ci(python): harden uv supply chain checks

.github/workflows/ci.yml

@@ -82,6 +82,9 @@ jobs:
       - name: Publish workflow guard self-test
         working-directory: .
         run: bash scripts/check-publish-workflow-guards_test.sh
+      - name: Python supply-chain guard self-test
+        working-directory: .
+        run: bash scripts/check-python-supply-chain_test.sh
 
   typecheck:
     name: Typecheck

.github/workflows/harness.yml

@@ -115,19 +115,28 @@ jobs:
     name: "Harness: Python"
     needs: build
     runs-on: ubuntu-latest
+    env:
+      UV_MALWARE_CHECK: "1"
+      UV_PREVIEW_FEATURES: "audit-command,malware-check"
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Python supply-chain guard self-test
+        run: bash scripts/check-python-supply-chain_test.sh
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
+          version: "0.11.26"
           # uv owns the frozen dependency cache; a pip cache is absent after uv sync.
           cache-dependency-glob: python/uv.lock
           enable-cache: true
       - name: Verify uv.lock is up to date
         working-directory: python
         run: uv lock --check
+      - name: Audit locked Python dependencies
+        working-directory: python
+        run: uv audit --frozen
       - name: Install Python SDK (frozen)
         working-directory: python
         # Install from the committed uv.lock (not a floating `pip install -e`) so

.github/workflows/pypi-publish.yml

@@ -76,6 +76,9 @@ jobs:
     permissions:
       contents: write
       id-token: write # PyPI Trusted Publishing (OIDC)
+    env:
+      UV_MALWARE_CHECK: "1"
+      UV_PREVIEW_FEATURES: "audit-command,malware-check"
 
     steps:
       - name: Checkout repository
@@ -89,8 +92,26 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.11"
+
       - name: Setup uv
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
+        with:
+          version: "0.11.26"
+
+      - name: Verify release lock
+        working-directory: python
+        run: uv lock --check
+
+      - name: Audit locked Python dependencies
+        working-directory: python
+        run: uv audit --frozen
+
+      - name: Install locked release tooling
+        working-directory: python
+        run: uv sync --frozen --no-install-project --extra release
 
       - name: Get version
         id: version
@@ -122,7 +143,7 @@ jobs:
         working-directory: python
         run: |
           rm -rf dist
-          uv build
+          uv build --no-build-isolation
           ls -la dist
 
       # Guard - the long description (README) must render on PyPI, and the
@@ -131,7 +152,7 @@ jobs:
       - name: Guard - README renders + package present
         working-directory: python
         run: |
-          uvx twine check --strict dist/*
+          uv run --frozen --no-sync twine check --strict dist/*
           tarball=$(ls dist/*.tar.gz)
           if ! tar -tzf "$tarball" | grep -q "/solana_pay_kit/__init__.py$"; then
             echo "FAIL: sdist is missing the solana_pay_kit package"

.github/workflows/python.yml

@@ -12,26 +12,38 @@ jobs:
   test-python:
     name: Python tests
     runs-on: ubuntu-latest
+    env:
+      UV_MALWARE_CHECK: "1"
+      UV_PREVIEW_FEATURES: "audit-command,malware-check"
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Python supply-chain guard self-test
+        run: bash scripts/check-python-supply-chain_test.sh
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
+          version: "0.11.26"
           # uv owns the frozen dependency cache; a pip cache is absent after uv sync.
           cache-dependency-glob: python/uv.lock
           enable-cache: true
       - name: Verify uv.lock is up to date
         working-directory: python
         run: uv lock --check
+      - name: Audit locked Python dependencies
+        working-directory: python
+        run: uv audit --frozen
       - name: Install Python SDK (frozen)
         working-directory: python
         # Install from the committed uv.lock (not a floating `pip install -e`) so
         # the release-gating Python CI is reproducible like every other SDK gate.
         # Framework extras bring fastapi/flask/django so the solana_pay_kit shim
         # tests import and pyright can resolve them; dev brings ruff, pyright, pytest.
         run: uv sync --frozen --extra dev --extra fastapi --extra flask --extra django
+      - name: Verify Python docs tooling
+        working-directory: python
+        run: uv run --frozen pydoc-markdown >/dev/null
       - name: Lint with ruff
         working-directory: python
         run: uv run ruff check src tests
@@ -64,13 +76,17 @@ jobs:
     name: Python harness matrix
     runs-on: ubuntu-latest
     needs: test-python
+    env:
+      UV_MALWARE_CHECK: "1"
+      UV_PREVIEW_FEATURES: "audit-command,malware-check"
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
+          version: "0.11.26"
           # uv owns the frozen dependency cache; a pip cache is absent after uv sync.
           cache-dependency-glob: python/uv.lock
           enable-cache: true

python/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling==1.29.0"]
 build-backend = "hatchling.build"
 
 [project]
@@ -37,6 +37,14 @@ dev = [
     "pyright>=1.1",
     "pydoc-markdown>=4.8",
 ]
+# The publish job installs these from uv.lock before entering its privileged
+# build/upload steps; keep release tooling out of the runtime and dev extras.
+release = ["hatchling==1.29.0", "twine==6.2.0"]
+
+[tool.uv]
+# docspec-python 2.2.1 has a stale Black <24 cap. Keep the docs-only
+# dependency on a patched release and exercise compatibility via docs-py.
+override-dependencies = ["black==26.5.1"]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/solana_pay_kit"]