or
figure out how to configure it by instead asking users to install `uv`
and letting it manage Python. Among other advantages, `uv` is designed
to be fast enough to embed directly into our scripts.

We were already using this in `bench_runner.py` so that the script could
import non standard library dependencies. Moving to it for the rest of
our Python unifies the approach and will also enable dependencies
whenever needed.

I've left `github_tools` alone as it has special handling with its own
Bazel setup.

I've updated the contributing tools to explain the approach here.

.github/workflows/check_dependent_pr.yaml

@@ -27,23 +27,25 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             api.github.com:443 github.com:443 pypi.org:443
-            files.pythonhosted.org:443
+            files.pythonhosted.org:443 raw.githubusercontent.com:443
 
       # Note: pull_request_target checks out the base branch by default.
       # This is safe as it avoids running untrusted code from the PR branch.
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install dependencies
-        run: |
-          python3 -m pip install gql==2.0.0 requests
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          version: '0.11.15'
 
       - name: Check Dependent PR
         run: |
           if [ "$EVENT_ACTION" = "closed" ]; then
-            python3 github_tools/check_dependent_pr.py --scan
+            ./github_tools/check_dependent_pr.py --scan
           else
-            python3 github_tools/check_dependent_pr.py --pr-number "${PR_NUMBER}"
+            ./github_tools/check_dependent_pr.py --pr-number "${PR_NUMBER}"
           fi
         env:
           GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/clangd_tidy.yaml

@@ -48,6 +48,7 @@ jobs:
             oauth2.googleapis.com:443
             objects.githubusercontent.com:443
             pypi.org:443
+            raw.githubusercontent.com:443
             registry.npmjs.org:443
             release-assets.githubusercontent.com:443
             releases.bazel.build:443
@@ -75,13 +76,9 @@ jobs:
         if: steps.filter.outputs.has_cpp == 'true'
         run: ./scripts/create_compdb.py
 
-      - name: Install clangd-tidy
-        if: steps.filter.outputs.has_cpp == 'true'
-        run: pip install clangd-tidy==1.1.0.post2
-
       - name: Run clangd-tidy
         if: steps.filter.outputs.has_cpp == 'true'
         env:
           FILTER_FILES: ${{ steps.filter.outputs.has_cpp_files }}
         run: |
-          clangd-tidy -p . -j 10 $FILTER_FILES
+          uvx --with clangd-tidy==1.1.0.post2 clangd-tidy -p . -j 10 $FILTER_FILES

.github/workflows/gh_pages_ci.yaml

@@ -28,6 +28,13 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          version: '0.11.15'
+
       - name: Prebuild actions
         run: ./website/prebuild.py
       - name: Setup Ruby

.github/workflows/gh_pages_deploy.yaml

@@ -35,6 +35,13 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          version: '0.11.15'
+
       - name: Prebuild actions
         run: ./website/prebuild.py
       - name: Setup Pages

.github/workflows/nightly_release.yaml

@@ -59,6 +59,7 @@ jobs:
             oauth2.googleapis.com:443
             objects.githubusercontent.com:443
             pypi.org:443
+            raw.githubusercontent.com:443
             registry.npmjs.org:443
             release-assets.githubusercontent.com:443
             releases.bazel.build:443

.github/workflows/pre_commit.yaml

@@ -40,6 +40,7 @@ jobs:
             oauth2.googleapis.com:443
             objects.githubusercontent.com:443
             pypi.org:443
+            raw.githubusercontent.com:443
             registry.npmjs.org:443
             release-assets.githubusercontent.com:443
             releases.bazel.build:443
@@ -48,7 +49,6 @@ jobs:
             www.googleapis.com:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 
       # Ensure LLVM is set up consistently.
       - uses: ./.github/actions/build-setup-common

.github/workflows/tests.yaml

@@ -70,6 +70,7 @@ jobs:
             oauth2.googleapis.com:443
             objects.githubusercontent.com:443
             pypi.org:443
+            raw.githubusercontent.com:443
             registry.npmjs.org:443
             release-assets.githubusercontent.com:443
             releases.bazel.build:443